cpython-lru_cache-weakref: Modules/

annotate Modules/_ssl.c @ 44825:ef859cd754a7 legacy-trunk

Fixed a wrong assumption in configure.in and Include/pyport.h. The is finite function is not called isfinite() but finite(). Sorry, my fault. :)

author	Christian Heimes <christian@cheimes.de>
date	Sun, 20 Jan 2008 14:28:28 +0000
parents	26384b8180c7
children	fcfa13199ecb

rev	line source
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1 /* SSL socket module
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	2
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3 SSL support based on patches by Brian E Gallew and Laszlo Kovacs.
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	4 Re-worked a bit by Bill Janssen to add server-side support and
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	5 certificate decoding.
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	6
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	7 This module is imported by ssl.py. It should not be used
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	8 directly.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	9
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	10 XXX should partial writes be enabled, SSL_MODE_ENABLE_PARTIAL_WRITE?
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	11
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	12 XXX what about SSL_MODE_AUTO_RETRY
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	13 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	14
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	15 #include "Python.h"
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	16
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	17 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	18 #include "pythread.h"
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	19 #define PySSL_BEGIN_ALLOW_THREADS { \
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	20 PyThreadState *_save; \
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	21 if (_ssl_locks_count>0) {_save = PyEval_SaveThread();}
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	22 #define PySSL_BLOCK_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save)};
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	23 #define PySSL_UNBLOCK_THREADS if (_ssl_locks_count>0){_save = PyEval_SaveThread()};
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	24 #define PySSL_END_ALLOW_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save);} \
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	25 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	26
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	27 #else /* no WITH_THREAD */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	28
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	29 #define PySSL_BEGIN_ALLOW_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	30 #define PySSL_BLOCK_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	31 #define PySSL_UNBLOCK_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	32 #define PySSL_END_ALLOW_THREADS
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	33
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	34 #endif
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	35
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	36 enum py_ssl_error {
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	37 /* these mirror ssl.h */
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	38 PY_SSL_ERROR_NONE,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	39 PY_SSL_ERROR_SSL,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	40 PY_SSL_ERROR_WANT_READ,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	41 PY_SSL_ERROR_WANT_WRITE,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	42 PY_SSL_ERROR_WANT_X509_LOOKUP,
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	43 PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	44 PY_SSL_ERROR_ZERO_RETURN,
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	45 PY_SSL_ERROR_WANT_CONNECT,
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	46 /* start of non ssl.h errorcodes */
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	47 PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	48 PY_SSL_ERROR_INVALID_ERROR_CODE
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	49 };
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	50
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	51 enum py_ssl_server_or_client {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	52 PY_SSL_CLIENT,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	53 PY_SSL_SERVER
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	54 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	55
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	56 enum py_ssl_cert_requirements {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	57 PY_SSL_CERT_NONE,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	58 PY_SSL_CERT_OPTIONAL,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	59 PY_SSL_CERT_REQUIRED
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	60 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	61
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	62 enum py_ssl_version {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	63 PY_SSL_VERSION_SSL2,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	64 PY_SSL_VERSION_SSL3,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	65 PY_SSL_VERSION_SSL23,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	66 PY_SSL_VERSION_TLS1,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	67 };
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	68
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	69 /* Include symbols from _socket module */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	70 #include "socketmodule.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	71
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	72 #if defined(HAVE_POLL_H)
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	73 #include <poll.h>
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	74 #elif defined(HAVE_SYS_POLL_H)
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	75 #include <sys/poll.h>
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	76 #endif
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	77
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	78 /* Include OpenSSL header files */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	79 #include "openssl/rsa.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	80 #include "openssl/crypto.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	81 #include "openssl/x509.h"
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	82 #include "openssl/x509v3.h"
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	83 #include "openssl/pem.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	84 #include "openssl/ssl.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	85 #include "openssl/err.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	86 #include "openssl/rand.h"
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	87
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	88 /* SSL error object */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	89 static PyObject *PySSLErrorObject;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	90
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	91 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	92
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	93 /* serves as a flag to see whether we've initialized the SSL thread support. */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	94 /* 0 means no, greater than 0 means yes */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	95
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	96 static unsigned int _ssl_locks_count = 0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	97
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	98 #endif /* def WITH_THREAD */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	99
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	100 /* SSL socket object */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	101
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	102 #define X509_NAME_MAXLEN 256
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	103
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	104 /* RAND_* APIs got added to OpenSSL in 0.9.5 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	105 #if OPENSSL_VERSION_NUMBER >= 0x0090500fL
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	106 # define HAVE_OPENSSL_RAND 1
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	107 #else
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	108 # undef HAVE_OPENSSL_RAND
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	109 #endif
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	110
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	111 typedef struct {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	112 PyObject_HEAD
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	113 PySocketSockObject Socket; / Socket on which we're layered */
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	114 SSL_CTX* ctx;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	115 SSL* ssl;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	116 X509* peer_cert;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	117 char server[X509_NAME_MAXLEN];
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	118 char issuer[X509_NAME_MAXLEN];
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	119
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	120 } PySSLObject;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	121
24280 1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	122 static PyTypeObject PySSL_Type;
1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	123 static PyObject PySSL_SSLwrite(PySSLObject self, PyObject *args);
1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	124 static PyObject PySSL_SSLread(PySSLObject self, PyObject *args);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	125 static int check_socket_and_wait_for_timeout(PySocketSockObject *s,
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	126 int writing);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	127 static PyObject PySSL_peercert(PySSLObject self, PyObject *args);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	128 static PyObject PySSL_cipher(PySSLObject self);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	129
44350 26384b8180c7 #1629: Renamed Py_Size, Py_Type and Py_Refcnt to Py_SIZE, Py_TYPE and Py_REFCNT. Macros for b/w compatibility are available. Christian Heimes <christian@cheimes.de> parents: 44296 diff changeset	130 #define PySSLObject_Check(v) (Py_TYPE(v) == &PySSL_Type)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	131
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	132 typedef enum {
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	133 SOCKET_IS_NONBLOCKING,
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	134 SOCKET_IS_BLOCKING,
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	135 SOCKET_HAS_TIMED_OUT,
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	136 SOCKET_HAS_BEEN_CLOSED,
36487 07ba8aae3dc6 Try to improve name based on discussion on python-checkins with Jim Jewett Neal Norwitz <nnorwitz@gmail.com> parents: 36476 diff changeset	137 SOCKET_TOO_LARGE_FOR_SELECT,
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	138 SOCKET_OPERATION_OK
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	139 } timeout_state;
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	140
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	141 /* Wrap error strings with filename and line # */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	142 #define STRINGIFY1(x) #x
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	143 #define STRINGIFY2(x) STRINGIFY1(x)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	144 #define ERRSTR1(x,y,z) (x ":" y ": " z)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	145 #define ERRSTR(x) ERRSTR1("_ssl.c", STRINGIFY2(__LINE__), x)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	146
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	147 /* XXX It might be helpful to augment the error message generated
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	148 below with the name of the SSL function that generated the error.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	149 I expect it's obvious most of the time.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	150 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	151
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	152 static PyObject *
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	153 PySSL_SetError(PySSLObject obj, int ret, char filename, int lineno)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	154 {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	155 PyObject *v;
42829 241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	156 char buf[2048];
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	157 char *errstr;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	158 int err;
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	159 enum py_ssl_error p = PY_SSL_ERROR_NONE;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	160
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	161 assert(ret <= 0);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	162
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	163 if (obj->ssl != NULL) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	164 err = SSL_get_error(obj->ssl, ret);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	165
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	166 switch (err) {
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	167 case SSL_ERROR_ZERO_RETURN:
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	168 errstr = "TLS/SSL connection has been closed";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	169 p = PY_SSL_ERROR_ZERO_RETURN;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	170 break;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	171 case SSL_ERROR_WANT_READ:
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	172 errstr = "The operation did not complete (read)";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	173 p = PY_SSL_ERROR_WANT_READ;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	174 break;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	175 case SSL_ERROR_WANT_WRITE:
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	176 p = PY_SSL_ERROR_WANT_WRITE;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	177 errstr = "The operation did not complete (write)";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	178 break;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	179 case SSL_ERROR_WANT_X509_LOOKUP:
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	180 p = PY_SSL_ERROR_WANT_X509_LOOKUP;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	181 errstr =
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	182 "The operation did not complete (X509 lookup)";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	183 break;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	184 case SSL_ERROR_WANT_CONNECT:
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	185 p = PY_SSL_ERROR_WANT_CONNECT;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	186 errstr = "The operation did not complete (connect)";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	187 break;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	188 case SSL_ERROR_SYSCALL:
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	189 {
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	190 unsigned long e = ERR_get_error();
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	191 if (e == 0) {
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	192 if (ret == 0 \|\| !obj->Socket) {
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	193 p = PY_SSL_ERROR_EOF;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	194 errstr =
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	195 "EOF occurred in violation of protocol";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	196 } else if (ret == -1) {
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	197 /* underlying BIO reported an I/O error */
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	198 return obj->Socket->errorhandler();
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	199 } else { /* possible? */
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	200 p = PY_SSL_ERROR_SYSCALL;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	201 errstr = "Some I/O error occurred";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	202 }
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	203 } else {
24086 86dfb96a1831 Repair badly formatted code. Jeremy Hylton <jeremy@alum.mit.edu> parents: 23832 diff changeset	204 p = PY_SSL_ERROR_SYSCALL;
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	205 /* XXX Protected by global interpreter lock */
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	206 errstr = ERR_error_string(e, NULL);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	207 }
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	208 break;
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	209 }
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	210 case SSL_ERROR_SSL:
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	211 {
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	212 unsigned long e = ERR_get_error();
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	213 p = PY_SSL_ERROR_SSL;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	214 if (e != 0)
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	215 /* XXX Protected by global interpreter lock */
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	216 errstr = ERR_error_string(e, NULL);
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	217 else { /* possible? */
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	218 errstr =
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	219 "A failure in the SSL library occurred";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	220 }
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	221 break;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	222 }
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	223 default:
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	224 p = PY_SSL_ERROR_INVALID_ERROR_CODE;
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	225 errstr = "Invalid error code";
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	226 }
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	227 } else {
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	228 errstr = ERR_error_string(ERR_peek_last_error(), NULL);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	229 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	230 PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	231 v = Py_BuildValue("(is)", p, buf);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	232 if (v != NULL) {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	233 PyErr_SetObject(PySSLErrorObject, v);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	234 Py_DECREF(v);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	235 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	236 return NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	237 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	238
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	239 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	240 _setSSLError (char errstr, int errcode, char filename, int lineno) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	241
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	242 char buf[2048];
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	243 PyObject *v;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	244
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	245 if (errstr == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	246 errcode = ERR_peek_last_error();
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	247 errstr = ERR_error_string(errcode, NULL);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	248 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	249 PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	250 v = Py_BuildValue("(is)", errcode, buf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	251 if (v != NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	252 PyErr_SetObject(PySSLErrorObject, v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	253 Py_DECREF(v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	254 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	255 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	256 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	257
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	258 static PySSLObject *
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	259 newPySSLObject(PySocketSockObject Sock, char key_file, char *cert_file,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	260 enum py_ssl_server_or_client socket_type,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	261 enum py_ssl_cert_requirements certreq,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	262 enum py_ssl_version proto_version,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	263 char *cacerts_file)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	264 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	265 PySSLObject *self;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	266 char *errstr = NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	267 int ret;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	268 int err;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	269 int sockstate;
42829 241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	270 int verification_mode;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	271
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	272 self = PyObject_New(PySSLObject, &PySSL_Type); /* Create new object */
38152 9a637bf4df42 Don't mask a no memory error with a less meaningful one as discussed on python-checkins Neal Norwitz <nnorwitz@gmail.com> parents: 38139 diff changeset	273 if (self == NULL)
38139 f1e24452dbba Fix problems found by Coverity. Neal Norwitz <nnorwitz@gmail.com> parents: 37784 diff changeset	274 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	275 memset(self->server, '\0', sizeof(char) * X509_NAME_MAXLEN);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	276 memset(self->issuer, '\0', sizeof(char) * X509_NAME_MAXLEN);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	277 self->peer_cert = NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	278 self->ssl = NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	279 self->ctx = NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	280 self->Socket = NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	281
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	282 /* Make sure the SSL error state is initialized */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	283 (void) ERR_get_state();
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	284 ERR_clear_error();
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	285
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	286 if ((key_file && !cert_file) \|\| (!key_file && cert_file)) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	287 errstr = ERRSTR("Both the key & certificate files "
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	288 "must be specified");
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	289 goto fail;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	290 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	291
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	292 if ((socket_type == PY_SSL_SERVER) &&
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	293 ((key_file == NULL) \|\| (cert_file == NULL))) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	294 errstr = ERRSTR("Both the key & certificate files "
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	295 "must be specified for server-side operation");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	296 goto fail;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	297 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	298
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	299 PySSL_BEGIN_ALLOW_THREADS
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	300 if (proto_version == PY_SSL_VERSION_TLS1)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	301 self->ctx = SSL_CTX_new(TLSv1_method()); /* Set up context */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	302 else if (proto_version == PY_SSL_VERSION_SSL3)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	303 self->ctx = SSL_CTX_new(SSLv3_method()); /* Set up context */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	304 else if (proto_version == PY_SSL_VERSION_SSL2)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	305 self->ctx = SSL_CTX_new(SSLv2_method()); /* Set up context */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	306 else if (proto_version == PY_SSL_VERSION_SSL23)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	307 self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	308 PySSL_END_ALLOW_THREADS
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	309
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	310 if (self->ctx == NULL) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	311 errstr = ERRSTR("Invalid SSL protocol variant specified.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	312 goto fail;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	313 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	314
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	315 if (certreq != PY_SSL_CERT_NONE) {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	316 if (cacerts_file == NULL) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	317 errstr = ERRSTR("No root certificates specified for "
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	318 "verification of other-side certificates.");
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	319 goto fail;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	320 } else {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	321 PySSL_BEGIN_ALLOW_THREADS
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	322 ret = SSL_CTX_load_verify_locations(self->ctx,
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	323 cacerts_file,
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	324 NULL);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	325 PySSL_END_ALLOW_THREADS
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	326 if (ret != 1) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	327 _setSSLError(NULL, 0, __FILE__, __LINE__);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	328 goto fail;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	329 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	330 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	331 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	332 if (key_file) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	333 PySSL_BEGIN_ALLOW_THREADS
24398 c7ed925c75b3 Patch #575827: allow threads inside SSL creation. Martin v. Löwis <martin@v.loewis.de> parents: 24280 diff changeset	334 ret = SSL_CTX_use_PrivateKey_file(self->ctx, key_file,
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	335 SSL_FILETYPE_PEM);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	336 PySSL_END_ALLOW_THREADS
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	337 if (ret != 1) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	338 _setSSLError(NULL, ret, __FILE__, __LINE__);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	339 goto fail;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	340 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	341
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	342 PySSL_BEGIN_ALLOW_THREADS
24398 c7ed925c75b3 Patch #575827: allow threads inside SSL creation. Martin v. Löwis <martin@v.loewis.de> parents: 24280 diff changeset	343 ret = SSL_CTX_use_certificate_chain_file(self->ctx,
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	344 cert_file);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	345 PySSL_END_ALLOW_THREADS
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	346 if (ret != 1) {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	347 /*
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	348 fprintf(stderr, "ret is %d, errcode is %lu, %lu, with file \"%s\"\n",
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	349 ret, ERR_peek_error(), ERR_peek_last_error(), cert_file);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	350 */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	351 if (ERR_peek_last_error() != 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	352 _setSSLError(NULL, ret, __FILE__, __LINE__);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	353 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	354 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	355 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	356 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	357
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	358 /* ssl compatibility */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	359 SSL_CTX_set_options(self->ctx, SSL_OP_ALL);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	360
42829 241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	361 verification_mode = SSL_VERIFY_NONE;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	362 if (certreq == PY_SSL_CERT_OPTIONAL)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	363 verification_mode = SSL_VERIFY_PEER;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	364 else if (certreq == PY_SSL_CERT_REQUIRED)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	365 verification_mode = (SSL_VERIFY_PEER \|
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	366 SSL_VERIFY_FAIL_IF_NO_PEER_CERT);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	367 SSL_CTX_set_verify(self->ctx, verification_mode,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	368 NULL); /* set verify lvl */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	369
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	370 PySSL_BEGIN_ALLOW_THREADS
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	371 self->ssl = SSL_new(self->ctx); /* New ssl struct */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	372 PySSL_END_ALLOW_THREADS
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	373 SSL_set_fd(self->ssl, Sock->sock_fd); /* Set the socket for SSL */
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	374
30723 6f15e73b59f2 Backport checkin: Walter Dörwald <walter@livinglogic.de> parents: 29695 diff changeset	375 /* If the socket is in non-blocking mode or timeout mode, set the BIO
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	376 * to non-blocking mode (blocking is the default)
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	377 */
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	378 if (Sock->sock_timeout >= 0.0) {
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	379 /* Set both the read and write BIO's to non-blocking mode */
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	380 BIO_set_nbio(SSL_get_rbio(self->ssl), 1);
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	381 BIO_set_nbio(SSL_get_wbio(self->ssl), 1);
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	382 }
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	383
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	384 PySSL_BEGIN_ALLOW_THREADS
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	385 if (socket_type == PY_SSL_CLIENT)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	386 SSL_set_connect_state(self->ssl);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	387 else
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	388 SSL_set_accept_state(self->ssl);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	389 PySSL_END_ALLOW_THREADS
24398 c7ed925c75b3 Patch #575827: allow threads inside SSL creation. Martin v. Löwis <martin@v.loewis.de> parents: 24280 diff changeset	390
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	391 /* Actually negotiate SSL connection */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	392 /* XXX If SSL_connect() returns 0, it's also a failure. */
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	393 sockstate = 0;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	394 do {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	395 PySSL_BEGIN_ALLOW_THREADS
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	396 if (socket_type == PY_SSL_CLIENT)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	397 ret = SSL_connect(self->ssl);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	398 else
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	399 ret = SSL_accept(self->ssl);
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	400 err = SSL_get_error(self->ssl, ret);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	401 PySSL_END_ALLOW_THREADS
29629 a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	402 if(PyErr_CheckSignals()) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	403 goto fail;
29629 a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	404 }
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	405 if (err == SSL_ERROR_WANT_READ) {
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	406 sockstate = check_socket_and_wait_for_timeout(Sock, 0);
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	407 } else if (err == SSL_ERROR_WANT_WRITE) {
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	408 sockstate = check_socket_and_wait_for_timeout(Sock, 1);
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	409 } else {
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	410 sockstate = SOCKET_OPERATION_OK;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	411 }
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	412 if (sockstate == SOCKET_HAS_TIMED_OUT) {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	413 PyErr_SetString(PySSLErrorObject,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	414 ERRSTR("The connect operation timed out"));
29629 a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	415 goto fail;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	416 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	417 PyErr_SetString(PySSLErrorObject,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	418 ERRSTR("Underlying socket has been closed."));
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	419 goto fail;
36487 07ba8aae3dc6 Try to improve name based on discussion on python-checkins with Jim Jewett Neal Norwitz <nnorwitz@gmail.com> parents: 36476 diff changeset	420 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	421 PyErr_SetString(PySSLErrorObject,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	422 ERRSTR("Underlying socket too large for select()."));
36452 7789cc557e1e Bug #876637, prevent stack corruption when socket descriptor Neal Norwitz <nnorwitz@gmail.com> parents: 36451 diff changeset	423 goto fail;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	424 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	425 break;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	426 }
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	427 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	428 if (ret < 1) {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	429 PySSL_SetError(self, ret, __FILE__, __LINE__);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	430 goto fail;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	431 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	432 self->ssl->debug = 1;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	433
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	434 PySSL_BEGIN_ALLOW_THREADS
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	435 if ((self->peer_cert = SSL_get_peer_certificate(self->ssl))) {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	436 X509_NAME_oneline(X509_get_subject_name(self->peer_cert),
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	437 self->server, X509_NAME_MAXLEN);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	438 X509_NAME_oneline(X509_get_issuer_name(self->peer_cert),
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	439 self->issuer, X509_NAME_MAXLEN);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	440 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	441 PySSL_END_ALLOW_THREADS
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	442 self->Socket = Sock;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	443 Py_INCREF(self->Socket);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	444 return self;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	445 fail:
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	446 if (errstr)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	447 PyErr_SetString(PySSLErrorObject, errstr);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	448 Py_DECREF(self);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	449 return NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	450 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	451
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	452 static PyObject *
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	453 PySSL_sslwrap(PyObject self, PyObject args)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	454 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	455 PySocketSockObject *Sock;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	456 int server_side = 0;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	457 int verification_mode = PY_SSL_CERT_NONE;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	458 int protocol = PY_SSL_VERSION_SSL23;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	459 char *key_file = NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	460 char *cert_file = NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	461 char *cacerts_file = NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	462
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	463 if (!PyArg_ParseTuple(args, "O!i\|zziiz:sslwrap",
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	464 PySocketModule.Sock_Type,
40152 e2df1356349f Fix various minor errors in passing arguments to Martin v. Löwis <martin@v.loewis.de> parents: 39059 diff changeset	465 &Sock,
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	466 &server_side,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	467 &key_file, &cert_file,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	468 &verification_mode, &protocol,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	469 &cacerts_file))
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	470 return NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	471
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	472 /*
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	473 fprintf(stderr,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	474 "server_side is %d, keyfile %p, certfile %p, verify_mode %d, "
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	475 "protocol %d, certs %p\n",
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	476 server_side, key_file, cert_file, verification_mode,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	477 protocol, cacerts_file);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	478 */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	479
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	480 return (PyObject *) newPySSLObject(Sock, key_file, cert_file,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	481 server_side, verification_mode,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	482 protocol, cacerts_file);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	483 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	484
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	485 PyDoc_STRVAR(ssl_doc,
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	486 "sslwrap(socket, server_side, [keyfile, certfile, certs_mode, protocol,\n"
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	487 " cacertsfile]) -> sslobject");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	488
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	489 /* SSL object methods */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	490
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	491 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	492 PySSL_server(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	493 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	494 return PyString_FromString(self->server);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	495 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	496
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	497 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	498 PySSL_issuer(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	499 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	500 return PyString_FromString(self->issuer);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	501 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	502
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	503 static PyObject *
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	504 _create_tuple_for_attribute (ASN1_OBJECT name, ASN1_STRING value) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	505
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	506 char namebuf[X509_NAME_MAXLEN];
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	507 int buflen;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	508 PyObject *name_obj;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	509 PyObject *value_obj;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	510 PyObject *attr;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	511 unsigned char *valuebuf = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	512
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	513 buflen = OBJ_obj2txt(namebuf, sizeof(namebuf), name, 0);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	514 if (buflen < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	515 _setSSLError(NULL, 0, __FILE__, __LINE__);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	516 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	517 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	518 name_obj = PyString_FromStringAndSize(namebuf, buflen);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	519 if (name_obj == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	520 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	521
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	522 buflen = ASN1_STRING_to_UTF8(&valuebuf, value);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	523 if (buflen < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	524 _setSSLError(NULL, 0, __FILE__, __LINE__);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	525 Py_DECREF(name_obj);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	526 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	527 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	528 value_obj = PyUnicode_DecodeUTF8((char *) valuebuf,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	529 buflen, "strict");
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	530 OPENSSL_free(valuebuf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	531 if (value_obj == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	532 Py_DECREF(name_obj);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	533 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	534 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	535 attr = PyTuple_New(2);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	536 if (attr == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	537 Py_DECREF(name_obj);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	538 Py_DECREF(value_obj);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	539 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	540 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	541 PyTuple_SET_ITEM(attr, 0, name_obj);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	542 PyTuple_SET_ITEM(attr, 1, value_obj);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	543 return attr;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	544
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	545 fail:
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	546 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	547 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	548
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	549 static PyObject *
43243 e2b4fc960830 SSL certificate distinguished names should be represented by tuples Bill Janssen <janssen@parc.com> parents: 42908 diff changeset	550 _create_tuple_for_X509_NAME (X509_NAME *xname)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	551 {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	552 PyObject dn = NULL; / tuple which represents the "distinguished name" */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	553 PyObject rdn = NULL; / tuple to hold a "relative distinguished name" */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	554 PyObject *rdnt;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	555 PyObject attr = NULL; / tuple to hold an attribute */
43243 e2b4fc960830 SSL certificate distinguished names should be represented by tuples Bill Janssen <janssen@parc.com> parents: 42908 diff changeset	556 int entry_count = X509_NAME_entry_count(xname);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	557 X509_NAME_ENTRY *entry;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	558 ASN1_OBJECT *name;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	559 ASN1_STRING *value;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	560 int index_counter;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	561 int rdn_level = -1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	562 int retcode;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	563
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	564 dn = PyList_New(0);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	565 if (dn == NULL)
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	566 return NULL;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	567 /* now create another tuple to hold the top-level RDN */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	568 rdn = PyList_New(0);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	569 if (rdn == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	570 goto fail0;
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	571
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	572 for (index_counter = 0;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	573 index_counter < entry_count;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	574 index_counter++)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	575 {
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	576 entry = X509_NAME_get_entry(xname, index_counter);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	577
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	578 /* check to see if we've gotten to a new RDN */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	579 if (rdn_level >= 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	580 if (rdn_level != entry->set) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	581 /* yes, new RDN */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	582 /* add old RDN to DN */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	583 rdnt = PyList_AsTuple(rdn);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	584 Py_DECREF(rdn);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	585 if (rdnt == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	586 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	587 retcode = PyList_Append(dn, rdnt);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	588 Py_DECREF(rdnt);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	589 if (retcode < 0)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	590 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	591 /* create new RDN */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	592 rdn = PyList_New(0);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	593 if (rdn == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	594 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	595 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	596 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	597 rdn_level = entry->set;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	598
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	599 /* now add this attribute to the current RDN */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	600 name = X509_NAME_ENTRY_get_object(entry);
42829 241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	601 value = X509_NAME_ENTRY_get_data(entry);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	602 attr = _create_tuple_for_attribute(name, value);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	603 /*
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	604 fprintf(stderr, "RDN level %d, attribute %s: %s\n",
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	605 entry->set,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	606 PyString_AS_STRING(PyTuple_GET_ITEM(attr, 0)),
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	607 PyString_AS_STRING(PyTuple_GET_ITEM(attr, 1)));
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	608 */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	609 if (attr == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	610 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	611 retcode = PyList_Append(rdn, attr);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	612 Py_DECREF(attr);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	613 if (retcode < 0)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	614 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	615 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	616 /* now, there's typically a dangling RDN */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	617 if ((rdn != NULL) && (PyList_Size(rdn) > 0)) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	618 rdnt = PyList_AsTuple(rdn);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	619 Py_DECREF(rdn);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	620 if (rdnt == NULL)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	621 goto fail0;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	622 retcode = PyList_Append(dn, rdnt);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	623 Py_DECREF(rdnt);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	624 if (retcode < 0)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	625 goto fail0;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	626 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	627
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	628 /* convert list to tuple */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	629 rdnt = PyList_AsTuple(dn);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	630 Py_DECREF(dn);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	631 if (rdnt == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	632 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	633 return rdnt;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	634
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	635 fail1:
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	636 Py_XDECREF(rdn);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	637
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	638 fail0:
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	639 Py_XDECREF(dn);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	640 return NULL;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	641 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	642
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	643 static PyObject *
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	644 _get_peer_alt_names (X509 *certificate) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	645
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	646 /* this code follows the procedure outlined in
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	647 OpenSSL's crypto/x509v3/v3_prn.c:X509v3_EXT_print()
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	648 function to extract the STACK_OF(GENERAL_NAME),
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	649 then iterates through the stack to add the
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	650 names. */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	651
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	652 int i, j;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	653 PyObject *peer_alt_names = Py_None;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	654 PyObject v, t;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	655 X509_EXTENSION *ext = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	656 GENERAL_NAMES *names = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	657 GENERAL_NAME *name;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	658 X509V3_EXT_METHOD *method;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	659 BIO *biobuf = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	660 char buf[2048];
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	661 char *vptr;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	662 int len;
44296 a327f3e26156 Fixed warning in ssl module Christian Heimes <christian@cheimes.de> parents: 43375 diff changeset	663 const unsigned char *p;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	664
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	665 if (certificate == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	666 return peer_alt_names;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	667
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	668 /* get a memory buffer */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	669 biobuf = BIO_new(BIO_s_mem());
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	670
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	671 i = 0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	672 while ((i = X509_get_ext_by_NID(
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	673 certificate, NID_subject_alt_name, i)) >= 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	674
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	675 if (peer_alt_names == Py_None) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	676 peer_alt_names = PyList_New(0);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	677 if (peer_alt_names == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	678 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	679 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	680
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	681 /* now decode the altName */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	682 ext = X509_get_ext(certificate, i);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	683 if(!(method = X509V3_EXT_get(ext))) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	684 PyErr_SetString(PySSLErrorObject,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	685 ERRSTR("No method for internalizing subjectAltName!"));
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	686 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	687 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	688
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	689 p = ext->value->data;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	690 if(method->it)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	691 names = (GENERAL_NAMES*) (ASN1_item_d2i(NULL,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	692 &p,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	693 ext->value->length,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	694 ASN1_ITEM_ptr(method->it)));
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	695 else
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	696 names = (GENERAL_NAMES*) (method->d2i(NULL,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	697 &p,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	698 ext->value->length));
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	699
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	700 for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	701
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	702 /* get a rendering of each name in the set of names */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	703
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	704 name = sk_GENERAL_NAME_value(names, j);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	705 if (name->type == GEN_DIRNAME) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	706
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	707 /* we special-case DirName as a tuple of tuples of attributes */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	708
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	709 t = PyTuple_New(2);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	710 if (t == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	711 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	712 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	713
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	714 v = PyString_FromString("DirName");
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	715 if (v == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	716 Py_DECREF(t);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	717 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	718 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	719 PyTuple_SET_ITEM(t, 0, v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	720
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	721 v = _create_tuple_for_X509_NAME (name->d.dirn);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	722 if (v == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	723 Py_DECREF(t);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	724 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	725 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	726 PyTuple_SET_ITEM(t, 1, v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	727
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	728 } else {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	729
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	730 /* for everything else, we use the OpenSSL print form */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	731
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	732 (void) BIO_reset(biobuf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	733 GENERAL_NAME_print(biobuf, name);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	734 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	735 if (len < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	736 _setSSLError(NULL, 0, __FILE__, __LINE__);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	737 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	738 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	739 vptr = strchr(buf, ':');
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	740 if (vptr == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	741 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	742 t = PyTuple_New(2);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	743 if (t == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	744 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	745 v = PyString_FromStringAndSize(buf, (vptr - buf));
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	746 if (v == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	747 Py_DECREF(t);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	748 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	749 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	750 PyTuple_SET_ITEM(t, 0, v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	751 v = PyString_FromStringAndSize((vptr + 1), (len - (vptr - buf + 1)));
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	752 if (v == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	753 Py_DECREF(t);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	754 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	755 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	756 PyTuple_SET_ITEM(t, 1, v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	757 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	758
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	759 /* and add that rendering to the list */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	760
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	761 if (PyList_Append(peer_alt_names, t) < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	762 Py_DECREF(t);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	763 goto fail;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	764 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	765 Py_DECREF(t);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	766 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	767 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	768 BIO_free(biobuf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	769 if (peer_alt_names != Py_None) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	770 v = PyList_AsTuple(peer_alt_names);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	771 Py_DECREF(peer_alt_names);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	772 return v;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	773 } else {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	774 return peer_alt_names;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	775 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	776
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	777
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	778 fail:
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	779 if (biobuf != NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	780 BIO_free(biobuf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	781
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	782 if (peer_alt_names != Py_None) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	783 Py_XDECREF(peer_alt_names);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	784 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	785
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	786 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	787 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	788
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	789 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	790 _decode_certificate (X509 *certificate, int verbose) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	791
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	792 PyObject *retval = NULL;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	793 BIO *biobuf = NULL;
42829 241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	794 PyObject *peer;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	795 PyObject *peer_alt_names = NULL;
42829 241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	796 PyObject *issuer;
241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	797 PyObject *version;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	798 PyObject *sn_obj;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	799 ASN1_INTEGER *serialNumber;
42829 241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	800 char buf[2048];
241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	801 int len;
241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	802 ASN1_TIME notBefore, notAfter;
241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	803 PyObject pnotBefore, pnotAfter;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	804
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	805 retval = PyDict_New();
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	806 if (retval == NULL)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	807 return NULL;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	808
43243 e2b4fc960830 SSL certificate distinguished names should be represented by tuples Bill Janssen <janssen@parc.com> parents: 42908 diff changeset	809 peer = _create_tuple_for_X509_NAME(
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	810 X509_get_subject_name(certificate));
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	811 if (peer == NULL)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	812 goto fail0;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	813 if (PyDict_SetItemString(retval, (const char *) "subject", peer) < 0) {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	814 Py_DECREF(peer);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	815 goto fail0;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	816 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	817 Py_DECREF(peer);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	818
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	819 if (verbose) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	820 issuer = _create_tuple_for_X509_NAME(
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	821 X509_get_issuer_name(certificate));
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	822 if (issuer == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	823 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	824 if (PyDict_SetItemString(retval, (const char *)"issuer", issuer) < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	825 Py_DECREF(issuer);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	826 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	827 }
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	828 Py_DECREF(issuer);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	829
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	830 version = PyInt_FromLong(X509_get_version(certificate) + 1);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	831 if (PyDict_SetItemString(retval, "version", version) < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	832 Py_DECREF(version);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	833 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	834 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	835 Py_DECREF(version);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	836 }
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	837
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	838 /* get a memory buffer */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	839 biobuf = BIO_new(BIO_s_mem());
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	840
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	841 if (verbose) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	842
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	843 (void) BIO_reset(biobuf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	844 serialNumber = X509_get_serialNumber(certificate);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	845 /* should not exceed 20 octets, 160 bits, so buf is big enough */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	846 i2a_ASN1_INTEGER(biobuf, serialNumber);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	847 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	848 if (len < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	849 _setSSLError(NULL, 0, __FILE__, __LINE__);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	850 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	851 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	852 sn_obj = PyString_FromStringAndSize(buf, len);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	853 if (sn_obj == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	854 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	855 if (PyDict_SetItemString(retval, "serialNumber", sn_obj) < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	856 Py_DECREF(sn_obj);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	857 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	858 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	859 Py_DECREF(sn_obj);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	860
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	861 (void) BIO_reset(biobuf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	862 notBefore = X509_get_notBefore(certificate);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	863 ASN1_TIME_print(biobuf, notBefore);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	864 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	865 if (len < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	866 _setSSLError(NULL, 0, __FILE__, __LINE__);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	867 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	868 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	869 pnotBefore = PyString_FromStringAndSize(buf, len);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	870 if (pnotBefore == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	871 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	872 if (PyDict_SetItemString(retval, "notBefore", pnotBefore) < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	873 Py_DECREF(pnotBefore);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	874 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	875 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	876 Py_DECREF(pnotBefore);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	877 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	878
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	879 (void) BIO_reset(biobuf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	880 notAfter = X509_get_notAfter(certificate);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	881 ASN1_TIME_print(biobuf, notAfter);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	882 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	883 if (len < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	884 _setSSLError(NULL, 0, __FILE__, __LINE__);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	885 goto fail1;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	886 }
42829 241053739733 Try to get this to build with Visual Studio by moving all the variable Neal Norwitz <nnorwitz@gmail.com> parents: 42828 diff changeset	887 pnotAfter = PyString_FromStringAndSize(buf, len);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	888 if (pnotAfter == NULL)
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	889 goto fail1;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	890 if (PyDict_SetItemString(retval, "notAfter", pnotAfter) < 0) {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	891 Py_DECREF(pnotAfter);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	892 goto fail1;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	893 }
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	894 Py_DECREF(pnotAfter);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	895
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	896 /* Now look for subjectAltName */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	897
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	898 peer_alt_names = _get_peer_alt_names(certificate);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	899 if (peer_alt_names == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	900 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	901 else if (peer_alt_names != Py_None) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	902 if (PyDict_SetItemString(retval, "subjectAltName",
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	903 peer_alt_names) < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	904 Py_DECREF(peer_alt_names);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	905 goto fail1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	906 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	907 Py_DECREF(peer_alt_names);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	908 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	909
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	910 BIO_free(biobuf);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	911 return retval;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	912
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	913 fail1:
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	914 if (biobuf != NULL)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	915 BIO_free(biobuf);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	916 fail0:
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	917 Py_XDECREF(retval);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	918 return NULL;
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	919 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	920
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	921
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	922 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	923 PySSL_test_decode_certificate (PyObject mod, PyObject args) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	924
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	925 PyObject *retval = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	926 char *filename = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	927 X509 *x=NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	928 BIO *cert;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	929 int verbose = 1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	930
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	931 if (!PyArg_ParseTuple(args, "s\|i:test_decode_certificate", &filename, &verbose))
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	932 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	933
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	934 if ((cert=BIO_new(BIO_s_file())) == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	935 PyErr_SetString(PySSLErrorObject, "Can't malloc memory to read file");
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	936 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	937 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	938
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	939 if (BIO_read_filename(cert,filename) <= 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	940 PyErr_SetString(PySSLErrorObject, "Can't open file");
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	941 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	942 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	943
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	944 x = PEM_read_bio_X509_AUX(cert,NULL, NULL, NULL);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	945 if (x == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	946 PyErr_SetString(PySSLErrorObject, "Error decoding PEM-encoded file");
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	947 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	948 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	949
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	950 retval = _decode_certificate(x, verbose);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	951
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	952 fail0:
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	953
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	954 if (cert != NULL) BIO_free(cert);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	955 return retval;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	956 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	957
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	958
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	959 static PyObject *
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	960 PySSL_peercert(PySSLObject self, PyObject args)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	961 {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	962 PyObject *retval = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	963 int len;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	964 int verification;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	965 PyObject *binary_mode = Py_None;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	966
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	967 if (!PyArg_ParseTuple(args, "\|O:peer_certificate", &binary_mode))
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	968 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	969
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	970 if (!self->peer_cert)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	971 Py_RETURN_NONE;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	972
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	973 if (PyObject_IsTrue(binary_mode)) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	974 /* return cert in DER-encoded format */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	975
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	976 unsigned char *bytes_buf = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	977
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	978 bytes_buf = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	979 len = i2d_X509(self->peer_cert, &bytes_buf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	980 if (len < 0) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	981 PySSL_SetError(self, len, __FILE__, __LINE__);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	982 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	983 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	984 retval = PyString_FromStringAndSize((const char *) bytes_buf, len);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	985 OPENSSL_free(bytes_buf);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	986 return retval;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	987
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	988 } else {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	989
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	990 verification = SSL_CTX_get_verify_mode(self->ctx);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	991 if ((verification & SSL_VERIFY_PEER) == 0)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	992 return PyDict_New();
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	993 else
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	994 return _decode_certificate (self->peer_cert, 0);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	995 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	996 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	997
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	998 PyDoc_STRVAR(PySSL_peercert_doc,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	999 "peer_certificate([der=False]) -> certificate\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1000 \n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1001 Returns the certificate for the peer. If no certificate was provided,\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1002 returns None. If a certificate was provided, but not validated, returns\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1003 an empty dictionary. Otherwise returns a dict containing information\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1004 about the peer certificate.\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1005 \n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1006 If the optional argument is True, returns a DER-encoded copy of the\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1007 peer certificate, or None if no certificate was provided. This will\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1008 return the certificate even if it wasn't validated.");
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1009
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1010 static PyObject PySSL_cipher (PySSLObject self) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1011
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1012 PyObject retval, v;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1013 SSL_CIPHER *current;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1014 char *cipher_name;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1015 char *cipher_protocol;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1016
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1017 if (self->ssl == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1018 return Py_None;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1019 current = SSL_get_current_cipher(self->ssl);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1020 if (current == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1021 return Py_None;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1022
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1023 retval = PyTuple_New(3);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1024 if (retval == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1025 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1026
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1027 cipher_name = (char *) SSL_CIPHER_get_name(current);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1028 if (cipher_name == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1029 PyTuple_SET_ITEM(retval, 0, Py_None);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1030 } else {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1031 v = PyString_FromString(cipher_name);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1032 if (v == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1033 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1034 PyTuple_SET_ITEM(retval, 0, v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1035 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1036 cipher_protocol = SSL_CIPHER_get_version(current);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1037 if (cipher_protocol == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1038 PyTuple_SET_ITEM(retval, 1, Py_None);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1039 } else {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1040 v = PyString_FromString(cipher_protocol);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1041 if (v == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1042 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1043 PyTuple_SET_ITEM(retval, 1, v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1044 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1045 v = PyInt_FromLong(SSL_CIPHER_get_bits(current, NULL));
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1046 if (v == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1047 goto fail0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1048 PyTuple_SET_ITEM(retval, 2, v);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1049 return retval;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1050
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1051 fail0:
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1052 Py_DECREF(retval);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1053 return NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1054 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1055
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1056 static void PySSL_dealloc(PySSLObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1057 {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1058 if (self->peer_cert) /* Possible not to have one? */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1059 X509_free (self->peer_cert);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1060 if (self->ssl)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1061 SSL_free(self->ssl);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1062 if (self->ctx)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1063 SSL_CTX_free(self->ctx);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1064 Py_XDECREF(self->Socket);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1065 PyObject_Del(self);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1066 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1067
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1068 /* If the socket has a timeout, do a select()/poll() on the socket.
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1069 The argument writing indicates the direction.
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1070 Returns one of the possibilities in the timeout_state enum (above).
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1071 */
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1072
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1073 static int
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1074 check_socket_and_wait_for_timeout(PySocketSockObject *s, int writing)
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1075 {
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1076 fd_set fds;
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1077 struct timeval tv;
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1078 int rc;
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1079
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1080 /* Nothing to do unless we're in timeout mode (not non-blocking) */
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1081 if (s->sock_timeout < 0.0)
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1082 return SOCKET_IS_BLOCKING;
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1083 else if (s->sock_timeout == 0.0)
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1084 return SOCKET_IS_NONBLOCKING;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1085
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1086 /* Guard against closed socket */
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1087 if (s->sock_fd < 0)
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1088 return SOCKET_HAS_BEEN_CLOSED;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1089
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1090 /* Prefer poll, if available, since you can poll() any fd
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1091 * which can't be done with select(). */
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1092 #ifdef HAVE_POLL
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1093 {
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1094 struct pollfd pollfd;
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1095 int timeout;
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1096
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1097 pollfd.fd = s->sock_fd;
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1098 pollfd.events = writing ? POLLOUT : POLLIN;
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1099
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1100 /* s->sock_timeout is in seconds, timeout in ms */
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1101 timeout = (int)(s->sock_timeout * 1000 + 0.5);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1102 PySSL_BEGIN_ALLOW_THREADS
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1103 rc = poll(&pollfd, 1, timeout);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1104 PySSL_END_ALLOW_THREADS
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1105
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1106 goto normal_return;
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1107 }
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1108 #endif
52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1109
36452 7789cc557e1e Bug #876637, prevent stack corruption when socket descriptor Neal Norwitz <nnorwitz@gmail.com> parents: 36451 diff changeset	1110 /* Guard against socket too large for select*/
36476 c073dffbe70e Introduce Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE. Martin v. Löwis <martin@v.loewis.de> parents: 36452 diff changeset	1111 #ifndef Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE
36452 7789cc557e1e Bug #876637, prevent stack corruption when socket descriptor Neal Norwitz <nnorwitz@gmail.com> parents: 36451 diff changeset	1112 if (s->sock_fd >= FD_SETSIZE)
36487 07ba8aae3dc6 Try to improve name based on discussion on python-checkins with Jim Jewett Neal Norwitz <nnorwitz@gmail.com> parents: 36476 diff changeset	1113 return SOCKET_TOO_LARGE_FOR_SELECT;
36476 c073dffbe70e Introduce Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE. Martin v. Löwis <martin@v.loewis.de> parents: 36452 diff changeset	1114 #endif
36452 7789cc557e1e Bug #876637, prevent stack corruption when socket descriptor Neal Norwitz <nnorwitz@gmail.com> parents: 36451 diff changeset	1115
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1116 /* Construct the arguments to select */
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1117 tv.tv_sec = (int)s->sock_timeout;
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1118 tv.tv_usec = (int)((s->sock_timeout - tv.tv_sec) * 1e6);
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1119 FD_ZERO(&fds);
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1120 FD_SET(s->sock_fd, &fds);
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1121
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1122 /* See if the socket is ready */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1123 PySSL_BEGIN_ALLOW_THREADS
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1124 if (writing)
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1125 rc = select(s->sock_fd+1, NULL, &fds, NULL, &tv);
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1126 else
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1127 rc = select(s->sock_fd+1, &fds, NULL, NULL, &tv);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1128 PySSL_END_ALLOW_THREADS
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1129
39059 52a8738f5ab4 #1494314: Fix a regression with high-numbered sockets in 2.4.3. This Anthony Baxter <anthonybaxter@gmail.com> parents: 38152 diff changeset	1130 normal_return:
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1131 /* Return SOCKET_TIMED_OUT on timeout, SOCKET_OPERATION_OK otherwise
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1132 (when we are able to write or when there's something to read) */
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1133 return rc == 0 ? SOCKET_HAS_TIMED_OUT : SOCKET_OPERATION_OK;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1134 }
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1135
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1136 static PyObject PySSL_SSLwrite(PySSLObject self, PyObject *args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1137 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1138 char *data;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1139 int len;
30795 9da537167b74 Patch #803998: Correctly check for error in SSL_write. Martin v. Löwis <martin@v.loewis.de> parents: 30723 diff changeset	1140 int count;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1141 int sockstate;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1142 int err;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1143
30795 9da537167b74 Patch #803998: Correctly check for error in SSL_write. Martin v. Löwis <martin@v.loewis.de> parents: 30723 diff changeset	1144 if (!PyArg_ParseTuple(args, "s#:write", &data, &count))
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1145 return NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1146
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1147 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1148 if (sockstate == SOCKET_HAS_TIMED_OUT) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1149 PyErr_SetString(PySSLErrorObject,
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1150 "The write operation timed out");
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1151 return NULL;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1152 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1153 PyErr_SetString(PySSLErrorObject,
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1154 "Underlying socket has been closed.");
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1155 return NULL;
36487 07ba8aae3dc6 Try to improve name based on discussion on python-checkins with Jim Jewett Neal Norwitz <nnorwitz@gmail.com> parents: 36476 diff changeset	1156 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1157 PyErr_SetString(PySSLErrorObject,
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1158 "Underlying socket too large for select().");
36452 7789cc557e1e Bug #876637, prevent stack corruption when socket descriptor Neal Norwitz <nnorwitz@gmail.com> parents: 36451 diff changeset	1159 return NULL;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1160 }
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1161 do {
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1162 err = 0;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1163 PySSL_BEGIN_ALLOW_THREADS
30795 9da537167b74 Patch #803998: Correctly check for error in SSL_write. Martin v. Löwis <martin@v.loewis.de> parents: 30723 diff changeset	1164 len = SSL_write(self->ssl, data, count);
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1165 err = SSL_get_error(self->ssl, len);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1166 PySSL_END_ALLOW_THREADS
29629 a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	1167 if(PyErr_CheckSignals()) {
a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	1168 return NULL;
a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	1169 }
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1170 if (err == SSL_ERROR_WANT_READ) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1171 sockstate =
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1172 check_socket_and_wait_for_timeout(self->Socket, 0);
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1173 } else if (err == SSL_ERROR_WANT_WRITE) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1174 sockstate =
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1175 check_socket_and_wait_for_timeout(self->Socket, 1);
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1176 } else {
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1177 sockstate = SOCKET_OPERATION_OK;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1178 }
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1179 if (sockstate == SOCKET_HAS_TIMED_OUT) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1180 PyErr_SetString(PySSLErrorObject,
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1181 "The write operation timed out");
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1182 return NULL;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1183 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1184 PyErr_SetString(PySSLErrorObject,
5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1185 "Underlying socket has been closed.");
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1186 return NULL;
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1187 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1188 break;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1189 }
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1190 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1191 if (len > 0)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1192 return PyInt_FromLong(len);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1193 else
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1194 return PySSL_SetError(self, len, __FILE__, __LINE__);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1195 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1196
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1197 PyDoc_STRVAR(PySSL_SSLwrite_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1198 "write(s) -> len\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1199 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1200 Writes the string s into the SSL object. Returns the number\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1201 of bytes written.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1202
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1203 static PyObject PySSL_SSLread(PySSLObject self, PyObject *args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1204 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1205 PyObject *buf;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1206 int count = 0;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1207 int len = 1024;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1208 int sockstate;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1209 int err;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1210
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1211 if (!PyArg_ParseTuple(args, "\|i:read", &len))
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1212 return NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1213
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1214 if (!(buf = PyString_FromStringAndSize((char *) 0, len)))
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1215 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1216
37339 6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1217 /* first check if there are bytes ready to be read */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1218 PySSL_BEGIN_ALLOW_THREADS
37339 6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1219 count = SSL_pending(self->ssl);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1220 PySSL_END_ALLOW_THREADS
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1221
37339 6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1222 if (!count) {
6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1223 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1224 if (sockstate == SOCKET_HAS_TIMED_OUT) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1225 PyErr_SetString(PySSLErrorObject,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1226 "The read operation timed out");
37339 6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1227 Py_DECREF(buf);
6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1228 return NULL;
6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1229 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1230 PyErr_SetString(PySSLErrorObject,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1231 "Underlying socket too large for select().");
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1232 Py_DECREF(buf);
37339 6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1233 return NULL;
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1234 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	1235 /* should contain a zero-length string */
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	1236 _PyString_Resize(&buf, 0);
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	1237 return buf;
37339 6fef957712b9 Patch #1380952: fix SSL objects timing out on consecutive read()s Georg Brandl <georg@python.org> parents: 36487 diff changeset	1238 }
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1239 }
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1240 do {
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1241 err = 0;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1242 PySSL_BEGIN_ALLOW_THREADS
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1243 count = SSL_read(self->ssl, PyString_AsString(buf), len);
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1244 err = SSL_get_error(self->ssl, count);
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1245 PySSL_END_ALLOW_THREADS
29629 a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	1246 if(PyErr_CheckSignals()) {
a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	1247 Py_DECREF(buf);
a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	1248 return NULL;
a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	1249 }
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1250 if (err == SSL_ERROR_WANT_READ) {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1251 sockstate =
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1252 check_socket_and_wait_for_timeout(self->Socket, 0);
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1253 } else if (err == SSL_ERROR_WANT_WRITE) {
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1254 sockstate =
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1255 check_socket_and_wait_for_timeout(self->Socket, 1);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1256 } else if ((err == SSL_ERROR_ZERO_RETURN) &&
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1257 (SSL_get_shutdown(self->ssl) ==
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1258 SSL_RECEIVED_SHUTDOWN))
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1259 {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1260 _PyString_Resize(&buf, 0);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1261 return buf;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1262 } else {
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1263 sockstate = SOCKET_OPERATION_OK;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1264 }
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1265 if (sockstate == SOCKET_HAS_TIMED_OUT) {
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1266 PyErr_SetString(PySSLErrorObject,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1267 "The read operation timed out");
29629 a4d6bc71f091 Patch #751916: Check for signals, fix some refcounting errors. Martin v. Löwis <martin@v.loewis.de> parents: 27594 diff changeset	1268 Py_DECREF(buf);
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1269 return NULL;
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1270 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1271 break;
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1272 }
5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	1273 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1274 if (count <= 0) {
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1275 Py_DECREF(buf);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1276 return PySSL_SetError(self, count, __FILE__, __LINE__);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1277 }
23295 6fa76b4e59fe Repair widespread misuse of _PyString_Resize. Since it's clear people Tim Peters <tim.peters@gmail.com> parents: 23190 diff changeset	1278 if (count != len)
6fa76b4e59fe Repair widespread misuse of _PyString_Resize. Since it's clear people Tim Peters <tim.peters@gmail.com> parents: 23190 diff changeset	1279 _PyString_Resize(&buf, count);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1280 return buf;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1281 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1282
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1283 PyDoc_STRVAR(PySSL_SSLread_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1284 "read([len]) -> string\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1285 \n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1286 Read up to len bytes from the SSL socket.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1287
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1288 static PyMethodDef PySSLMethods[] = {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1289 {"write", (PyCFunction)PySSL_SSLwrite, METH_VARARGS,
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1290 PySSL_SSLwrite_doc},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1291 {"read", (PyCFunction)PySSL_SSLread, METH_VARARGS,
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1292 PySSL_SSLread_doc},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1293 {"server", (PyCFunction)PySSL_server, METH_NOARGS},
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1294 {"issuer", (PyCFunction)PySSL_issuer, METH_NOARGS},
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1295 {"peer_certificate", (PyCFunction)PySSL_peercert, METH_VARARGS,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1296 PySSL_peercert_doc},
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1297 {"cipher", (PyCFunction)PySSL_cipher, METH_NOARGS},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1298 {NULL, NULL}
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1299 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1300
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1301 static PyObject PySSL_getattr(PySSLObject self, char *name)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1302 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1303 return Py_FindMethod(PySSLMethods, (PyObject *)self, name);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1304 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1305
24280 1598a1e473e2 staticforward bites the dust. Jeremy Hylton <jeremy@alum.mit.edu> parents: 24086 diff changeset	1306 static PyTypeObject PySSL_Type = {
42333 6620a510e9a9 PEP 3123: Provide forward compatibility with Python 3.0, while keeping Martin v. Löwis <martin@v.loewis.de> parents: 40152 diff changeset	1307 PyVarObject_HEAD_INIT(NULL, 0)
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1308 "ssl.SSLContext", /tp_name/
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1309 sizeof(PySSLObject), /tp_basicsize/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1310 0, /tp_itemsize/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1311 /* methods */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1312 (destructor)PySSL_dealloc, /tp_dealloc/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1313 0, /tp_print/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1314 (getattrfunc)PySSL_getattr, /tp_getattr/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1315 0, /tp_setattr/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1316 0, /tp_compare/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1317 0, /tp_repr/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1318 0, /tp_as_number/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1319 0, /tp_as_sequence/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1320 0, /tp_as_mapping/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1321 0, /tp_hash/
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1322 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1323
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1324 #ifdef HAVE_OPENSSL_RAND
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1325
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1326 /* helper routines for seeding the SSL PRNG */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1327 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1328 PySSL_RAND_add(PyObject self, PyObject args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1329 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1330 char *buf;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1331 int len;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1332 double entropy;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1333
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1334 if (!PyArg_ParseTuple(args, "s#d:RAND_add", &buf, &len, &entropy))
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1335 return NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1336 RAND_add(buf, len, entropy);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1337 Py_INCREF(Py_None);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1338 return Py_None;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1339 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1340
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1341 PyDoc_STRVAR(PySSL_RAND_add_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1342 "RAND_add(string, entropy)\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1343 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1344 Mix string into the OpenSSL PRNG state. entropy (a float) is a lower\n\
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1345 bound on the entropy contained in string. See RFC 1750.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1346
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1347 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1348 PySSL_RAND_status(PyObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1349 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1350 return PyInt_FromLong(RAND_status());
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1351 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1352
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1353 PyDoc_STRVAR(PySSL_RAND_status_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1354 "RAND_status() -> 0 or 1\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1355 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1356 Returns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1357 It is necessary to seed the PRNG with RAND_add() on some platforms before\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1358 using the ssl() function.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1359
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1360 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1361 PySSL_RAND_egd(PyObject self, PyObject arg)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1362 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1363 int bytes;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1364
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1365 if (!PyString_Check(arg))
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1366 return PyErr_Format(PyExc_TypeError,
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1367 "RAND_egd() expected string, found %s",
44350 26384b8180c7 #1629: Renamed Py_Size, Py_Type and Py_Refcnt to Py_SIZE, Py_TYPE and Py_REFCNT. Macros for b/w compatibility are available. Christian Heimes <christian@cheimes.de> parents: 44296 diff changeset	1368 Py_TYPE(arg)->tp_name);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1369 bytes = RAND_egd(PyString_AS_STRING(arg));
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1370 if (bytes == -1) {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1371 PyErr_SetString(PySSLErrorObject,
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1372 "EGD connection failed or EGD did not return "
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1373 "enough data to seed the PRNG");
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1374 return NULL;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1375 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1376 return PyInt_FromLong(bytes);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1377 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1378
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1379 PyDoc_STRVAR(PySSL_RAND_egd_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1380 "RAND_egd(path) -> bytes\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1381 \n\
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1382 Queries the entropy gather daemon (EGD) on the socket named by 'path'.\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1383 Returns number of bytes read. Raises SSLError if connection to EGD\n\
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1384 fails or if it does provide enough data to seed PRNG.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1385
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1386 #endif
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1387
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1388 /* List of functions exported by this module. */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1389
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1390 static PyMethodDef PySSL_methods[] = {
42908 5805fe17cb2d > Some of the code sets the error string in this directly before Guido van Rossum <guido@python.org> parents: 42831 diff changeset	1391 {"sslwrap", PySSL_sslwrap,
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1392 METH_VARARGS, ssl_doc},
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1393 {"_test_decode_cert", PySSL_test_decode_certificate,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1394 METH_VARARGS},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1395 #ifdef HAVE_OPENSSL_RAND
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1396 {"RAND_add", PySSL_RAND_add, METH_VARARGS,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1397 PySSL_RAND_add_doc},
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1398 {"RAND_egd", PySSL_RAND_egd, METH_O,
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1399 PySSL_RAND_egd_doc},
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1400 {"RAND_status", (PyCFunction)PySSL_RAND_status, METH_NOARGS,
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1401 PySSL_RAND_status_doc},
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1402 #endif
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1403 {NULL, NULL} /* Sentinel */
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1404 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1405
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1406
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1407 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1408
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1409 /* an implementation of OpenSSL threading operations in terms
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1410 of the Python C thread library */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1411
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1412 static PyThread_type_lock *_ssl_locks = NULL;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1413
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1414 static unsigned long _ssl_thread_id_function (void) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1415 return PyThread_get_thread_ident();
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1416 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1417
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1418 static void _ssl_thread_locking_function (int mode, int n, const char *file, int line) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1419 /* this function is needed to perform locking on shared data
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1420 structures. (Note that OpenSSL uses a number of global data
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1421 structures that will be implicitly shared whenever multiple threads
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1422 use OpenSSL.) Multi-threaded applications will crash at random if
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1423 it is not set.
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1424
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1425 locking_function() must be able to handle up to CRYPTO_num_locks()
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1426 different mutex locks. It sets the n-th lock if mode & CRYPTO_LOCK, and
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1427 releases it otherwise.
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1428
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1429 file and line are the file number of the function setting the
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1430 lock. They can be useful for debugging.
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1431 */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1432
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1433 if ((_ssl_locks == NULL) \|\|
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1434 (n < 0) \|\| (n >= _ssl_locks_count))
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1435 return;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1436
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1437 if (mode & CRYPTO_LOCK) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1438 PyThread_acquire_lock(_ssl_locks[n], 1);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1439 } else {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1440 PyThread_release_lock(_ssl_locks[n]);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1441 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1442 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1443
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1444 static int _setup_ssl_threads(void) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1445
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1446 int i;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1447
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1448 if (_ssl_locks == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1449 _ssl_locks_count = CRYPTO_num_locks();
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1450 _ssl_locks = (PyThread_type_lock *)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1451 malloc(sizeof(PyThread_type_lock) * _ssl_locks_count);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1452 if (_ssl_locks == NULL)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1453 return 0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1454 memset(_ssl_locks, 0, sizeof(PyThread_type_lock) * _ssl_locks_count);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1455 for (i = 0; i < _ssl_locks_count; i++) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1456 _ssl_locks[i] = PyThread_allocate_lock();
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1457 if (_ssl_locks[i] == NULL) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1458 int j;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1459 for (j = 0; j < i; j++) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1460 PyThread_free_lock(_ssl_locks[j]);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1461 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1462 free(_ssl_locks);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1463 return 0;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1464 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1465 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1466 CRYPTO_set_locking_callback(_ssl_thread_locking_function);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1467 CRYPTO_set_id_callback(_ssl_thread_id_function);
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1468 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1469 return 1;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1470 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1471
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1472 #endif /* def HAVE_THREAD */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1473
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1474 PyDoc_STRVAR(module_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1475 "Implementation module for SSL socket operations. See the socket module\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1476 for documentation.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1477
24471 f66b3a3509c7 Excise DL_EXPORT/DL_IMPORT from Modules/. Required adding a prototype Mark Hammond <mhammond@skippinet.com.au>* parents: 24398 diff changeset	1478 PyMODINIT_FUNC
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1479 init_ssl(void)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1480 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1481 PyObject m, d;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1482
44350 26384b8180c7 #1629: Renamed Py_Size, Py_Type and Py_Refcnt to Py_SIZE, Py_TYPE and Py_REFCNT. Macros for b/w compatibility are available. Christian Heimes <christian@cheimes.de> parents: 44296 diff changeset	1483 Py_TYPE(&PySSL_Type) = &PyType_Type;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1484
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1485 m = Py_InitModule3("_ssl", PySSL_methods, module_doc);
36324 1af7f719ed28 Check return result from Py_InitModule(). This API can fail. Neal Norwitz <nnorwitz@gmail.com>* parents: 32960 diff changeset	1486 if (m == NULL)
1af7f719ed28 Check return result from Py_InitModule(). This API can fail. Neal Norwitz <nnorwitz@gmail.com>* parents: 32960 diff changeset	1487 return;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1488 d = PyModule_GetDict(m);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1489
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1490 /* Load _socket module and its C API */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1491 if (PySocketModule_ImportModuleAndAPI())
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1492 return;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1493
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1494 /* Init OpenSSL */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1495 SSL_load_error_strings();
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1496 #ifdef WITH_THREAD
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1497 /* note that this will start threading if not already started */
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1498 if (!_setup_ssl_threads()) {
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1499 return;
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1500 }
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1501 #endif
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1502 SSLeay_add_ssl_algorithms();
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1503
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1504 /* Add symbols to module dict */
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1505 PySSLErrorObject = PyErr_NewException("ssl.SSLError",
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1506 PySocketModule.error,
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1507 NULL);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1508 if (PySSLErrorObject == NULL)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1509 return;
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43243 diff changeset	1510 if (PyDict_SetItemString(d, "SSLError", PySSLErrorObject) != 0)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1511 return;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1512 if (PyDict_SetItemString(d, "SSLType",
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1513 (PyObject *)&PySSL_Type) != 0)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1514 return;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1515 PyModule_AddIntConstant(m, "SSL_ERROR_ZERO_RETURN",
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1516 PY_SSL_ERROR_ZERO_RETURN);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1517 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_READ",
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1518 PY_SSL_ERROR_WANT_READ);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1519 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_WRITE",
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1520 PY_SSL_ERROR_WANT_WRITE);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1521 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_X509_LOOKUP",
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1522 PY_SSL_ERROR_WANT_X509_LOOKUP);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1523 PyModule_AddIntConstant(m, "SSL_ERROR_SYSCALL",
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1524 PY_SSL_ERROR_SYSCALL);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1525 PyModule_AddIntConstant(m, "SSL_ERROR_SSL",
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1526 PY_SSL_ERROR_SSL);
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1527 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_CONNECT",
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1528 PY_SSL_ERROR_WANT_CONNECT);
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1529 /* non ssl.h errorcodes */
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1530 PyModule_AddIntConstant(m, "SSL_ERROR_EOF",
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1531 PY_SSL_ERROR_EOF);
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1532 PyModule_AddIntConstant(m, "SSL_ERROR_INVALID_ERROR_CODE",
0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1533 PY_SSL_ERROR_INVALID_ERROR_CODE);
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1534 /* cert requirements */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1535 PyModule_AddIntConstant(m, "CERT_NONE",
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1536 PY_SSL_CERT_NONE);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1537 PyModule_AddIntConstant(m, "CERT_OPTIONAL",
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1538 PY_SSL_CERT_OPTIONAL);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1539 PyModule_AddIntConstant(m, "CERT_REQUIRED",
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1540 PY_SSL_CERT_REQUIRED);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	1541
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1542 /* protocol versions */
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1543 PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1544 PY_SSL_VERSION_SSL2);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1545 PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1546 PY_SSL_VERSION_SSL3);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1547 PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1548 PY_SSL_VERSION_SSL23);
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1549 PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: 42333 diff changeset	1550 PY_SSL_VERSION_TLS1);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1551 }

Mercurial > cpython-lru_cache-weakref

annotate Modules/_ssl.c @ 44825:ef859cd754a7 legacy-trunk