cpython-lru_cache-weakref: Modules/

annotate Modules/_ssl.c @ 80661:94de77bd0b4b 2.7

Issue #16194: document imp.load_dynamic problems when read several extension modules from the same binary object file.

author	Andrew Svetlov <andrew.svetlov@gmail.com>
date	Thu, 29 Nov 2012 19:51:28 +0200
parents	ba1c48f8b571
children	d7e22acb2315

rev	line source
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1 /* SSL socket module
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	2
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3 SSL support based on patches by Brian E Gallew and Laszlo Kovacs.
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	4 Re-worked a bit by Bill Janssen to add server-side support and
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	5 certificate decoding. Chris Stawarz contributed some non-blocking
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	6 patches.
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	7
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	8 This module is imported by ssl.py. It should not be used
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	9 directly.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	10
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	11 XXX should partial writes be enabled, SSL_MODE_ENABLE_PARTIAL_WRITE?
60900 0ec16d831990 Merged revisions 80392 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60816 diff changeset	12
0ec16d831990 Merged revisions 80392 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60816 diff changeset	13 XXX integrate several "shutdown modes" as suggested in
0ec16d831990 Merged revisions 80392 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60816 diff changeset	14 http://bugs.python.org/issue8108#msg102867 ?
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	15 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	16
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	17 #include "Python.h"
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	18
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	19 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	20 #include "pythread.h"
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	21 #define PySSL_BEGIN_ALLOW_THREADS { \
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	22 PyThreadState *_save = NULL; \
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	23 if (_ssl_locks_count>0) {_save = PyEval_SaveThread();}
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	24 #define PySSL_BLOCK_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save)};
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	25 #define PySSL_UNBLOCK_THREADS if (_ssl_locks_count>0){_save = PyEval_SaveThread()};
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	26 #define PySSL_END_ALLOW_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save);} \
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	27 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	28
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	29 #else /* no WITH_THREAD */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	30
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	31 #define PySSL_BEGIN_ALLOW_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	32 #define PySSL_BLOCK_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	33 #define PySSL_UNBLOCK_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	34 #define PySSL_END_ALLOW_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	35
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	36 #endif
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	37
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	38 enum py_ssl_error {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	39 /* these mirror ssl.h */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	40 PY_SSL_ERROR_NONE,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	41 PY_SSL_ERROR_SSL,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	42 PY_SSL_ERROR_WANT_READ,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	43 PY_SSL_ERROR_WANT_WRITE,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	44 PY_SSL_ERROR_WANT_X509_LOOKUP,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	45 PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	46 PY_SSL_ERROR_ZERO_RETURN,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	47 PY_SSL_ERROR_WANT_CONNECT,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	48 /* start of non ssl.h errorcodes */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	49 PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	50 PY_SSL_ERROR_INVALID_ERROR_CODE
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	51 };
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	52
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	53 enum py_ssl_server_or_client {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	54 PY_SSL_CLIENT,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	55 PY_SSL_SERVER
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	56 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	57
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	58 enum py_ssl_cert_requirements {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	59 PY_SSL_CERT_NONE,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	60 PY_SSL_CERT_OPTIONAL,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	61 PY_SSL_CERT_REQUIRED
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	62 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	63
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	64 enum py_ssl_version {
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	65 #ifndef OPENSSL_NO_SSL2
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	66 PY_SSL_VERSION_SSL2,
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	67 #endif
3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	68 PY_SSL_VERSION_SSL3=1,
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	69 PY_SSL_VERSION_SSL23,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	70 PY_SSL_VERSION_TLS1
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	71 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	72
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	73 /* Include symbols from _socket module */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	74 #include "socketmodule.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	75
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	76 #if defined(HAVE_POLL_H)
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	77 #include <poll.h>
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	78 #elif defined(HAVE_SYS_POLL_H)
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	79 #include <sys/poll.h>
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	80 #endif
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	81
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	82 /* Include OpenSSL header files */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	83 #include "openssl/rsa.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	84 #include "openssl/crypto.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	85 #include "openssl/x509.h"
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	86 #include "openssl/x509v3.h"
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	87 #include "openssl/pem.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	88 #include "openssl/ssl.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	89 #include "openssl/err.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	90 #include "openssl/rand.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	91
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	92 /* SSL error object */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	93 static PyObject *PySSLErrorObject;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	94
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	95 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	96
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	97 /* serves as a flag to see whether we've initialized the SSL thread support. */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	98 /* 0 means no, greater than 0 means yes */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	99
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	100 static unsigned int _ssl_locks_count = 0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	101
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	102 #endif /* def WITH_THREAD */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	103
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	104 /* SSL socket object */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	105
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	106 #define X509_NAME_MAXLEN 256
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	107
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	108 /* RAND_* APIs got added to OpenSSL in 0.9.5 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	109 #if OPENSSL_VERSION_NUMBER >= 0x0090500fL
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	110 # define HAVE_OPENSSL_RAND 1
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	111 #else
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	112 # undef HAVE_OPENSSL_RAND
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	113 #endif
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	114
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	115 typedef struct {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	116 PyObject_HEAD
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	117 PySocketSockObject Socket; / Socket on which we're layered */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	118 SSL_CTX* ctx;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	119 SSL* ssl;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	120 X509* peer_cert;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	121 char server[X509_NAME_MAXLEN];
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	122 char issuer[X509_NAME_MAXLEN];
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	123 int shutdown_seen_zero;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	124
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	125 } PySSLObject;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	126
24280 1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	127 static PyTypeObject PySSL_Type;
1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	128 static PyObject PySSL_SSLwrite(PySSLObject self, PyObject *args);
1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	129 static PyObject PySSL_SSLread(PySSLObject self, PyObject *args);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	130 static int check_socket_and_wait_for_timeout(PySocketSockObject *s,
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	131 int writing);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	132 static PyObject PySSL_peercert(PySSLObject self, PyObject *args);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	133 static PyObject PySSL_cipher(PySSLObject self);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	134
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	135 #define PySSLObject_Check(v) (Py_TYPE(v) == &PySSL_Type)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	136
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	137 typedef enum {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	138 SOCKET_IS_NONBLOCKING,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	139 SOCKET_IS_BLOCKING,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	140 SOCKET_HAS_TIMED_OUT,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	141 SOCKET_HAS_BEEN_CLOSED,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	142 SOCKET_TOO_LARGE_FOR_SELECT,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	143 SOCKET_OPERATION_OK
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	144 } timeout_state;
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	145
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	146 /* Wrap error strings with filename and line # */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	147 #define STRINGIFY1(x) #x
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	148 #define STRINGIFY2(x) STRINGIFY1(x)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	149 #define ERRSTR1(x,y,z) (x ":" y ": " z)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	150 #define ERRSTR(x) ERRSTR1("_ssl.c", STRINGIFY2(__LINE__), x)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	151
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	152 /* XXX It might be helpful to augment the error message generated
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	153 below with the name of the SSL function that generated the error.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	154 I expect it's obvious most of the time.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	155 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	156
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	157 static PyObject *
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	158 PySSL_SetError(PySSLObject obj, int ret, char filename, int lineno)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	159 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	160 PyObject *v;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	161 char buf[2048];
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	162 char *errstr;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	163 int err;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	164 enum py_ssl_error p = PY_SSL_ERROR_NONE;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	165
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	166 assert(ret <= 0);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	167
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	168 if (obj->ssl != NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	169 err = SSL_get_error(obj->ssl, ret);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	170
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	171 switch (err) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	172 case SSL_ERROR_ZERO_RETURN:
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	173 errstr = "TLS/SSL connection has been closed";
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	174 p = PY_SSL_ERROR_ZERO_RETURN;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	175 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	176 case SSL_ERROR_WANT_READ:
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	177 errstr = "The operation did not complete (read)";
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	178 p = PY_SSL_ERROR_WANT_READ;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	179 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	180 case SSL_ERROR_WANT_WRITE:
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	181 p = PY_SSL_ERROR_WANT_WRITE;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	182 errstr = "The operation did not complete (write)";
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	183 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	184 case SSL_ERROR_WANT_X509_LOOKUP:
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	185 p = PY_SSL_ERROR_WANT_X509_LOOKUP;
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	186 errstr = "The operation did not complete (X509 lookup)";
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	187 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	188 case SSL_ERROR_WANT_CONNECT:
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	189 p = PY_SSL_ERROR_WANT_CONNECT;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	190 errstr = "The operation did not complete (connect)";
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	191 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	192 case SSL_ERROR_SYSCALL:
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	193 {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	194 unsigned long e = ERR_get_error();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	195 if (e == 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	196 if (ret == 0 \|\| !obj->Socket) {
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	197 p = PY_SSL_ERROR_EOF;
013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	198 errstr = "EOF occurred in violation of protocol";
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	199 } else if (ret == -1) {
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	200 /* underlying BIO reported an I/O error */
61645 c17783aedcb8 Merged revisions 81241 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61536 diff changeset	201 ERR_clear_error();
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	202 return obj->Socket->errorhandler();
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	203 } else { /* possible? */
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	204 p = PY_SSL_ERROR_SYSCALL;
013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	205 errstr = "Some I/O error occurred";
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	206 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	207 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	208 p = PY_SSL_ERROR_SYSCALL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	209 /* XXX Protected by global interpreter lock */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	210 errstr = ERR_error_string(e, NULL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	211 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	212 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	213 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	214 case SSL_ERROR_SSL:
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	215 {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	216 unsigned long e = ERR_get_error();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	217 p = PY_SSL_ERROR_SSL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	218 if (e != 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	219 /* XXX Protected by global interpreter lock */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	220 errstr = ERR_error_string(e, NULL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	221 else { /* possible? */
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	222 errstr = "A failure in the SSL library occurred";
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	223 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	224 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	225 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	226 default:
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	227 p = PY_SSL_ERROR_INVALID_ERROR_CODE;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	228 errstr = "Invalid error code";
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	229 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	230 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	231 errstr = ERR_error_string(ERR_peek_last_error(), NULL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	232 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	233 PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);
61645 c17783aedcb8 Merged revisions 81241 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61536 diff changeset	234 ERR_clear_error();
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	235 v = Py_BuildValue("(is)", p, buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	236 if (v != NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	237 PyErr_SetObject(PySSLErrorObject, v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	238 Py_DECREF(v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	239 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	240 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	241 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	242
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	243 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	244 _setSSLError (char errstr, int errcode, char filename, int lineno) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	245
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	246 char buf[2048];
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	247 PyObject *v;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	248
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	249 if (errstr == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	250 errcode = ERR_peek_last_error();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	251 errstr = ERR_error_string(errcode, NULL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	252 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	253 PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);
61645 c17783aedcb8 Merged revisions 81241 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61536 diff changeset	254 ERR_clear_error();
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	255 v = Py_BuildValue("(is)", errcode, buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	256 if (v != NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	257 PyErr_SetObject(PySSLErrorObject, v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	258 Py_DECREF(v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	259 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	260 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	261 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	262
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	263 static PySSLObject *
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	264 newPySSLObject(PySocketSockObject Sock, char key_file, char *cert_file,
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	265 enum py_ssl_server_or_client socket_type,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	266 enum py_ssl_cert_requirements certreq,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	267 enum py_ssl_version proto_version,
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	268 char cacerts_file, char ciphers)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	269 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	270 PySSLObject *self;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	271 char *errstr = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	272 int ret;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	273 int verification_mode;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	274
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	275 self = PyObject_New(PySSLObject, &PySSL_Type); /* Create new object */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	276 if (self == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	277 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	278 memset(self->server, '\0', sizeof(char) * X509_NAME_MAXLEN);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	279 memset(self->issuer, '\0', sizeof(char) * X509_NAME_MAXLEN);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	280 self->peer_cert = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	281 self->ssl = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	282 self->ctx = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	283 self->Socket = NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	284
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	285 /* Make sure the SSL error state is initialized */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	286 (void) ERR_get_state();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	287 ERR_clear_error();
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	288
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	289 if ((key_file && !cert_file) \|\| (!key_file && cert_file)) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	290 errstr = ERRSTR("Both the key & certificate files "
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	291 "must be specified");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	292 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	293 }
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	294
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	295 if ((socket_type == PY_SSL_SERVER) &&
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	296 ((key_file == NULL) \|\| (cert_file == NULL))) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	297 errstr = ERRSTR("Both the key & certificate files "
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	298 "must be specified for server-side operation");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	299 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	300 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	301
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	302 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	303 if (proto_version == PY_SSL_VERSION_TLS1)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	304 self->ctx = SSL_CTX_new(TLSv1_method()); /* Set up context */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	305 else if (proto_version == PY_SSL_VERSION_SSL3)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	306 self->ctx = SSL_CTX_new(SSLv3_method()); /* Set up context */
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	307 #ifndef OPENSSL_NO_SSL2
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	308 else if (proto_version == PY_SSL_VERSION_SSL2)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	309 self->ctx = SSL_CTX_new(SSLv2_method()); /* Set up context */
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	310 #endif
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	311 else if (proto_version == PY_SSL_VERSION_SSL23)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	312 self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	313 PySSL_END_ALLOW_THREADS
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	314
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	315 if (self->ctx == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	316 errstr = ERRSTR("Invalid SSL protocol variant specified.");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	317 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	318 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	319
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	320 if (ciphers != NULL) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	321 ret = SSL_CTX_set_cipher_list(self->ctx, ciphers);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	322 if (ret == 0) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	323 errstr = ERRSTR("No cipher can be selected.");
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	324 goto fail;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	325 }
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	326 }
60659 7462e752f0fa Issue #8322: Add a ciphers argument to SSL sockets, so as to change the Antoine Pitrou <solipsis@pitrou.net> parents: 60466 diff changeset	327
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	328 if (certreq != PY_SSL_CERT_NONE) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	329 if (cacerts_file == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	330 errstr = ERRSTR("No root certificates specified for "
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	331 "verification of other-side certificates.");
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	332 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	333 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	334 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	335 ret = SSL_CTX_load_verify_locations(self->ctx,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	336 cacerts_file,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	337 NULL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	338 PySSL_END_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	339 if (ret != 1) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	340 _setSSLError(NULL, 0, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	341 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	342 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	343 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	344 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	345 if (key_file) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	346 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	347 ret = SSL_CTX_use_PrivateKey_file(self->ctx, key_file,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	348 SSL_FILETYPE_PEM);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	349 PySSL_END_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	350 if (ret != 1) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	351 _setSSLError(NULL, ret, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	352 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	353 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	354
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	355 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	356 ret = SSL_CTX_use_certificate_chain_file(self->ctx,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	357 cert_file);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	358 PySSL_END_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	359 if (ret != 1) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	360 /*
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	361 fprintf(stderr, "ret is %d, errcode is %lu, %lu, with file \"%s\"\n",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	362 ret, ERR_peek_error(), ERR_peek_last_error(), cert_file);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	363 */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	364 if (ERR_peek_last_error() != 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	365 _setSSLError(NULL, ret, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	366 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	367 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	368 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	369 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	370
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	371 /* ssl compatibility */
74645 9a4131ada792 Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. Antoine Pitrou <solipsis@pitrou.net> parents: 63701 diff changeset	372 SSL_CTX_set_options(self->ctx,
9a4131ada792 Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. Antoine Pitrou <solipsis@pitrou.net> parents: 63701 diff changeset	373 SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	374
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	375 verification_mode = SSL_VERIFY_NONE;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	376 if (certreq == PY_SSL_CERT_OPTIONAL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	377 verification_mode = SSL_VERIFY_PEER;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	378 else if (certreq == PY_SSL_CERT_REQUIRED)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	379 verification_mode = (SSL_VERIFY_PEER \|
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	380 SSL_VERIFY_FAIL_IF_NO_PEER_CERT);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	381 SSL_CTX_set_verify(self->ctx, verification_mode,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	382 NULL); /* set verify lvl */
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	383
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	384 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	385 self->ssl = SSL_new(self->ctx); /* New ssl struct */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	386 PySSL_END_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	387 SSL_set_fd(self->ssl, Sock->sock_fd); /* Set the socket for SSL */
60463 24d7f55400d3 Merged revisions 79910 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60036 diff changeset	388 #ifdef SSL_MODE_AUTO_RETRY
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	389 SSL_set_mode(self->ssl, SSL_MODE_AUTO_RETRY);
60463 24d7f55400d3 Merged revisions 79910 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60036 diff changeset	390 #endif
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	391
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	392 /* If the socket is in non-blocking mode or timeout mode, set the BIO
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	393 * to non-blocking mode (blocking is the default)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	394 */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	395 if (Sock->sock_timeout >= 0.0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	396 /* Set both the read and write BIO's to non-blocking mode */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	397 BIO_set_nbio(SSL_get_rbio(self->ssl), 1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	398 BIO_set_nbio(SSL_get_wbio(self->ssl), 1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	399 }
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	400
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	401 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	402 if (socket_type == PY_SSL_CLIENT)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	403 SSL_set_connect_state(self->ssl);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	404 else
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	405 SSL_set_accept_state(self->ssl);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	406 PySSL_END_ALLOW_THREADS
24398 c7ed925c75b3 Patch #575827: allow threads inside SSL creation. Martin v. Löwis <martin@v.loewis.de> parents: 24280 diff changeset	407
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	408 self->Socket = Sock;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	409 Py_INCREF(self->Socket);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	410 return self;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	411 fail:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	412 if (errstr)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	413 PyErr_SetString(PySSLErrorObject, errstr);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	414 Py_DECREF(self);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	415 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	416 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	417
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	418 static PyObject *
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	419 PySSL_sslwrap(PyObject self, PyObject args)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	420 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	421 PySocketSockObject *Sock;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	422 int server_side = 0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	423 int verification_mode = PY_SSL_CERT_NONE;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	424 int protocol = PY_SSL_VERSION_SSL23;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	425 char *key_file = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	426 char *cert_file = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	427 char *cacerts_file = NULL;
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	428 char *ciphers = NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	429
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	430 if (!PyArg_ParseTuple(args, "O!i\|zziizz:sslwrap",
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	431 PySocketModule.Sock_Type,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	432 &Sock,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	433 &server_side,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	434 &key_file, &cert_file,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	435 &verification_mode, &protocol,
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	436 &cacerts_file, &ciphers))
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	437 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	438
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	439 /*
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	440 fprintf(stderr,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	441 "server_side is %d, keyfile %p, certfile %p, verify_mode %d, "
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	442 "protocol %d, certs %p\n",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	443 server_side, key_file, cert_file, verification_mode,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	444 protocol, cacerts_file);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	445 */
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	446
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	447 return (PyObject *) newPySSLObject(Sock, key_file, cert_file,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	448 server_side, verification_mode,
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	449 protocol, cacerts_file,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	450 ciphers);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	451 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	452
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	453 PyDoc_STRVAR(ssl_doc,
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	454 "sslwrap(socket, server_side, [keyfile, certfile, certs_mode, protocol,\n"
60659 7462e752f0fa Issue #8322: Add a ciphers argument to SSL sockets, so as to change the Antoine Pitrou <solipsis@pitrou.net> parents: 60466 diff changeset	455 " cacertsfile, ciphers]) -> sslobject");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	456
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	457 /* SSL object methods */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	458
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	459 static PyObject PySSL_SSLdo_handshake(PySSLObject self)
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	460 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	461 int ret;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	462 int err;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	463 int sockstate, nonblocking;
60934 ce4916ca06dd Merged revisions 80451-80452 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60900 diff changeset	464
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	465 /* just in case the blocking state of the socket has been changed */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	466 nonblocking = (self->Socket->sock_timeout >= 0.0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	467 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	468 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	469
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	470 /* Actually negotiate SSL connection */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	471 /* XXX If SSL_do_handshake() returns 0, it's also a failure. */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	472 do {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	473 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	474 ret = SSL_do_handshake(self->ssl);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	475 err = SSL_get_error(self->ssl, ret);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	476 PySSL_END_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	477 if(PyErr_CheckSignals()) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	478 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	479 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	480 if (err == SSL_ERROR_WANT_READ) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	481 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	482 } else if (err == SSL_ERROR_WANT_WRITE) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	483 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	484 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	485 sockstate = SOCKET_OPERATION_OK;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	486 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	487 if (sockstate == SOCKET_HAS_TIMED_OUT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	488 PyErr_SetString(PySSLErrorObject,
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	489 ERRSTR("The handshake operation timed out"));
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	490 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	491 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	492 PyErr_SetString(PySSLErrorObject,
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	493 ERRSTR("Underlying socket has been closed."));
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	494 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	495 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	496 PyErr_SetString(PySSLErrorObject,
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	497 ERRSTR("Underlying socket too large for select()."));
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	498 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	499 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	500 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	501 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	502 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	503 if (ret < 1)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	504 return PySSL_SetError(self, ret, __FILE__, __LINE__);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	505
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	506 if (self->peer_cert)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	507 X509_free (self->peer_cert);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	508 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	509 if ((self->peer_cert = SSL_get_peer_certificate(self->ssl))) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	510 X509_NAME_oneline(X509_get_subject_name(self->peer_cert),
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	511 self->server, X509_NAME_MAXLEN);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	512 X509_NAME_oneline(X509_get_issuer_name(self->peer_cert),
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	513 self->issuer, X509_NAME_MAXLEN);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	514 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	515 PySSL_END_ALLOW_THREADS
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	516
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	517 Py_INCREF(Py_None);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	518 return Py_None;
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	519 }
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	520
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	521 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	522 PySSL_server(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	523 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	524 return PyString_FromString(self->server);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	525 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	526
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	527 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	528 PySSL_issuer(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	529 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	530 return PyString_FromString(self->issuer);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	531 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	532
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	533 static PyObject *
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	534 _create_tuple_for_attribute (ASN1_OBJECT name, ASN1_STRING value) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	535
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	536 char namebuf[X509_NAME_MAXLEN];
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	537 int buflen;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	538 PyObject *name_obj;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	539 PyObject *value_obj;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	540 PyObject *attr;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	541 unsigned char *valuebuf = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	542
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	543 buflen = OBJ_obj2txt(namebuf, sizeof(namebuf), name, 0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	544 if (buflen < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	545 _setSSLError(NULL, 0, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	546 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	547 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	548 name_obj = PyString_FromStringAndSize(namebuf, buflen);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	549 if (name_obj == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	550 goto fail;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	551
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	552 buflen = ASN1_STRING_to_UTF8(&valuebuf, value);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	553 if (buflen < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	554 _setSSLError(NULL, 0, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	555 Py_DECREF(name_obj);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	556 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	557 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	558 value_obj = PyUnicode_DecodeUTF8((char *) valuebuf,
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	559 buflen, "strict");
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	560 OPENSSL_free(valuebuf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	561 if (value_obj == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	562 Py_DECREF(name_obj);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	563 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	564 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	565 attr = PyTuple_New(2);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	566 if (attr == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	567 Py_DECREF(name_obj);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	568 Py_DECREF(value_obj);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	569 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	570 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	571 PyTuple_SET_ITEM(attr, 0, name_obj);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	572 PyTuple_SET_ITEM(attr, 1, value_obj);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	573 return attr;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	574
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	575 fail:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	576 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	577 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	578
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	579 static PyObject *
43243 e2b4fc960830 SSL certificate distinguished names should be represented by tuples Bill Janssen <janssen@parc.com> parents: 42908 diff changeset	580 _create_tuple_for_X509_NAME (X509_NAME *xname)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	581 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	582 PyObject dn = NULL; / tuple which represents the "distinguished name" */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	583 PyObject rdn = NULL; / tuple to hold a "relative distinguished name" */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	584 PyObject *rdnt;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	585 PyObject attr = NULL; / tuple to hold an attribute */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	586 int entry_count = X509_NAME_entry_count(xname);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	587 X509_NAME_ENTRY *entry;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	588 ASN1_OBJECT *name;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	589 ASN1_STRING *value;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	590 int index_counter;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	591 int rdn_level = -1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	592 int retcode;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	593
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	594 dn = PyList_New(0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	595 if (dn == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	596 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	597 /* now create another tuple to hold the top-level RDN */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	598 rdn = PyList_New(0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	599 if (rdn == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	600 goto fail0;
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	601
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	602 for (index_counter = 0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	603 index_counter < entry_count;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	604 index_counter++)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	605 {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	606 entry = X509_NAME_get_entry(xname, index_counter);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	607
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	608 /* check to see if we've gotten to a new RDN */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	609 if (rdn_level >= 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	610 if (rdn_level != entry->set) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	611 /* yes, new RDN */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	612 /* add old RDN to DN */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	613 rdnt = PyList_AsTuple(rdn);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	614 Py_DECREF(rdn);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	615 if (rdnt == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	616 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	617 retcode = PyList_Append(dn, rdnt);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	618 Py_DECREF(rdnt);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	619 if (retcode < 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	620 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	621 /* create new RDN */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	622 rdn = PyList_New(0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	623 if (rdn == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	624 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	625 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	626 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	627 rdn_level = entry->set;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	628
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	629 /* now add this attribute to the current RDN */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	630 name = X509_NAME_ENTRY_get_object(entry);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	631 value = X509_NAME_ENTRY_get_data(entry);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	632 attr = _create_tuple_for_attribute(name, value);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	633 /*
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	634 fprintf(stderr, "RDN level %d, attribute %s: %s\n",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	635 entry->set,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	636 PyString_AS_STRING(PyTuple_GET_ITEM(attr, 0)),
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	637 PyString_AS_STRING(PyTuple_GET_ITEM(attr, 1)));
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	638 */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	639 if (attr == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	640 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	641 retcode = PyList_Append(rdn, attr);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	642 Py_DECREF(attr);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	643 if (retcode < 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	644 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	645 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	646 /* now, there's typically a dangling RDN */
74965 111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	647 if (rdn != NULL) {
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	648 if (PyList_GET_SIZE(rdn) > 0) {
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	649 rdnt = PyList_AsTuple(rdn);
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	650 Py_DECREF(rdn);
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	651 if (rdnt == NULL)
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	652 goto fail0;
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	653 retcode = PyList_Append(dn, rdnt);
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	654 Py_DECREF(rdnt);
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	655 if (retcode < 0)
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	656 goto fail0;
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	657 }
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	658 else {
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	659 Py_DECREF(rdn);
111dcae41ff7 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74646 diff changeset	660 }
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	661 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	662
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	663 /* convert list to tuple */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	664 rdnt = PyList_AsTuple(dn);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	665 Py_DECREF(dn);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	666 if (rdnt == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	667 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	668 return rdnt;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	669
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	670 fail1:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	671 Py_XDECREF(rdn);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	672
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	673 fail0:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	674 Py_XDECREF(dn);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	675 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	676 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	677
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	678 static PyObject *
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	679 _get_peer_alt_names (X509 *certificate) {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	680
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	681 /* this code follows the procedure outlined in
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	682 OpenSSL's crypto/x509v3/v3_prn.c:X509v3_EXT_print()
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	683 function to extract the STACK_OF(GENERAL_NAME),
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	684 then iterates through the stack to add the
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	685 names. */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	686
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	687 int i, j;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	688 PyObject *peer_alt_names = Py_None;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	689 PyObject v, t;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	690 X509_EXTENSION *ext = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	691 GENERAL_NAMES *names = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	692 GENERAL_NAME *name;
65269 f2f7b70fc5eb Merged revisions 85432 via svnmerge from Benjamin Peterson <benjamin@python.org> parents: 63695 diff changeset	693 const X509V3_EXT_METHOD *method;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	694 BIO *biobuf = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	695 char buf[2048];
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	696 char *vptr;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	697 int len;
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	698 /* Issue #2973: ASN1_item_d2i() API changed in OpenSSL 0.9.6m */
59276 c31a7c0c6399 Issue #2973: Fix gcc warning on the 2nd argument of ASN1_item_d2i() and Victor Stinner <victor.stinner@haypocalc.com> parents: 56626 diff changeset	699 #if OPENSSL_VERSION_NUMBER >= 0x009060dfL
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	700 const unsigned char *p;
59276 c31a7c0c6399 Issue #2973: Fix gcc warning on the 2nd argument of ASN1_item_d2i() and Victor Stinner <victor.stinner@haypocalc.com> parents: 56626 diff changeset	701 #else
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	702 unsigned char *p;
59276 c31a7c0c6399 Issue #2973: Fix gcc warning on the 2nd argument of ASN1_item_d2i() and Victor Stinner <victor.stinner@haypocalc.com> parents: 56626 diff changeset	703 #endif
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	704
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	705 if (certificate == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	706 return peer_alt_names;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	707
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	708 /* get a memory buffer */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	709 biobuf = BIO_new(BIO_s_mem());
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	710
72569 8e6694387c98 Issue #13034: When decoding some SSL certificates, the subjectAltName extension could be unreported. Antoine Pitrou <solipsis@pitrou.net> parents: 72113 diff changeset	711 i = -1;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	712 while ((i = X509_get_ext_by_NID(
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	713 certificate, NID_subject_alt_name, i)) >= 0) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	714
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	715 if (peer_alt_names == Py_None) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	716 peer_alt_names = PyList_New(0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	717 if (peer_alt_names == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	718 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	719 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	720
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	721 /* now decode the altName */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	722 ext = X509_get_ext(certificate, i);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	723 if(!(method = X509V3_EXT_get(ext))) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	724 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	725 ERRSTR("No method for internalizing subjectAltName!"));
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	726 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	727 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	728
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	729 p = ext->value->data;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	730 if (method->it)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	731 names = (GENERAL_NAMES*) (ASN1_item_d2i(NULL,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	732 &p,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	733 ext->value->length,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	734 ASN1_ITEM_ptr(method->it)));
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	735 else
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	736 names = (GENERAL_NAMES*) (method->d2i(NULL,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	737 &p,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	738 ext->value->length));
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	739
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	740 for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	741
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	742 /* get a rendering of each name in the set of names */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	743
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	744 name = sk_GENERAL_NAME_value(names, j);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	745 if (name->type == GEN_DIRNAME) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	746
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	747 /* we special-case DirName as a tuple of tuples of attributes */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	748
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	749 t = PyTuple_New(2);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	750 if (t == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	751 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	752 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	753
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	754 v = PyString_FromString("DirName");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	755 if (v == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	756 Py_DECREF(t);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	757 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	758 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	759 PyTuple_SET_ITEM(t, 0, v);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	760
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	761 v = _create_tuple_for_X509_NAME (name->d.dirn);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	762 if (v == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	763 Py_DECREF(t);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	764 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	765 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	766 PyTuple_SET_ITEM(t, 1, v);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	767
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	768 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	769
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	770 /* for everything else, we use the OpenSSL print form */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	771
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	772 (void) BIO_reset(biobuf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	773 GENERAL_NAME_print(biobuf, name);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	774 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	775 if (len < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	776 _setSSLError(NULL, 0, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	777 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	778 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	779 vptr = strchr(buf, ':');
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	780 if (vptr == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	781 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	782 t = PyTuple_New(2);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	783 if (t == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	784 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	785 v = PyString_FromStringAndSize(buf, (vptr - buf));
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	786 if (v == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	787 Py_DECREF(t);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	788 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	789 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	790 PyTuple_SET_ITEM(t, 0, v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	791 v = PyString_FromStringAndSize((vptr + 1), (len - (vptr - buf + 1)));
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	792 if (v == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	793 Py_DECREF(t);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	794 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	795 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	796 PyTuple_SET_ITEM(t, 1, v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	797 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	798
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	799 /* and add that rendering to the list */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	800
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	801 if (PyList_Append(peer_alt_names, t) < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	802 Py_DECREF(t);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	803 goto fail;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	804 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	805 Py_DECREF(t);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	806 }
73713 61a5d44020cd Issue #13458: Fix a memory leak in the ssl module when decoding a certificate with a subjectAltName. Antoine Pitrou <solipsis@pitrou.net> parents: 72569 diff changeset	807 sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	808 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	809 BIO_free(biobuf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	810 if (peer_alt_names != Py_None) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	811 v = PyList_AsTuple(peer_alt_names);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	812 Py_DECREF(peer_alt_names);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	813 return v;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	814 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	815 return peer_alt_names;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	816 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	817
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	818
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	819 fail:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	820 if (biobuf != NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	821 BIO_free(biobuf);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	822
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	823 if (peer_alt_names != Py_None) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	824 Py_XDECREF(peer_alt_names);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	825 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	826
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	827 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	828 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	829
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	830 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	831 _decode_certificate (X509 *certificate, int verbose) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	832
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	833 PyObject *retval = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	834 BIO *biobuf = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	835 PyObject *peer;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	836 PyObject *peer_alt_names = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	837 PyObject *issuer;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	838 PyObject *version;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	839 PyObject *sn_obj;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	840 ASN1_INTEGER *serialNumber;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	841 char buf[2048];
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	842 int len;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	843 ASN1_TIME notBefore, notAfter;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	844 PyObject pnotBefore, pnotAfter;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	845
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	846 retval = PyDict_New();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	847 if (retval == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	848 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	849
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	850 peer = _create_tuple_for_X509_NAME(
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	851 X509_get_subject_name(certificate));
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	852 if (peer == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	853 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	854 if (PyDict_SetItemString(retval, (const char *) "subject", peer) < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	855 Py_DECREF(peer);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	856 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	857 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	858 Py_DECREF(peer);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	859
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	860 if (verbose) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	861 issuer = _create_tuple_for_X509_NAME(
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	862 X509_get_issuer_name(certificate));
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	863 if (issuer == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	864 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	865 if (PyDict_SetItemString(retval, (const char *)"issuer", issuer) < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	866 Py_DECREF(issuer);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	867 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	868 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	869 Py_DECREF(issuer);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	870
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	871 version = PyInt_FromLong(X509_get_version(certificate) + 1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	872 if (PyDict_SetItemString(retval, "version", version) < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	873 Py_DECREF(version);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	874 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	875 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	876 Py_DECREF(version);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	877 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	878
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	879 /* get a memory buffer */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	880 biobuf = BIO_new(BIO_s_mem());
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	881
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	882 if (verbose) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	883
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	884 (void) BIO_reset(biobuf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	885 serialNumber = X509_get_serialNumber(certificate);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	886 /* should not exceed 20 octets, 160 bits, so buf is big enough */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	887 i2a_ASN1_INTEGER(biobuf, serialNumber);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	888 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	889 if (len < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	890 _setSSLError(NULL, 0, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	891 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	892 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	893 sn_obj = PyString_FromStringAndSize(buf, len);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	894 if (sn_obj == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	895 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	896 if (PyDict_SetItemString(retval, "serialNumber", sn_obj) < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	897 Py_DECREF(sn_obj);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	898 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	899 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	900 Py_DECREF(sn_obj);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	901
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	902 (void) BIO_reset(biobuf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	903 notBefore = X509_get_notBefore(certificate);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	904 ASN1_TIME_print(biobuf, notBefore);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	905 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	906 if (len < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	907 _setSSLError(NULL, 0, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	908 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	909 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	910 pnotBefore = PyString_FromStringAndSize(buf, len);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	911 if (pnotBefore == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	912 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	913 if (PyDict_SetItemString(retval, "notBefore", pnotBefore) < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	914 Py_DECREF(pnotBefore);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	915 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	916 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	917 Py_DECREF(pnotBefore);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	918 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	919
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	920 (void) BIO_reset(biobuf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	921 notAfter = X509_get_notAfter(certificate);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	922 ASN1_TIME_print(biobuf, notAfter);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	923 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	924 if (len < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	925 _setSSLError(NULL, 0, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	926 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	927 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	928 pnotAfter = PyString_FromStringAndSize(buf, len);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	929 if (pnotAfter == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	930 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	931 if (PyDict_SetItemString(retval, "notAfter", pnotAfter) < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	932 Py_DECREF(pnotAfter);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	933 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	934 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	935 Py_DECREF(pnotAfter);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	936
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	937 /* Now look for subjectAltName */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	938
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	939 peer_alt_names = _get_peer_alt_names(certificate);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	940 if (peer_alt_names == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	941 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	942 else if (peer_alt_names != Py_None) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	943 if (PyDict_SetItemString(retval, "subjectAltName",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	944 peer_alt_names) < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	945 Py_DECREF(peer_alt_names);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	946 goto fail1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	947 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	948 Py_DECREF(peer_alt_names);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	949 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	950
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	951 BIO_free(biobuf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	952 return retval;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	953
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	954 fail1:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	955 if (biobuf != NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	956 BIO_free(biobuf);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	957 fail0:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	958 Py_XDECREF(retval);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	959 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	960 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	961
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	962
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	963 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	964 PySSL_test_decode_certificate (PyObject mod, PyObject args) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	965
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	966 PyObject *retval = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	967 char *filename = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	968 X509 *x=NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	969 BIO *cert;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	970 int verbose = 1;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	971
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	972 if (!PyArg_ParseTuple(args, "s\|i:test_decode_certificate", &filename, &verbose))
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	973 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	974
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	975 if ((cert=BIO_new(BIO_s_file())) == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	976 PyErr_SetString(PySSLErrorObject, "Can't malloc memory to read file");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	977 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	978 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	979
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	980 if (BIO_read_filename(cert,filename) <= 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	981 PyErr_SetString(PySSLErrorObject, "Can't open file");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	982 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	983 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	984
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	985 x = PEM_read_bio_X509_AUX(cert,NULL, NULL, NULL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	986 if (x == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	987 PyErr_SetString(PySSLErrorObject, "Error decoding PEM-encoded file");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	988 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	989 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	990
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	991 retval = _decode_certificate(x, verbose);
63701 3775bf8299b3 Merged revisions 83680,83685 via svnmerge from Mark Dickinson <dickinsm@gmail.com> parents: 62488 diff changeset	992 X509_free(x);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	993
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	994 fail0:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	995
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	996 if (cert != NULL) BIO_free(cert);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	997 return retval;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	998 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	999
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1000
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1001 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1002 PySSL_peercert(PySSLObject self, PyObject args)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1003 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1004 PyObject *retval = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1005 int len;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1006 int verification;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1007 PyObject *binary_mode = Py_None;
78603 ba1c48f8b571 Issue #15604: Update uses of PyObject_IsTrue() to check for and handle errors correctly. Antoine Pitrou <solipsis@pitrou.net> parents: 74965 diff changeset	1008 int b;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1009
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1010 if (!PyArg_ParseTuple(args, "\|O:peer_certificate", &binary_mode))
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1011 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1012
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1013 if (!self->peer_cert)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1014 Py_RETURN_NONE;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1015
78603 ba1c48f8b571 Issue #15604: Update uses of PyObject_IsTrue() to check for and handle errors correctly. Antoine Pitrou <solipsis@pitrou.net> parents: 74965 diff changeset	1016 b = PyObject_IsTrue(binary_mode);
ba1c48f8b571 Issue #15604: Update uses of PyObject_IsTrue() to check for and handle errors correctly. Antoine Pitrou <solipsis@pitrou.net> parents: 74965 diff changeset	1017 if (b < 0)
ba1c48f8b571 Issue #15604: Update uses of PyObject_IsTrue() to check for and handle errors correctly. Antoine Pitrou <solipsis@pitrou.net> parents: 74965 diff changeset	1018 return NULL;
ba1c48f8b571 Issue #15604: Update uses of PyObject_IsTrue() to check for and handle errors correctly. Antoine Pitrou <solipsis@pitrou.net> parents: 74965 diff changeset	1019 if (b) {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1020 /* return cert in DER-encoded format */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1021
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1022 unsigned char *bytes_buf = NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1023
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1024 bytes_buf = NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1025 len = i2d_X509(self->peer_cert, &bytes_buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1026 if (len < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1027 PySSL_SetError(self, len, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1028 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1029 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1030 retval = PyString_FromStringAndSize((const char *) bytes_buf, len);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1031 OPENSSL_free(bytes_buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1032 return retval;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1033
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1034 } else {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1035
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1036 verification = SSL_CTX_get_verify_mode(self->ctx);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1037 if ((verification & SSL_VERIFY_PEER) == 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1038 return PyDict_New();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1039 else
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1040 return _decode_certificate (self->peer_cert, 0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1041 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1042 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1043
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1044 PyDoc_STRVAR(PySSL_peercert_doc,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1045 "peer_certificate([der=False]) -> certificate\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1046 \n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1047 Returns the certificate for the peer. If no certificate was provided,\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1048 returns None. If a certificate was provided, but not validated, returns\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1049 an empty dictionary. Otherwise returns a dict containing information\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1050 about the peer certificate.\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1051 \n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1052 If the optional argument is True, returns a DER-encoded copy of the\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1053 peer certificate, or None if no certificate was provided. This will\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1054 return the certificate even if it wasn't validated.");
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1055
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1056 static PyObject PySSL_cipher (PySSLObject self) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1057
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1058 PyObject retval, v;
65269 f2f7b70fc5eb Merged revisions 85432 via svnmerge from Benjamin Peterson <benjamin@python.org> parents: 63695 diff changeset	1059 const SSL_CIPHER *current;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1060 char *cipher_name;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1061 char *cipher_protocol;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1062
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1063 if (self->ssl == NULL)
66804 21df8155c770 Merged revisions 87140 via svnmerge from Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> parents: 65269 diff changeset	1064 Py_RETURN_NONE;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1065 current = SSL_get_current_cipher(self->ssl);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1066 if (current == NULL)
66804 21df8155c770 Merged revisions 87140 via svnmerge from Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> parents: 65269 diff changeset	1067 Py_RETURN_NONE;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1068
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1069 retval = PyTuple_New(3);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1070 if (retval == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1071 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1072
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1073 cipher_name = (char *) SSL_CIPHER_get_name(current);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1074 if (cipher_name == NULL) {
66804 21df8155c770 Merged revisions 87140 via svnmerge from Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> parents: 65269 diff changeset	1075 Py_INCREF(Py_None);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1076 PyTuple_SET_ITEM(retval, 0, Py_None);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1077 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1078 v = PyString_FromString(cipher_name);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1079 if (v == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1080 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1081 PyTuple_SET_ITEM(retval, 0, v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1082 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1083 cipher_protocol = SSL_CIPHER_get_version(current);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1084 if (cipher_protocol == NULL) {
66804 21df8155c770 Merged revisions 87140 via svnmerge from Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> parents: 65269 diff changeset	1085 Py_INCREF(Py_None);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1086 PyTuple_SET_ITEM(retval, 1, Py_None);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1087 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1088 v = PyString_FromString(cipher_protocol);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1089 if (v == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1090 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1091 PyTuple_SET_ITEM(retval, 1, v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1092 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1093 v = PyInt_FromLong(SSL_CIPHER_get_bits(current, NULL));
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1094 if (v == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1095 goto fail0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1096 PyTuple_SET_ITEM(retval, 2, v);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1097 return retval;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1098
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1099 fail0:
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1100 Py_DECREF(retval);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1101 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1102 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1103
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1104 static void PySSL_dealloc(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1105 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1106 if (self->peer_cert) /* Possible not to have one? */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1107 X509_free (self->peer_cert);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1108 if (self->ssl)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1109 SSL_free(self->ssl);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1110 if (self->ctx)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1111 SSL_CTX_free(self->ctx);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1112 Py_XDECREF(self->Socket);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1113 PyObject_Del(self);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1114 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1115
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1116 /* If the socket has a timeout, do a select()/poll() on the socket.
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1117 The argument writing indicates the direction.
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1118 Returns one of the possibilities in the timeout_state enum (above).
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1119 */
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1120
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1121 static int
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1122 check_socket_and_wait_for_timeout(PySocketSockObject *s, int writing)
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1123 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1124 fd_set fds;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1125 struct timeval tv;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1126 int rc;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1127
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1128 /* Nothing to do unless we're in timeout mode (not non-blocking) */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1129 if (s->sock_timeout < 0.0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1130 return SOCKET_IS_BLOCKING;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1131 else if (s->sock_timeout == 0.0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1132 return SOCKET_IS_NONBLOCKING;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1133
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1134 /* Guard against closed socket */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1135 if (s->sock_fd < 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1136 return SOCKET_HAS_BEEN_CLOSED;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1137
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1138 /* Prefer poll, if available, since you can poll() any fd
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1139 * which can't be done with select(). */
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1140 #ifdef HAVE_POLL
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1141 {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1142 struct pollfd pollfd;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1143 int timeout;
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1144
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1145 pollfd.fd = s->sock_fd;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1146 pollfd.events = writing ? POLLOUT : POLLIN;
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1147
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1148 /* s->sock_timeout is in seconds, timeout in ms */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1149 timeout = (int)(s->sock_timeout * 1000 + 0.5);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1150 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1151 rc = poll(&pollfd, 1, timeout);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1152 PySSL_END_ALLOW_THREADS
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1153
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1154 goto normal_return;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1155 }
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1156 #endif
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1157
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1158 /* Guard against socket too large for select*/
72113 ff6adb867f40 Issue #12287: Fix a stack corruption in ossaudiodev module when the FD is Charles-François Natali <neologix@free.fr> parents: 70001 diff changeset	1159 if (!_PyIsSelectable_fd(s->sock_fd))
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1160 return SOCKET_TOO_LARGE_FOR_SELECT;
36452 7789cc557e1e Bug #876637, prevent stack corruption when socket descriptor Neal Norwitz <nnorwitz@gmail.com> parents: 36451 diff changeset	1161
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1162 /* Construct the arguments to select */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1163 tv.tv_sec = (int)s->sock_timeout;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1164 tv.tv_usec = (int)((s->sock_timeout - tv.tv_sec) * 1e6);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1165 FD_ZERO(&fds);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1166 FD_SET(s->sock_fd, &fds);
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1167
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1168 /* See if the socket is ready */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1169 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1170 if (writing)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1171 rc = select(s->sock_fd+1, NULL, &fds, NULL, &tv);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1172 else
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1173 rc = select(s->sock_fd+1, &fds, NULL, NULL, &tv);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1174 PySSL_END_ALLOW_THREADS
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1175
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1176 #ifdef HAVE_POLL
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1177 normal_return:
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1178 #endif
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1179 /* Return SOCKET_TIMED_OUT on timeout, SOCKET_OPERATION_OK otherwise
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1180 (when we are able to write or when there's something to read) */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1181 return rc == 0 ? SOCKET_HAS_TIMED_OUT : SOCKET_OPERATION_OK;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1182 }
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1183
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1184 static PyObject PySSL_SSLwrite(PySSLObject self, PyObject *args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1185 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1186 Py_buffer buf;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1187 int len;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1188 int sockstate;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1189 int err;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1190 int nonblocking;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1191
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1192 if (!PyArg_ParseTuple(args, "s*:write", &buf))
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1193 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1194
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1195 /* just in case the blocking state of the socket has been changed */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1196 nonblocking = (self->Socket->sock_timeout >= 0.0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1197 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1198 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1199
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1200 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1201 if (sockstate == SOCKET_HAS_TIMED_OUT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1202 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1203 "The write operation timed out");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1204 goto error;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1205 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1206 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1207 "Underlying socket has been closed.");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1208 goto error;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1209 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1210 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1211 "Underlying socket too large for select().");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1212 goto error;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1213 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1214 do {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1215 PySSL_BEGIN_ALLOW_THREADS
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1216 len = SSL_write(self->ssl, buf.buf, buf.len);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1217 err = SSL_get_error(self->ssl, len);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1218 PySSL_END_ALLOW_THREADS
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1219 if (PyErr_CheckSignals()) {
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1220 goto error;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1221 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1222 if (err == SSL_ERROR_WANT_READ) {
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1223 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1224 } else if (err == SSL_ERROR_WANT_WRITE) {
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1225 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1226 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1227 sockstate = SOCKET_OPERATION_OK;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1228 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1229 if (sockstate == SOCKET_HAS_TIMED_OUT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1230 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1231 "The write operation timed out");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1232 goto error;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1233 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1234 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1235 "Underlying socket has been closed.");
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1236 goto error;
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1237 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1238 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1239 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1240 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
56626 43d0b47106df Issue #7133: SSL objects now support the new buffer API. Antoine Pitrou <solipsis@pitrou.net> parents: 54412 diff changeset	1241
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1242 PyBuffer_Release(&buf);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1243 if (len > 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1244 return PyInt_FromLong(len);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1245 else
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1246 return PySSL_SetError(self, len, __FILE__, __LINE__);
56626 43d0b47106df Issue #7133: SSL objects now support the new buffer API. Antoine Pitrou <solipsis@pitrou.net> parents: 54412 diff changeset	1247
43d0b47106df Issue #7133: SSL objects now support the new buffer API. Antoine Pitrou <solipsis@pitrou.net> parents: 54412 diff changeset	1248 error:
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1249 PyBuffer_Release(&buf);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1250 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1251 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1252
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1253 PyDoc_STRVAR(PySSL_SSLwrite_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1254 "write(s) -> len\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1255 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1256 Writes the string s into the SSL object. Returns the number\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1257 of bytes written.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1258
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1259 static PyObject PySSL_SSLpending(PySSLObject self)
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1260 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1261 int count = 0;
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1262
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1263 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1264 count = SSL_pending(self->ssl);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1265 PySSL_END_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1266 if (count < 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1267 return PySSL_SetError(self, count, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1268 else
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1269 return PyInt_FromLong(count);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1270 }
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1271
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1272 PyDoc_STRVAR(PySSL_SSLpending_doc,
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1273 "pending() -> count\n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1274 \n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1275 Returns the number of already decrypted bytes available for read,\n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1276 pending on the connection.\n");
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1277
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1278 static PyObject PySSL_SSLread(PySSLObject self, PyObject *args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1279 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1280 PyObject *buf;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1281 int count = 0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1282 int len = 1024;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1283 int sockstate;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1284 int err;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1285 int nonblocking;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1286
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1287 if (!PyArg_ParseTuple(args, "\|i:read", &len))
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1288 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1289
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1290 if (!(buf = PyString_FromStringAndSize((char *) 0, len)))
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1291 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1292
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1293 /* just in case the blocking state of the socket has been changed */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1294 nonblocking = (self->Socket->sock_timeout >= 0.0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1295 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1296 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1297
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1298 /* first check if there are bytes ready to be read */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1299 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1300 count = SSL_pending(self->ssl);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1301 PySSL_END_ALLOW_THREADS
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1302
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1303 if (!count) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1304 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1305 if (sockstate == SOCKET_HAS_TIMED_OUT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1306 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1307 "The read operation timed out");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1308 Py_DECREF(buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1309 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1310 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1311 PyErr_SetString(PySSLErrorObject,
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1312 "Underlying socket too large for select().");
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1313 Py_DECREF(buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1314 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1315 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1316 if (SSL_get_shutdown(self->ssl) !=
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1317 SSL_RECEIVED_SHUTDOWN)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1318 {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1319 Py_DECREF(buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1320 PyErr_SetString(PySSLErrorObject,
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1321 "Socket closed without SSL shutdown handshake");
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1322 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1323 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1324 /* should contain a zero-length string */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1325 _PyString_Resize(&buf, 0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1326 return buf;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1327 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1328 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1329 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1330 do {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1331 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1332 count = SSL_read(self->ssl, PyString_AsString(buf), len);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1333 err = SSL_get_error(self->ssl, count);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1334 PySSL_END_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1335 if(PyErr_CheckSignals()) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1336 Py_DECREF(buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1337 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1338 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1339 if (err == SSL_ERROR_WANT_READ) {
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1340 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1341 } else if (err == SSL_ERROR_WANT_WRITE) {
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1342 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1343 } else if ((err == SSL_ERROR_ZERO_RETURN) &&
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1344 (SSL_get_shutdown(self->ssl) ==
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1345 SSL_RECEIVED_SHUTDOWN))
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1346 {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1347 _PyString_Resize(&buf, 0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1348 return buf;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1349 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1350 sockstate = SOCKET_OPERATION_OK;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1351 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1352 if (sockstate == SOCKET_HAS_TIMED_OUT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1353 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1354 "The read operation timed out");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1355 Py_DECREF(buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1356 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1357 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1358 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1359 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1360 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1361 if (count <= 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1362 Py_DECREF(buf);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1363 return PySSL_SetError(self, count, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1364 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1365 if (count != len)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1366 _PyString_Resize(&buf, count);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1367 return buf;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1368 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1369
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1370 PyDoc_STRVAR(PySSL_SSLread_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1371 "read([len]) -> string\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1372 \n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1373 Read up to len bytes from the SSL socket.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1374
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1375 static PyObject PySSL_SSLshutdown(PySSLObject self)
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1376 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1377 int err, ssl_err, sockstate, nonblocking;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1378 int zeros = 0;
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1379
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1380 /* Guard against closed socket */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1381 if (self->Socket->sock_fd < 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1382 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1383 "Underlying socket has been closed.");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1384 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1385 }
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1386
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1387 /* Just in case the blocking state of the socket has been changed */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1388 nonblocking = (self->Socket->sock_timeout >= 0.0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1389 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1390 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
60900 0ec16d831990 Merged revisions 80392 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60816 diff changeset	1391
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1392 while (1) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1393 PySSL_BEGIN_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1394 /* Disable read-ahead so that unwrap can work correctly.
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1395 * Otherwise OpenSSL might read in too much data,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1396 * eating clear text data that happens to be
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1397 * transmitted after the SSL shutdown.
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1398 * Should be safe to call repeatedly everytime this
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1399 * function is used and the shutdown_seen_zero != 0
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1400 * condition is met.
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1401 */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1402 if (self->shutdown_seen_zero)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1403 SSL_set_read_ahead(self->ssl, 0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1404 err = SSL_shutdown(self->ssl);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1405 PySSL_END_ALLOW_THREADS
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1406 /* If err == 1, a secure shutdown with SSL_shutdown() is complete */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1407 if (err > 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1408 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1409 if (err == 0) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1410 /* Don't loop endlessly; instead preserve legacy
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1411 behaviour of trying SSL_shutdown() only twice.
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1412 This looks necessary for OpenSSL < 0.9.8m */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1413 if (++zeros > 1)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1414 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1415 /* Shutdown was sent, now try receiving */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1416 self->shutdown_seen_zero = 1;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1417 continue;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1418 }
60900 0ec16d831990 Merged revisions 80392 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60816 diff changeset	1419
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1420 /* Possibly retry shutdown until timeout or failure */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1421 ssl_err = SSL_get_error(self->ssl, err);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1422 if (ssl_err == SSL_ERROR_WANT_READ)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1423 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1424 else if (ssl_err == SSL_ERROR_WANT_WRITE)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1425 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1426 else
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1427 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1428 if (sockstate == SOCKET_HAS_TIMED_OUT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1429 if (ssl_err == SSL_ERROR_WANT_READ)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1430 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1431 "The read operation timed out");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1432 else
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1433 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1434 "The write operation timed out");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1435 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1436 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1437 else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1438 PyErr_SetString(PySSLErrorObject,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1439 "Underlying socket too large for select().");
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1440 return NULL;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1441 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1442 else if (sockstate != SOCKET_OPERATION_OK)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1443 /* Retain the SSL error code */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1444 break;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1445 }
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1446
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1447 if (err < 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1448 return PySSL_SetError(self, err, __FILE__, __LINE__);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1449 else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1450 Py_INCREF(self->Socket);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1451 return (PyObject *) (self->Socket);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1452 }
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1453 }
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1454
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1455 PyDoc_STRVAR(PySSL_SSLshutdown_doc,
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1456 "shutdown(s) -> socket\n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1457 \n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1458 Does the SSL shutdown handshake with the remote end, and returns\n\
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1459 the underlying socket object.");
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 47527 diff changeset	1460
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1461 static PyMethodDef PySSLMethods[] = {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1462 {"do_handshake", (PyCFunction)PySSL_SSLdo_handshake, METH_NOARGS},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1463 {"write", (PyCFunction)PySSL_SSLwrite, METH_VARARGS,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1464 PySSL_SSLwrite_doc},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1465 {"read", (PyCFunction)PySSL_SSLread, METH_VARARGS,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1466 PySSL_SSLread_doc},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1467 {"pending", (PyCFunction)PySSL_SSLpending, METH_NOARGS,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1468 PySSL_SSLpending_doc},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1469 {"server", (PyCFunction)PySSL_server, METH_NOARGS},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1470 {"issuer", (PyCFunction)PySSL_issuer, METH_NOARGS},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1471 {"peer_certificate", (PyCFunction)PySSL_peercert, METH_VARARGS,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1472 PySSL_peercert_doc},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1473 {"cipher", (PyCFunction)PySSL_cipher, METH_NOARGS},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1474 {"shutdown", (PyCFunction)PySSL_SSLshutdown, METH_NOARGS,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1475 PySSL_SSLshutdown_doc},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1476 {NULL, NULL}
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1477 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1478
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1479 static PyObject PySSL_getattr(PySSLObject self, char *name)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1480 {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1481 return Py_FindMethod(PySSLMethods, (PyObject *)self, name);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1482 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1483
24280 1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	1484 static PyTypeObject PySSL_Type = {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1485 PyVarObject_HEAD_INIT(NULL, 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1486 "ssl.SSLContext", /tp_name/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1487 sizeof(PySSLObject), /tp_basicsize/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1488 0, /tp_itemsize/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1489 /* methods */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1490 (destructor)PySSL_dealloc, /tp_dealloc/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1491 0, /tp_print/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1492 (getattrfunc)PySSL_getattr, /tp_getattr/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1493 0, /tp_setattr/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1494 0, /tp_compare/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1495 0, /tp_repr/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1496 0, /tp_as_number/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1497 0, /tp_as_sequence/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1498 0, /tp_as_mapping/
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1499 0, /tp_hash/
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1500 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1501
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1502 #ifdef HAVE_OPENSSL_RAND
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1503
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1504 /* helper routines for seeding the SSL PRNG */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1505 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1506 PySSL_RAND_add(PyObject self, PyObject args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1507 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1508 char *buf;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1509 int len;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1510 double entropy;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1511
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1512 if (!PyArg_ParseTuple(args, "s#d:RAND_add", &buf, &len, &entropy))
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1513 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1514 RAND_add(buf, len, entropy);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1515 Py_INCREF(Py_None);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1516 return Py_None;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1517 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1518
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1519 PyDoc_STRVAR(PySSL_RAND_add_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1520 "RAND_add(string, entropy)\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1521 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1522 Mix string into the OpenSSL PRNG state. entropy (a float) is a lower\n\
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1523 bound on the entropy contained in string. See RFC 1750.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1524
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1525 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1526 PySSL_RAND_status(PyObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1527 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1528 return PyInt_FromLong(RAND_status());
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1529 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1530
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1531 PyDoc_STRVAR(PySSL_RAND_status_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1532 "RAND_status() -> 0 or 1\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1533 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1534 Returns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1535 It is necessary to seed the PRNG with RAND_add() on some platforms before\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1536 using the ssl() function.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1537
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1538 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1539 PySSL_RAND_egd(PyObject self, PyObject arg)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1540 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1541 int bytes;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1542
47527 52294af4b663 This reverts r63675 based on the discussion in this thread: Gregory P. Smith <greg@mad-scientist.com> parents: 47294 diff changeset	1543 if (!PyString_Check(arg))
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1544 return PyErr_Format(PyExc_TypeError,
013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1545 "RAND_egd() expected string, found %s",
013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1546 Py_TYPE(arg)->tp_name);
47527 52294af4b663 This reverts r63675 based on the discussion in this thread: Gregory P. Smith <greg@mad-scientist.com> parents: 47294 diff changeset	1547 bytes = RAND_egd(PyString_AS_STRING(arg));
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1548 if (bytes == -1) {
61536 013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1549 PyErr_SetString(PySSLErrorObject,
013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1550 "EGD connection failed or EGD did not return "
013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1551 "enough data to seed the PRNG");
013d76aa8951 Merged revisions 81115 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61245 diff changeset	1552 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1553 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1554 return PyInt_FromLong(bytes);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1555 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1556
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1557 PyDoc_STRVAR(PySSL_RAND_egd_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1558 "RAND_egd(path) -> bytes\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1559 \n\
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1560 Queries the entropy gather daemon (EGD) on the socket named by 'path'.\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1561 Returns number of bytes read. Raises SSLError if connection to EGD\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1562 fails or if it does provide enough data to seed PRNG.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1563
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1564 #endif
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1565
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1566 /* List of functions exported by this module. */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1567
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1568 static PyMethodDef PySSL_methods[] = {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1569 {"sslwrap", PySSL_sslwrap,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1570 METH_VARARGS, ssl_doc},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1571 {"_test_decode_cert", PySSL_test_decode_certificate,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1572 METH_VARARGS},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1573 #ifdef HAVE_OPENSSL_RAND
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1574 {"RAND_add", PySSL_RAND_add, METH_VARARGS,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1575 PySSL_RAND_add_doc},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1576 {"RAND_egd", PySSL_RAND_egd, METH_O,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1577 PySSL_RAND_egd_doc},
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1578 {"RAND_status", (PyCFunction)PySSL_RAND_status, METH_NOARGS,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1579 PySSL_RAND_status_doc},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1580 #endif
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1581 {NULL, NULL} /* Sentinel */
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1582 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1583
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1584
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1585 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1586
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1587 /* an implementation of OpenSSL threading operations in terms
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1588 of the Python C thread library */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1589
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1590 static PyThread_type_lock *_ssl_locks = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1591
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1592 static unsigned long _ssl_thread_id_function (void) {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1593 return PyThread_get_thread_ident();
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1594 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1595
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1596 static void _ssl_thread_locking_function (int mode, int n, const char *file, int line) {
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1597 /* this function is needed to perform locking on shared data
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1598 structures. (Note that OpenSSL uses a number of global data
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1599 structures that will be implicitly shared whenever multiple threads
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1600 use OpenSSL.) Multi-threaded applications will crash at random if
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1601 it is not set.
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1602
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1603 locking_function() must be able to handle up to CRYPTO_num_locks()
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1604 different mutex locks. It sets the n-th lock if mode & CRYPTO_LOCK, and
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1605 releases it otherwise.
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1606
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1607 file and line are the file number of the function setting the
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1608 lock. They can be useful for debugging.
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1609 */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1610
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1611 if ((_ssl_locks == NULL) \|\|
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1612 (n < 0) \|\| ((unsigned)n >= _ssl_locks_count))
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1613 return;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1614
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1615 if (mode & CRYPTO_LOCK) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1616 PyThread_acquire_lock(_ssl_locks[n], 1);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1617 } else {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1618 PyThread_release_lock(_ssl_locks[n]);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1619 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1620 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1621
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1622 static int _setup_ssl_threads(void) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1623
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1624 unsigned int i;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1625
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1626 if (_ssl_locks == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1627 _ssl_locks_count = CRYPTO_num_locks();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1628 _ssl_locks = (PyThread_type_lock *)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1629 malloc(sizeof(PyThread_type_lock) * _ssl_locks_count);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1630 if (_ssl_locks == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1631 return 0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1632 memset(_ssl_locks, 0, sizeof(PyThread_type_lock) * _ssl_locks_count);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1633 for (i = 0; i < _ssl_locks_count; i++) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1634 _ssl_locks[i] = PyThread_allocate_lock();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1635 if (_ssl_locks[i] == NULL) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1636 unsigned int j;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1637 for (j = 0; j < i; j++) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1638 PyThread_free_lock(_ssl_locks[j]);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1639 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1640 free(_ssl_locks);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1641 return 0;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1642 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1643 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1644 CRYPTO_set_locking_callback(_ssl_thread_locking_function);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1645 CRYPTO_set_id_callback(_ssl_thread_id_function);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1646 }
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1647 return 1;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1648 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1649
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1650 #endif /* def HAVE_THREAD */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1651
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1652 PyDoc_STRVAR(module_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1653 "Implementation module for SSL socket operations. See the socket module\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1654 for documentation.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1655
24471 f66b3a3509c7 Excise DL_EXPORT/DL_IMPORT from Modules/. Required adding a prototype Mark Hammond <mhammond@skippinet.com.au>* parents: 24398 diff changeset	1656 PyMODINIT_FUNC
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1657 init_ssl(void)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1658 {
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1659 PyObject m, d, *r;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1660 unsigned long libver;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1661 unsigned int major, minor, fix, patch, status;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1662
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1663 Py_TYPE(&PySSL_Type) = &PyType_Type;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1664
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1665 m = Py_InitModule3("_ssl", PySSL_methods, module_doc);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1666 if (m == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1667 return;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1668 d = PyModule_GetDict(m);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1669
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1670 /* Load _socket module and its C API */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1671 if (PySocketModule_ImportModuleAndAPI())
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1672 return;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1673
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1674 /* Init OpenSSL */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1675 SSL_load_error_strings();
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1676 SSL_library_init();
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1677 #ifdef WITH_THREAD
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1678 /* note that this will start threading if not already started */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1679 if (!_setup_ssl_threads()) {
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1680 return;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1681 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1682 #endif
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1683 OpenSSL_add_all_algorithms();
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1684
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1685 /* Add symbols to module dict */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1686 PySSLErrorObject = PyErr_NewException("ssl.SSLError",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1687 PySocketModule.error,
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1688 NULL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1689 if (PySSLErrorObject == NULL)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1690 return;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1691 if (PyDict_SetItemString(d, "SSLError", PySSLErrorObject) != 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1692 return;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1693 if (PyDict_SetItemString(d, "SSLType",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1694 (PyObject *)&PySSL_Type) != 0)
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1695 return;
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1696 PyModule_AddIntConstant(m, "SSL_ERROR_ZERO_RETURN",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1697 PY_SSL_ERROR_ZERO_RETURN);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1698 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_READ",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1699 PY_SSL_ERROR_WANT_READ);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1700 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_WRITE",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1701 PY_SSL_ERROR_WANT_WRITE);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1702 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_X509_LOOKUP",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1703 PY_SSL_ERROR_WANT_X509_LOOKUP);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1704 PyModule_AddIntConstant(m, "SSL_ERROR_SYSCALL",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1705 PY_SSL_ERROR_SYSCALL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1706 PyModule_AddIntConstant(m, "SSL_ERROR_SSL",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1707 PY_SSL_ERROR_SSL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1708 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_CONNECT",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1709 PY_SSL_ERROR_WANT_CONNECT);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1710 /* non ssl.h errorcodes */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1711 PyModule_AddIntConstant(m, "SSL_ERROR_EOF",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1712 PY_SSL_ERROR_EOF);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1713 PyModule_AddIntConstant(m, "SSL_ERROR_INVALID_ERROR_CODE",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1714 PY_SSL_ERROR_INVALID_ERROR_CODE);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1715 /* cert requirements */
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1716 PyModule_AddIntConstant(m, "CERT_NONE",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1717 PY_SSL_CERT_NONE);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1718 PyModule_AddIntConstant(m, "CERT_OPTIONAL",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1719 PY_SSL_CERT_OPTIONAL);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1720 PyModule_AddIntConstant(m, "CERT_REQUIRED",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1721 PY_SSL_CERT_REQUIRED);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1722
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1723 /* protocol versions */
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	1724 #ifndef OPENSSL_NO_SSL2
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1725 PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1726 PY_SSL_VERSION_SSL2);
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	1727 #endif
61245 ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1728 PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1729 PY_SSL_VERSION_SSL3);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1730 PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1731 PY_SSL_VERSION_SSL23);
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1732 PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",
ccade5772674 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61016 diff changeset	1733 PY_SSL_VERSION_TLS1);
60372 664173984f2d Issue #8321: Give access to OpenSSL version numbers from the `ssl` module, Antoine Pitrou <solipsis@pitrou.net> parents: 60033 diff changeset	1734
61243 6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1735 /* OpenSSL version */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1736 /* SSLeay() gives us the version of the library linked against,
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1737 which could be different from the headers version.
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1738 */
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1739 libver = SSLeay();
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1740 r = PyLong_FromUnsignedLong(libver);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1741 if (r == NULL)
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1742 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1743 if (PyModule_AddObject(m, "OPENSSL_VERSION_NUMBER", r))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1744 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1745 status = libver & 0xF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1746 libver >>= 4;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1747 patch = libver & 0xFF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1748 libver >>= 8;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1749 fix = libver & 0xFF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1750 libver >>= 8;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1751 minor = libver & 0xFF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1752 libver >>= 8;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1753 major = libver & 0xFF;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1754 r = Py_BuildValue("IIIII", major, minor, fix, patch, status);
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1755 if (r == NULL \|\| PyModule_AddObject(m, "OPENSSL_VERSION_INFO", r))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1756 return;
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1757 r = PyString_FromString(SSLeay_version(SSLEAY_VERSION));
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1758 if (r == NULL \|\| PyModule_AddObject(m, "OPENSSL_VERSION", r))
6db9ba42e468 Untabify Modules/_ssl.c Antoine Pitrou <solipsis@pitrou.net> parents: 61189 diff changeset	1759 return;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1760 }

Mercurial > cpython-lru_cache-weakref

annotate Modules/_ssl.c @ 80661:94de77bd0b4b 2.7