cpython-lru_cache-weakref: Modules/

annotate Modules/_ssl.c @ 87690:66c1c9f32567 default tip

Add use_weakref option to functools.lru_cache The use_weakref option makes lru_cache create weak references to the function arguments when creating the cache key, which prevents them from staying in the memory forever even after all other references to them are gone. This is a proof of concept for http://bugs.python.org/issue19859

author	Radomir Dopieralski <devel@sheep.art.pl>
date	Tue, 03 Dec 2013 16:02:48 +0100
parents	aa531135bc6b
children

rev	line source
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1 /* SSL socket module
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	2
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3 SSL support based on patches by Brian E Gallew and Laszlo Kovacs.
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	4 Re-worked a bit by Bill Janssen to add server-side support and
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	5 certificate decoding. Chris Stawarz contributed some non-blocking
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	6 patches.
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	7
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	8 This module is imported by ssl.py. It should not be used
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	9 directly.
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	10
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	11 XXX should partial writes be enabled, SSL_MODE_ENABLE_PARTIAL_WRITE?
60901 fc97784e5cc2 Merged revisions 80394 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60818 diff changeset	12
fc97784e5cc2 Merged revisions 80394 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60818 diff changeset	13 XXX integrate several "shutdown modes" as suggested in
fc97784e5cc2 Merged revisions 80394 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60818 diff changeset	14 http://bugs.python.org/issue8108#msg102867 ?
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	15 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	16
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	17 #include "Python.h"
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	18
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	19 #ifdef WITH_THREAD
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	20 #include "pythread.h"
85290 8e1194c39bed Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork. Christian Heimes <christian@cheimes.de> parents: 85263 diff changeset	21
8e1194c39bed Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork. Christian Heimes <christian@cheimes.de> parents: 85263 diff changeset	22
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	23 #define PySSL_BEGIN_ALLOW_THREADS_S(save) \
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	24 do { if (_ssl_locks_count>0) { (save) = PyEval_SaveThread(); } } while (0)
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	25 #define PySSL_END_ALLOW_THREADS_S(save) \
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	26 do { if (_ssl_locks_count>0) { PyEval_RestoreThread(save); } } while (0)
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	27 #define PySSL_BEGIN_ALLOW_THREADS { \
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	28 PyThreadState *_save = NULL; \
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	29 PySSL_BEGIN_ALLOW_THREADS_S(_save);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	30 #define PySSL_BLOCK_THREADS PySSL_END_ALLOW_THREADS_S(_save);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	31 #define PySSL_UNBLOCK_THREADS PySSL_BEGIN_ALLOW_THREADS_S(_save);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	32 #define PySSL_END_ALLOW_THREADS PySSL_END_ALLOW_THREADS_S(_save); }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	33
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	34 #else /* no WITH_THREAD */
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	35
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	36 #define PySSL_BEGIN_ALLOW_THREADS_S(save)
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	37 #define PySSL_END_ALLOW_THREADS_S(save)
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	38 #define PySSL_BEGIN_ALLOW_THREADS
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	39 #define PySSL_BLOCK_THREADS
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	40 #define PySSL_UNBLOCK_THREADS
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	41 #define PySSL_END_ALLOW_THREADS
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	42
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	43 #endif
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	44
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	45 /* Include symbols from _socket module */
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	46 #include "socketmodule.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	47
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	48 static PySocketModule_APIObject PySocketModule;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	49
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	50 #if defined(HAVE_POLL_H)
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	51 #include <poll.h>
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	52 #elif defined(HAVE_SYS_POLL_H)
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	53 #include <sys/poll.h>
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	54 #endif
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	55
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	56 /* Include OpenSSL header files */
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	57 #include "openssl/rsa.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	58 #include "openssl/crypto.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	59 #include "openssl/x509.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	60 #include "openssl/x509v3.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	61 #include "openssl/pem.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	62 #include "openssl/ssl.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	63 #include "openssl/err.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	64 #include "openssl/rand.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	65
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	66 /* SSL error object */
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	67 static PyObject *PySSLErrorObject;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	68 static PyObject *PySSLZeroReturnErrorObject;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	69 static PyObject *PySSLWantReadErrorObject;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	70 static PyObject *PySSLWantWriteErrorObject;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	71 static PyObject *PySSLSyscallErrorObject;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	72 static PyObject *PySSLEOFErrorObject;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	73
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	74 /* Error mappings */
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	75 static PyObject *err_codes_to_names;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	76 static PyObject *err_names_to_codes;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	77 static PyObject *lib_codes_to_names;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	78
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	79 struct py_ssl_error_code {
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	80 const char *mnemonic;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	81 int library, reason;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	82 };
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	83 struct py_ssl_library_code {
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	84 const char *library;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	85 int code;
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	86 };
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	87
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	88 /* Include generated data (error codes) */
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	89 #include "_ssl_data.h"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	90
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	91 /* Openssl comes with TLSv1.1 and TLSv1.2 between 1.0.0h and 1.0.1
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	92 http://www.openssl.org/news/changelog.html
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	93 */
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	94 #if OPENSSL_VERSION_NUMBER >= 0x10001000L
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	95 # define HAVE_TLSv1_2 1
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	96 #else
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	97 # define HAVE_TLSv1_2 0
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	98 #endif
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	99
87623 87858e0b757d SNI was added in OpenSSL 0.9.8f [11 Oct 2007], too Christian Heimes <christian@cheimes.de> parents: 87397 diff changeset	100 /* SNI support (client- and server-side) appeared in OpenSSL 1.0.0 and 0.9.8f
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	101 * This includes the SSL_set_SSL_CTX() function.
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	102 */
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	103 #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	104 # define HAVE_SNI 1
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	105 #else
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	106 # define HAVE_SNI 0
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	107 #endif
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	108
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	109 enum py_ssl_error {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	110 /* these mirror ssl.h */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	111 PY_SSL_ERROR_NONE,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	112 PY_SSL_ERROR_SSL,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	113 PY_SSL_ERROR_WANT_READ,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	114 PY_SSL_ERROR_WANT_WRITE,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	115 PY_SSL_ERROR_WANT_X509_LOOKUP,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	116 PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	117 PY_SSL_ERROR_ZERO_RETURN,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	118 PY_SSL_ERROR_WANT_CONNECT,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	119 /* start of non ssl.h errorcodes */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	120 PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	121 PY_SSL_ERROR_NO_SOCKET, /* socket has been GC'd */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	122 PY_SSL_ERROR_INVALID_ERROR_CODE
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	123 };
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	124
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	125 enum py_ssl_server_or_client {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	126 PY_SSL_CLIENT,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	127 PY_SSL_SERVER
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	128 };
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	129
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	130 enum py_ssl_cert_requirements {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	131 PY_SSL_CERT_NONE,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	132 PY_SSL_CERT_OPTIONAL,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	133 PY_SSL_CERT_REQUIRED
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	134 };
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	135
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	136 enum py_ssl_version {
69997 b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 66806 diff changeset	137 #ifndef OPENSSL_NO_SSL2
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	138 PY_SSL_VERSION_SSL2,
69997 b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 66806 diff changeset	139 #endif
b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 66806 diff changeset	140 PY_SSL_VERSION_SSL3=1,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	141 PY_SSL_VERSION_SSL23,
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	142 #if HAVE_TLSv1_2
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	143 PY_SSL_VERSION_TLS1,
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	144 PY_SSL_VERSION_TLS1_1,
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	145 PY_SSL_VERSION_TLS1_2
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	146 #else
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	147 PY_SSL_VERSION_TLS1
39442 654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	148 #endif
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	149 };
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	150
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	151 #ifdef WITH_THREAD
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	152
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	153 /* serves as a flag to see whether we've initialized the SSL thread support. */
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	154 /* 0 means no, greater than 0 means yes */
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	155
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	156 static unsigned int _ssl_locks_count = 0;
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	157
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	158 #endif /* def WITH_THREAD */
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	159
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	160 /* SSL socket object */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	161
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	162 #define X509_NAME_MAXLEN 256
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	163
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	164 /* RAND_* APIs got added to OpenSSL in 0.9.5 */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	165 #if OPENSSL_VERSION_NUMBER >= 0x0090500fL
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	166 # define HAVE_OPENSSL_RAND 1
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	167 #else
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	168 # undef HAVE_OPENSSL_RAND
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	169 #endif
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	170
65246 23ec0be07e20 Fix compile on NetBSD 5.0 (or anything else using an old 0.9.9-dev OpenSSL). Gregory P. Smith <greg@mad-scientist.com> parents: 65223 diff changeset	171 /* SSL_CTX_clear_options() and SSL_clear_options() were first added in
23ec0be07e20 Fix compile on NetBSD 5.0 (or anything else using an old 0.9.9-dev OpenSSL). Gregory P. Smith <greg@mad-scientist.com> parents: 65223 diff changeset	172 * OpenSSL 0.9.8m but do not appear in some 0.9.9-dev versions such the
23ec0be07e20 Fix compile on NetBSD 5.0 (or anything else using an old 0.9.9-dev OpenSSL). Gregory P. Smith <greg@mad-scientist.com> parents: 65223 diff changeset	173 * 0.9.9 from "May 2008" that NetBSD 5.0 uses. */
23ec0be07e20 Fix compile on NetBSD 5.0 (or anything else using an old 0.9.9-dev OpenSSL). Gregory P. Smith <greg@mad-scientist.com> parents: 65223 diff changeset	174 #if OPENSSL_VERSION_NUMBER >= 0x009080dfL && OPENSSL_VERSION_NUMBER != 0x00909000L
61782 5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	175 # define HAVE_SSL_CTX_CLEAR_OPTIONS
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	176 #else
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	177 # undef HAVE_SSL_CTX_CLEAR_OPTIONS
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	178 #endif
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	179
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	180 /* In case of 'tls-unique' it will be 12 bytes for TLS, 36 bytes for
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	181 * older SSL, but let's be safe */
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	182 #define PySSL_CB_MAXLEN 128
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	183
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	184 /* SSL_get_finished got added to OpenSSL in 0.9.5 */
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	185 #if OPENSSL_VERSION_NUMBER >= 0x0090500fL
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	186 # define HAVE_OPENSSL_FINISHED 1
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	187 #else
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	188 # define HAVE_OPENSSL_FINISHED 0
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	189 #endif
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	190
75005 06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74995 diff changeset	191 /* ECDH support got added to OpenSSL in 0.9.8 */
06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74995 diff changeset	192 #if OPENSSL_VERSION_NUMBER < 0x0090800fL && !defined(OPENSSL_NO_ECDH)
06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74995 diff changeset	193 # define OPENSSL_NO_ECDH
06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74995 diff changeset	194 #endif
06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74995 diff changeset	195
75043 1a06f0a8120f Fix last remaining build issues of _ssl under old OpenSSLs. Patch by Vinay. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	196 /* compression support got added to OpenSSL in 0.9.8 */
1a06f0a8120f Fix last remaining build issues of _ssl under old OpenSSLs. Patch by Vinay. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	197 #if OPENSSL_VERSION_NUMBER < 0x0090800fL && !defined(OPENSSL_NO_COMP)
1a06f0a8120f Fix last remaining build issues of _ssl under old OpenSSLs. Patch by Vinay. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	198 # define OPENSSL_NO_COMP
1a06f0a8120f Fix last remaining build issues of _ssl under old OpenSSLs. Patch by Vinay. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	199 #endif
1a06f0a8120f Fix last remaining build issues of _ssl under old OpenSSLs. Patch by Vinay. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	200
87397 40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	201 /* X509_VERIFY_PARAM got added to OpenSSL in 0.9.8 */
40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	202 #if OPENSSL_VERSION_NUMBER >= 0x0090800fL
40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	203 # define HAVE_OPENSSL_VERIFY_PARAM
40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	204 #endif
40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	205
75005 06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74995 diff changeset	206
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	207 typedef struct {
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	208 PyObject_HEAD
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	209 SSL_CTX *ctx;
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	210 #ifdef OPENSSL_NPN_NEGOTIATED
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	211 char *npn_protocols;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	212 int npn_protocols_len;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	213 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	214 #ifndef OPENSSL_NO_TLSEXT
84334 28f47a5d59b9 _ssl.c: strip trailing spaces Victor Stinner <victor.stinner@gmail.com> parents: 84333 diff changeset	215 PyObject *set_hostname;
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	216 #endif
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	217 int check_hostname;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	218 } PySSLContext;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	219
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	220 typedef struct {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	221 PyObject_HEAD
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	222 PyObject Socket; / weakref to socket on which we're layered */
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	223 SSL *ssl;
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	224 PySSLContext ctx; / weakref to SSL context */
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	225 X509 *peer_cert;
85857 ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	226 char shutdown_seen_zero;
ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	227 char handshake_done;
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	228 enum py_ssl_server_or_client socket_type;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	229 } PySSLSocket;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	230
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	231 static PyTypeObject PySSLContext_Type;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	232 static PyTypeObject PySSLSocket_Type;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	233
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	234 static PyObject PySSL_SSLwrite(PySSLSocket self, PyObject *args);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	235 static PyObject PySSL_SSLread(PySSLSocket self, PyObject *args);
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	236 static int check_socket_and_wait_for_timeout(PySocketSockObject *s,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	237 int writing);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	238 static PyObject PySSL_peercert(PySSLSocket self, PyObject *args);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	239 static PyObject PySSL_cipher(PySSLSocket self);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	240
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	241 #define PySSLContext_Check(v) (Py_TYPE(v) == &PySSLContext_Type)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	242 #define PySSLSocket_Check(v) (Py_TYPE(v) == &PySSLSocket_Type)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	243
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	244 typedef enum {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	245 SOCKET_IS_NONBLOCKING,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	246 SOCKET_IS_BLOCKING,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	247 SOCKET_HAS_TIMED_OUT,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	248 SOCKET_HAS_BEEN_CLOSED,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	249 SOCKET_TOO_LARGE_FOR_SELECT,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	250 SOCKET_OPERATION_OK
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	251 } timeout_state;
598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	252
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	253 /* Wrap error strings with filename and line # */
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	254 #define STRINGIFY1(x) #x
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	255 #define STRINGIFY2(x) STRINGIFY1(x)
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	256 #define ERRSTR1(x,y,z) (x ":" y ": " z)
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	257 #define ERRSTR(x) ERRSTR1("_ssl.c", STRINGIFY2(__LINE__), x)
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	258
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	259
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	260 /*
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	261 * SSL errors.
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	262 */
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	263
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	264 PyDoc_STRVAR(SSLError_doc,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	265 "An error occurred in the SSL implementation.");
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	266
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	267 PyDoc_STRVAR(SSLZeroReturnError_doc,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	268 "SSL/TLS session closed cleanly.");
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	269
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	270 PyDoc_STRVAR(SSLWantReadError_doc,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	271 "Non-blocking SSL socket needs to read more data\n"
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	272 "before the requested operation can be completed.");
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	273
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	274 PyDoc_STRVAR(SSLWantWriteError_doc,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	275 "Non-blocking SSL socket needs to write more data\n"
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	276 "before the requested operation can be completed.");
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	277
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	278 PyDoc_STRVAR(SSLSyscallError_doc,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	279 "System error when attempting SSL operation.");
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	280
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	281 PyDoc_STRVAR(SSLEOFError_doc,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	282 "SSL/TLS connection terminated abruptly.");
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	283
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	284 static PyObject *
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	285 SSLError_str(PyOSErrorObject *self)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	286 {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	287 if (self->strerror != NULL && PyUnicode_Check(self->strerror)) {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	288 Py_INCREF(self->strerror);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	289 return self->strerror;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	290 }
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	291 else
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	292 return PyObject_Str(self->args);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	293 }
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	294
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	295 static PyType_Slot sslerror_type_slots[] = {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	296 {Py_tp_base, NULL}, /* Filled out in module init as it's not a constant */
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	297 {Py_tp_doc, SSLError_doc},
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	298 {Py_tp_str, SSLError_str},
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	299 {0, 0},
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	300 };
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	301
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	302 static PyType_Spec sslerror_type_spec = {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	303 "ssl.SSLError",
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	304 sizeof(PyOSErrorObject),
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	305 0,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	306 Py_TPFLAGS_DEFAULT \| Py_TPFLAGS_BASETYPE,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	307 sslerror_type_slots
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	308 };
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	309
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	310 static void
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	311 fill_and_set_sslerror(PyObject type, int ssl_errno, const char errstr,
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	312 int lineno, unsigned long errcode)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	313 {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	314 PyObject err_value = NULL, reason_obj = NULL, *lib_obj = NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	315 PyObject init_value, msg, *key;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	316 _Py_IDENTIFIER(reason);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	317 _Py_IDENTIFIER(library);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	318
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	319 if (errcode != 0) {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	320 int lib, reason;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	321
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	322 lib = ERR_GET_LIB(errcode);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	323 reason = ERR_GET_REASON(errcode);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	324 key = Py_BuildValue("ii", lib, reason);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	325 if (key == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	326 goto fail;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	327 reason_obj = PyDict_GetItem(err_codes_to_names, key);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	328 Py_DECREF(key);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	329 if (reason_obj == NULL) {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	330 /* XXX if reason < 100, it might reflect a library number (!!) */
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	331 PyErr_Clear();
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	332 }
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	333 key = PyLong_FromLong(lib);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	334 if (key == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	335 goto fail;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	336 lib_obj = PyDict_GetItem(lib_codes_to_names, key);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	337 Py_DECREF(key);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	338 if (lib_obj == NULL) {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	339 PyErr_Clear();
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	340 }
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	341 if (errstr == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	342 errstr = ERR_reason_error_string(errcode);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	343 }
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	344 if (errstr == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	345 errstr = "unknown error";
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	346
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	347 if (reason_obj && lib_obj)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	348 msg = PyUnicode_FromFormat("[%S: %S] %s (_ssl.c:%d)",
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	349 lib_obj, reason_obj, errstr, lineno);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	350 else if (lib_obj)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	351 msg = PyUnicode_FromFormat("[%S] %s (_ssl.c:%d)",
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	352 lib_obj, errstr, lineno);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	353 else
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	354 msg = PyUnicode_FromFormat("%s (_ssl.c:%d)", errstr, lineno);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	355 if (msg == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	356 goto fail;
86803 1181fcc02fe7 Issue #19437: Fix fill_and_set_sslerror() of _ssl, handle Py_BuildValue() Victor Stinner <victor.stinner@gmail.com> parents: 86752 diff changeset	357
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	358 init_value = Py_BuildValue("iN", ssl_errno, msg);
86803 1181fcc02fe7 Issue #19437: Fix fill_and_set_sslerror() of _ssl, handle Py_BuildValue() Victor Stinner <victor.stinner@gmail.com> parents: 86752 diff changeset	359 if (init_value == NULL)
1181fcc02fe7 Issue #19437: Fix fill_and_set_sslerror() of _ssl, handle Py_BuildValue() Victor Stinner <victor.stinner@gmail.com> parents: 86752 diff changeset	360 goto fail;
1181fcc02fe7 Issue #19437: Fix fill_and_set_sslerror() of _ssl, handle Py_BuildValue() Victor Stinner <victor.stinner@gmail.com> parents: 86752 diff changeset	361
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	362 err_value = PyObject_CallObject(type, init_value);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	363 Py_DECREF(init_value);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	364 if (err_value == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	365 goto fail;
86803 1181fcc02fe7 Issue #19437: Fix fill_and_set_sslerror() of _ssl, handle Py_BuildValue() Victor Stinner <victor.stinner@gmail.com> parents: 86752 diff changeset	366
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	367 if (reason_obj == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	368 reason_obj = Py_None;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	369 if (_PyObject_SetAttrId(err_value, &PyId_reason, reason_obj))
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	370 goto fail;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	371 if (lib_obj == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	372 lib_obj = Py_None;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	373 if (_PyObject_SetAttrId(err_value, &PyId_library, lib_obj))
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	374 goto fail;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	375 PyErr_SetObject(type, err_value);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	376 fail:
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	377 Py_XDECREF(err_value);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	378 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	379
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	380 static PyObject *
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	381 PySSL_SetError(PySSLSocket obj, int ret, char filename, int lineno)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	382 {
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	383 PyObject *type = PySSLErrorObject;
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	384 char *errstr = NULL;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	385 int err;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	386 enum py_ssl_error p = PY_SSL_ERROR_NONE;
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	387 unsigned long e = 0;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	388
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	389 assert(ret <= 0);
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	390 e = ERR_peek_last_error();
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	391
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	392 if (obj->ssl != NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	393 err = SSL_get_error(obj->ssl, ret);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	394
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	395 switch (err) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	396 case SSL_ERROR_ZERO_RETURN:
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	397 errstr = "TLS/SSL connection has been closed (EOF)";
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	398 type = PySSLZeroReturnErrorObject;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	399 p = PY_SSL_ERROR_ZERO_RETURN;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	400 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	401 case SSL_ERROR_WANT_READ:
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	402 errstr = "The operation did not complete (read)";
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	403 type = PySSLWantReadErrorObject;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	404 p = PY_SSL_ERROR_WANT_READ;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	405 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	406 case SSL_ERROR_WANT_WRITE:
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	407 p = PY_SSL_ERROR_WANT_WRITE;
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	408 type = PySSLWantWriteErrorObject;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	409 errstr = "The operation did not complete (write)";
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	410 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	411 case SSL_ERROR_WANT_X509_LOOKUP:
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	412 p = PY_SSL_ERROR_WANT_X509_LOOKUP;
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	413 errstr = "The operation did not complete (X509 lookup)";
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	414 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	415 case SSL_ERROR_WANT_CONNECT:
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	416 p = PY_SSL_ERROR_WANT_CONNECT;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	417 errstr = "The operation did not complete (connect)";
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	418 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	419 case SSL_ERROR_SYSCALL:
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	420 {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	421 if (e == 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	422 PySocketSockObject *s
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	423 = (PySocketSockObject *) PyWeakref_GetObject(obj->Socket);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	424 if (ret == 0 \|\| (((PyObject *)s) == Py_None)) {
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	425 p = PY_SSL_ERROR_EOF;
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	426 type = PySSLEOFErrorObject;
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	427 errstr = "EOF occurred in violation of protocol";
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	428 } else if (ret == -1) {
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	429 /* underlying BIO reported an I/O error */
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	430 Py_INCREF(s);
61646 8b6401ae1262 Merged revisions 81242 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61537 diff changeset	431 ERR_clear_error();
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	432 s->errorhandler();
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	433 Py_DECREF(s);
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	434 return NULL;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	435 } else { /* possible? */
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	436 p = PY_SSL_ERROR_SYSCALL;
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	437 type = PySSLSyscallErrorObject;
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	438 errstr = "Some I/O error occurred";
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	439 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	440 } else {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	441 p = PY_SSL_ERROR_SYSCALL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	442 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	443 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	444 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	445 case SSL_ERROR_SSL:
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	446 {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	447 p = PY_SSL_ERROR_SSL;
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	448 if (e == 0)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	449 /* possible? */
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	450 errstr = "A failure in the SSL library occurred";
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	451 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	452 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	453 default:
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	454 p = PY_SSL_ERROR_INVALID_ERROR_CODE;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	455 errstr = "Invalid error code";
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	456 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	457 }
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	458 fill_and_set_sslerror(type, p, errstr, lineno, e);
61646 8b6401ae1262 Merged revisions 81242 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61537 diff changeset	459 ERR_clear_error();
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	460 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	461 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	462
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	463 static PyObject *
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	464 _setSSLError (char errstr, int errcode, char filename, int lineno) {
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	465
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	466 if (errstr == NULL)
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	467 errcode = ERR_peek_last_error();
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	468 else
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	469 errcode = 0;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	470 fill_and_set_sslerror(PySSLErrorObject, errcode, errstr, lineno, errcode);
61646 8b6401ae1262 Merged revisions 81242 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61537 diff changeset	471 ERR_clear_error();
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	472 return NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	473 }
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	474
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	475 /*
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	476 * SSL objects
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	477 */
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	478
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	479 static PySSLSocket *
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	480 newPySSLSocket(PySSLContext sslctx, PySocketSockObject sock,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	481 enum py_ssl_server_or_client socket_type,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	482 char *server_hostname)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	483 {
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	484 PySSLSocket *self;
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	485 SSL_CTX *ctx = sslctx->ctx;
83918 0bf4a6b56eb5 Fix compilation under MSVC: ssl_set_mode() is a macro, and the MSVC preprocessor doesn't process #ifdef's inside a macro argument list. Antoine Pitrou <solipsis@pitrou.net> parents: 83915 diff changeset	486 long mode;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	487
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	488 self = PyObject_New(PySSLSocket, &PySSLSocket_Type);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	489 if (self == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	490 return NULL;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	491
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	492 self->peer_cert = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	493 self->ssl = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	494 self->Socket = NULL;
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	495 self->ctx = sslctx;
85858 e27c767b8d4f Properly initialize all fields of a SSL object after allocation. Antoine Pitrou <solipsis@pitrou.net> parents: 85535 diff changeset	496 self->shutdown_seen_zero = 0;
85857 ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	497 self->handshake_done = 0;
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	498 Py_INCREF(sslctx);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	499
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	500 /* Make sure the SSL error state is initialized */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	501 (void) ERR_get_state();
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	502 ERR_clear_error();
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	503
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	504 PySSL_BEGIN_ALLOW_THREADS
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	505 self->ssl = SSL_new(ctx);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	506 PySSL_END_ALLOW_THREADS
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	507 SSL_set_app_data(self->ssl,self);
87241 00348c0518f8 Safely downcast SOCKET_T to int in _ssl module Christian Heimes <christian@cheimes.de> parents: 87214 diff changeset	508 SSL_set_fd(self->ssl, Py_SAFE_DOWNCAST(sock->sock_fd, SOCKET_T, int));
83918 0bf4a6b56eb5 Fix compilation under MSVC: ssl_set_mode() is a macro, and the MSVC preprocessor doesn't process #ifdef's inside a macro argument list. Antoine Pitrou <solipsis@pitrou.net> parents: 83915 diff changeset	509 mode = SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER;
60464 837f3bb1575f Merged revisions 79912 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60038 diff changeset	510 #ifdef SSL_MODE_AUTO_RETRY
83918 0bf4a6b56eb5 Fix compilation under MSVC: ssl_set_mode() is a macro, and the MSVC preprocessor doesn't process #ifdef's inside a macro argument list. Antoine Pitrou <solipsis@pitrou.net> parents: 83915 diff changeset	511 mode \|= SSL_MODE_AUTO_RETRY;
60464 837f3bb1575f Merged revisions 79912 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60038 diff changeset	512 #endif
83918 0bf4a6b56eb5 Fix compilation under MSVC: ssl_set_mode() is a macro, and the MSVC preprocessor doesn't process #ifdef's inside a macro argument list. Antoine Pitrou <solipsis@pitrou.net> parents: 83915 diff changeset	513 SSL_set_mode(self->ssl, mode);
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	514
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	515 #if HAVE_SNI
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	516 if (server_hostname != NULL)
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	517 SSL_set_tlsext_host_name(self->ssl, server_hostname);
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	518 #endif
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	519
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	520 /* If the socket is in non-blocking mode or timeout mode, set the BIO
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	521 * to non-blocking mode (blocking is the default)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	522 */
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	523 if (sock->sock_timeout >= 0.0) {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	524 BIO_set_nbio(SSL_get_rbio(self->ssl), 1);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	525 BIO_set_nbio(SSL_get_wbio(self->ssl), 1);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	526 }
27557 5eefec94a784 SF patch 676472 by Geoff Talvola, reviewed by Ben Laurie. Guido van Rossum <guido@python.org> parents: 27430 diff changeset	527
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	528 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	529 if (socket_type == PY_SSL_CLIENT)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	530 SSL_set_connect_state(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	531 else
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	532 SSL_set_accept_state(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	533 PySSL_END_ALLOW_THREADS
24398 c7ed925c75b3 Patch #575827: allow threads inside SSL creation. Martin v. Löwis <martin@v.loewis.de> parents: 24280 diff changeset	534
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	535 self->socket_type = socket_type;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	536 self->Socket = PyWeakref_NewRef((PyObject *) sock, NULL);
86806 8f58e57e0d59 Issue #19437: Fix newPySSLSocket(), handle PyWeakref_NewRef() failure Victor Stinner <victor.stinner@gmail.com> parents: 86803 diff changeset	537 if (self->Socket == NULL) {
8f58e57e0d59 Issue #19437: Fix newPySSLSocket(), handle PyWeakref_NewRef() failure Victor Stinner <victor.stinner@gmail.com> parents: 86803 diff changeset	538 Py_DECREF(self);
8f58e57e0d59 Issue #19437: Fix newPySSLSocket(), handle PyWeakref_NewRef() failure Victor Stinner <victor.stinner@gmail.com> parents: 86803 diff changeset	539 return NULL;
8f58e57e0d59 Issue #19437: Fix newPySSLSocket(), handle PyWeakref_NewRef() failure Victor Stinner <victor.stinner@gmail.com> parents: 86803 diff changeset	540 }
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	541 return self;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	542 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	543
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	544 /* SSL object methods */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	545
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	546 static PyObject PySSL_SSLdo_handshake(PySSLSocket self)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	547 {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	548 int ret;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	549 int err;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	550 int sockstate, nonblocking;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	551 PySocketSockObject *sock
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	552 = (PySocketSockObject *) PyWeakref_GetObject(self->Socket);
60936 5ed34f3f6c35 Merged revisions 80454 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60901 diff changeset	553
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	554 if (((PyObject*)sock) == Py_None) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	555 _setSSLError("Underlying socket connection gone",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	556 PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	557 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	558 }
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	559 Py_INCREF(sock);
60936 5ed34f3f6c35 Merged revisions 80454 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60901 diff changeset	560
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	561 /* just in case the blocking state of the socket has been changed */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	562 nonblocking = (sock->sock_timeout >= 0.0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	563 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	564 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	565
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	566 /* Actually negotiate SSL connection */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	567 /* XXX If SSL_do_handshake() returns 0, it's also a failure. */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	568 do {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	569 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	570 ret = SSL_do_handshake(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	571 err = SSL_get_error(self->ssl, ret);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	572 PySSL_END_ALLOW_THREADS
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	573 if (PyErr_CheckSignals())
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	574 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	575 if (err == SSL_ERROR_WANT_READ) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	576 sockstate = check_socket_and_wait_for_timeout(sock, 0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	577 } else if (err == SSL_ERROR_WANT_WRITE) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	578 sockstate = check_socket_and_wait_for_timeout(sock, 1);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	579 } else {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	580 sockstate = SOCKET_OPERATION_OK;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	581 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	582 if (sockstate == SOCKET_HAS_TIMED_OUT) {
66663 3d9a86b8cc98 Issue #10272: The ssl module now raises socket.timeout instead of a generic Antoine Pitrou <solipsis@pitrou.net> parents: 66217 diff changeset	583 PyErr_SetString(PySocketModule.timeout_error,
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	584 ERRSTR("The handshake operation timed out"));
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	585 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	586 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	587 PyErr_SetString(PySSLErrorObject,
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	588 ERRSTR("Underlying socket has been closed."));
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	589 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	590 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	591 PyErr_SetString(PySSLErrorObject,
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	592 ERRSTR("Underlying socket too large for select()."));
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	593 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	594 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	595 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	596 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	597 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	598 Py_DECREF(sock);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	599 if (ret < 1)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	600 return PySSL_SetError(self, ret, __FILE__, __LINE__);
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	601
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	602 if (self->peer_cert)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	603 X509_free (self->peer_cert);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	604 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	605 self->peer_cert = SSL_get_peer_certificate(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	606 PySSL_END_ALLOW_THREADS
85857 ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	607 self->handshake_done = 1;
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	608
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	609 Py_INCREF(Py_None);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	610 return Py_None;
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	611
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	612 error:
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	613 Py_DECREF(sock);
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	614 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	615 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	616
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	617 static PyObject *
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	618 _create_tuple_for_attribute (ASN1_OBJECT name, ASN1_STRING value) {
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	619
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	620 char namebuf[X509_NAME_MAXLEN];
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	621 int buflen;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	622 PyObject *name_obj;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	623 PyObject *value_obj;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	624 PyObject *attr;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	625 unsigned char *valuebuf = NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	626
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	627 buflen = OBJ_obj2txt(namebuf, sizeof(namebuf), name, 0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	628 if (buflen < 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	629 _setSSLError(NULL, 0, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	630 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	631 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	632 name_obj = PyUnicode_FromStringAndSize(namebuf, buflen);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	633 if (name_obj == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	634 goto fail;
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	635
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	636 buflen = ASN1_STRING_to_UTF8(&valuebuf, value);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	637 if (buflen < 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	638 _setSSLError(NULL, 0, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	639 Py_DECREF(name_obj);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	640 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	641 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	642 value_obj = PyUnicode_DecodeUTF8((char *) valuebuf,
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	643 buflen, "strict");
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	644 OPENSSL_free(valuebuf);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	645 if (value_obj == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	646 Py_DECREF(name_obj);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	647 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	648 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	649 attr = PyTuple_New(2);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	650 if (attr == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	651 Py_DECREF(name_obj);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	652 Py_DECREF(value_obj);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	653 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	654 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	655 PyTuple_SET_ITEM(attr, 0, name_obj);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	656 PyTuple_SET_ITEM(attr, 1, value_obj);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	657 return attr;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	658
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	659 fail:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	660 return NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	661 }
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	662
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	663 static PyObject *
43292 876b7ef4775d Merged revisions 57778-58052 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42954 diff changeset	664 _create_tuple_for_X509_NAME (X509_NAME *xname)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	665 {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	666 PyObject dn = NULL; / tuple which represents the "distinguished name" */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	667 PyObject rdn = NULL; / tuple to hold a "relative distinguished name" */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	668 PyObject *rdnt;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	669 PyObject attr = NULL; / tuple to hold an attribute */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	670 int entry_count = X509_NAME_entry_count(xname);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	671 X509_NAME_ENTRY *entry;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	672 ASN1_OBJECT *name;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	673 ASN1_STRING *value;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	674 int index_counter;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	675 int rdn_level = -1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	676 int retcode;
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	677
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	678 dn = PyList_New(0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	679 if (dn == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	680 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	681 /* now create another tuple to hold the top-level RDN */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	682 rdn = PyList_New(0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	683 if (rdn == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	684 goto fail0;
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	685
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	686 for (index_counter = 0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	687 index_counter < entry_count;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	688 index_counter++)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	689 {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	690 entry = X509_NAME_get_entry(xname, index_counter);
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	691
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	692 /* check to see if we've gotten to a new RDN */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	693 if (rdn_level >= 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	694 if (rdn_level != entry->set) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	695 /* yes, new RDN */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	696 /* add old RDN to DN */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	697 rdnt = PyList_AsTuple(rdn);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	698 Py_DECREF(rdn);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	699 if (rdnt == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	700 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	701 retcode = PyList_Append(dn, rdnt);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	702 Py_DECREF(rdnt);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	703 if (retcode < 0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	704 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	705 /* create new RDN */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	706 rdn = PyList_New(0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	707 if (rdn == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	708 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	709 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	710 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	711 rdn_level = entry->set;
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	712
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	713 /* now add this attribute to the current RDN */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	714 name = X509_NAME_ENTRY_get_object(entry);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	715 value = X509_NAME_ENTRY_get_data(entry);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	716 attr = _create_tuple_for_attribute(name, value);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	717 /*
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	718 fprintf(stderr, "RDN level %d, attribute %s: %s\n",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	719 entry->set,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	720 PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 0)),
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	721 PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 1)));
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	722 */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	723 if (attr == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	724 goto fail1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	725 retcode = PyList_Append(rdn, attr);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	726 Py_DECREF(attr);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	727 if (retcode < 0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	728 goto fail1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	729 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	730 /* now, there's typically a dangling RDN */
74963 f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	731 if (rdn != NULL) {
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	732 if (PyList_GET_SIZE(rdn) > 0) {
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	733 rdnt = PyList_AsTuple(rdn);
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	734 Py_DECREF(rdn);
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	735 if (rdnt == NULL)
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	736 goto fail0;
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	737 retcode = PyList_Append(dn, rdnt);
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	738 Py_DECREF(rdnt);
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	739 if (retcode < 0)
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	740 goto fail0;
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	741 }
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	742 else {
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	743 Py_DECREF(rdn);
f3a4c2b34973 Issue #13014: Fix a possible reference leak in SSLSocket.getpeercert(). Antoine Pitrou <solipsis@pitrou.net> parents: 74648 diff changeset	744 }
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	745 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	746
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	747 /* convert list to tuple */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	748 rdnt = PyList_AsTuple(dn);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	749 Py_DECREF(dn);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	750 if (rdnt == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	751 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	752 return rdnt;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	753
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	754 fail1:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	755 Py_XDECREF(rdn);
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	756
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	757 fail0:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	758 Py_XDECREF(dn);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	759 return NULL;
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	760 }
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	761
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	762 static PyObject *
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	763 _get_peer_alt_names (X509 *certificate) {
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	764
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	765 /* this code follows the procedure outlined in
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	766 OpenSSL's crypto/x509v3/v3_prn.c:X509v3_EXT_print()
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	767 function to extract the STACK_OF(GENERAL_NAME),
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	768 then iterates through the stack to add the
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	769 names. */
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	770
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	771 int i, j;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	772 PyObject *peer_alt_names = Py_None;
85535 90040e560527 Issue #18709: GCC 4.6 complains that 'v' may be used uninitialized in GEN_EMAIL/GEN_URI/GEN_DNS case Christian Heimes <christian@cheimes.de> parents: 85378 diff changeset	773 PyObject v = NULL, t;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	774 X509_EXTENSION *ext = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	775 GENERAL_NAMES *names = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	776 GENERAL_NAME *name;
65272 4755744724f2 Merged revisions 85432 via svnmerge from Benjamin Peterson <benjamin@python.org> parents: 64404 diff changeset	777 const X509V3_EXT_METHOD *method;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	778 BIO *biobuf = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	779 char buf[2048];
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	780 char *vptr;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	781 int len;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	782 /* Issue #2973: ASN1_item_d2i() API changed in OpenSSL 0.9.6m */
59279 951c97e2878d Merged revisions 78598 via svnmerge from Victor Stinner <victor.stinner@haypocalc.com> parents: 54917 diff changeset	783 #if OPENSSL_VERSION_NUMBER >= 0x009060dfL
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	784 const unsigned char *p;
59279 951c97e2878d Merged revisions 78598 via svnmerge from Victor Stinner <victor.stinner@haypocalc.com> parents: 54917 diff changeset	785 #else
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	786 unsigned char *p;
59279 951c97e2878d Merged revisions 78598 via svnmerge from Victor Stinner <victor.stinner@haypocalc.com> parents: 54917 diff changeset	787 #endif
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	788
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	789 if (certificate == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	790 return peer_alt_names;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	791
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	792 /* get a memory buffer */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	793 biobuf = BIO_new(BIO_s_mem());
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	794
72567 65e7f40fefd4 Issue #13034: When decoding some SSL certificates, the subjectAltName extension could be unreported. Antoine Pitrou <solipsis@pitrou.net> parents: 72115 diff changeset	795 i = -1;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	796 while ((i = X509_get_ext_by_NID(
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	797 certificate, NID_subject_alt_name, i)) >= 0) {
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	798
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	799 if (peer_alt_names == Py_None) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	800 peer_alt_names = PyList_New(0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	801 if (peer_alt_names == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	802 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	803 }
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	804
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	805 /* now decode the altName */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	806 ext = X509_get_ext(certificate, i);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	807 if(!(method = X509V3_EXT_get(ext))) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	808 PyErr_SetString
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	809 (PySSLErrorObject,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	810 ERRSTR("No method for internalizing subjectAltName!"));
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	811 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	812 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	813
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	814 p = ext->value->data;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	815 if (method->it)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	816 names = (GENERAL_NAMES*)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	817 (ASN1_item_d2i(NULL,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	818 &p,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	819 ext->value->length,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	820 ASN1_ITEM_ptr(method->it)));
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	821 else
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	822 names = (GENERAL_NAMES*)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	823 (method->d2i(NULL,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	824 &p,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	825 ext->value->length));
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	826
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	827 for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	828 /* get a rendering of each name in the set of names */
85211 c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	829 int gntype;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	830 ASN1_STRING *as = NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	831
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	832 name = sk_GENERAL_NAME_value(names, j);
85233 b352a5cb60b6 Issue #18768: coding style nitpick. Thanks to Vajrasky Kok Christian Heimes <christian@cheimes.de> parents: 85231 diff changeset	833 gntype = name->type;
85211 c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	834 switch (gntype) {
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	835 case GEN_DIRNAME:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	836 /* we special-case DirName as a tuple of
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	837 tuples of attributes */
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	838
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	839 t = PyTuple_New(2);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	840 if (t == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	841 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	842 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	843
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	844 v = PyUnicode_FromString("DirName");
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	845 if (v == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	846 Py_DECREF(t);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	847 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	848 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	849 PyTuple_SET_ITEM(t, 0, v);
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	850
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	851 v = _create_tuple_for_X509_NAME (name->d.dirn);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	852 if (v == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	853 Py_DECREF(t);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	854 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	855 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	856 PyTuple_SET_ITEM(t, 1, v);
85211 c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	857 break;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	858
85211 c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	859 case GEN_EMAIL:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	860 case GEN_DNS:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	861 case GEN_URI:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	862 /* GENERAL_NAME_print() doesn't handle NULL bytes in ASN1_string
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	863 correctly, CVE-2013-4238 */
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	864 t = PyTuple_New(2);
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	865 if (t == NULL)
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	866 goto fail;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	867 switch (gntype) {
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	868 case GEN_EMAIL:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	869 v = PyUnicode_FromString("email");
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	870 as = name->d.rfc822Name;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	871 break;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	872 case GEN_DNS:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	873 v = PyUnicode_FromString("DNS");
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	874 as = name->d.dNSName;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	875 break;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	876 case GEN_URI:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	877 v = PyUnicode_FromString("URI");
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	878 as = name->d.uniformResourceIdentifier;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	879 break;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	880 }
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	881 if (v == NULL) {
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	882 Py_DECREF(t);
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	883 goto fail;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	884 }
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	885 PyTuple_SET_ITEM(t, 0, v);
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	886 v = PyUnicode_FromStringAndSize((char *)ASN1_STRING_data(as),
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	887 ASN1_STRING_length(as));
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	888 if (v == NULL) {
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	889 Py_DECREF(t);
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	890 goto fail;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	891 }
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	892 PyTuple_SET_ITEM(t, 1, v);
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	893 break;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	894
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	895 default:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	896 /* for everything else, we use the OpenSSL print form */
85211 c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	897 switch (gntype) {
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	898 /* check for new general name type */
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	899 case GEN_OTHERNAME:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	900 case GEN_X400:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	901 case GEN_EDIPARTY:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	902 case GEN_IPADD:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	903 case GEN_RID:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	904 break;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	905 default:
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	906 if (PyErr_WarnFormat(PyExc_RuntimeWarning, 1,
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	907 "Unknown general name type %d",
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	908 gntype) == -1) {
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	909 goto fail;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	910 }
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	911 break;
c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	912 }
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	913 (void) BIO_reset(biobuf);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	914 GENERAL_NAME_print(biobuf, name);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	915 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	916 if (len < 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	917 _setSSLError(NULL, 0, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	918 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	919 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	920 vptr = strchr(buf, ':');
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	921 if (vptr == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	922 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	923 t = PyTuple_New(2);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	924 if (t == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	925 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	926 v = PyUnicode_FromStringAndSize(buf, (vptr - buf));
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	927 if (v == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	928 Py_DECREF(t);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	929 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	930 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	931 PyTuple_SET_ITEM(t, 0, v);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	932 v = PyUnicode_FromStringAndSize((vptr + 1),
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	933 (len - (vptr - buf + 1)));
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	934 if (v == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	935 Py_DECREF(t);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	936 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	937 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	938 PyTuple_SET_ITEM(t, 1, v);
85211 c9f073e593b0 Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes Christian Heimes <christian@cheimes.de> parents: 84838 diff changeset	939 break;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	940 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	941
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	942 /* and add that rendering to the list */
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	943
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	944 if (PyList_Append(peer_alt_names, t) < 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	945 Py_DECREF(t);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	946 goto fail;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	947 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	948 Py_DECREF(t);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	949 }
73711 80d491aaeed2 Issue #13458: Fix a memory leak in the ssl module when decoding a certificate with a subjectAltName. Antoine Pitrou <solipsis@pitrou.net> parents: 72567 diff changeset	950 sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	951 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	952 BIO_free(biobuf);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	953 if (peer_alt_names != Py_None) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	954 v = PyList_AsTuple(peer_alt_names);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	955 Py_DECREF(peer_alt_names);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	956 return v;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	957 } else {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	958 return peer_alt_names;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	959 }
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	960
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	961
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	962 fail:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	963 if (biobuf != NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	964 BIO_free(biobuf);
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	965
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	966 if (peer_alt_names != Py_None) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	967 Py_XDECREF(peer_alt_names);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	968 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	969
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	970 return NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	971 }
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	972
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	973 static PyObject *
87303 468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	974 _get_aia_uri(X509 *certificate, int nid) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	975 PyObject lst = NULL, ostr = NULL;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	976 int i, result;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	977 AUTHORITY_INFO_ACCESS *info;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	978
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	979 info = X509_get_ext_d2i(certificate, NID_info_access, NULL, NULL);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	980 if ((info == NULL) \|\| (sk_ACCESS_DESCRIPTION_num(info) == 0)) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	981 return Py_None;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	982 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	983
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	984 if ((lst = PyList_New(0)) == NULL) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	985 goto fail;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	986 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	987
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	988 for (i = 0; i < sk_ACCESS_DESCRIPTION_num(info); i++) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	989 ACCESS_DESCRIPTION *ad = sk_ACCESS_DESCRIPTION_value(info, i);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	990 ASN1_IA5STRING *uri;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	991
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	992 if ((OBJ_obj2nid(ad->method) != nid) \|\|
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	993 (ad->location->type != GEN_URI)) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	994 continue;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	995 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	996 uri = ad->location->d.uniformResourceIdentifier;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	997 ostr = PyUnicode_FromStringAndSize((char *)uri->data,
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	998 uri->length);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	999 if (ostr == NULL) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1000 goto fail;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1001 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1002 result = PyList_Append(lst, ostr);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1003 Py_DECREF(ostr);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1004 if (result < 0) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1005 goto fail;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1006 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1007 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1008 AUTHORITY_INFO_ACCESS_free(info);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1009
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1010 /* convert to tuple or None */
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1011 if (PyList_Size(lst) == 0) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1012 Py_DECREF(lst);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1013 return Py_None;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1014 } else {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1015 PyObject *tup;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1016 tup = PyList_AsTuple(lst);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1017 Py_DECREF(lst);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1018 return tup;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1019 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1020
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1021 fail:
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1022 AUTHORITY_INFO_ACCESS_free(info);
87321 4d63ee2ff753 lst might be NULL here Christian Heimes <christian@cheimes.de> parents: 87320 diff changeset	1023 Py_XDECREF(lst);
87303 468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1024 return NULL;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1025 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1026
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1027 static PyObject *
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1028 _get_crl_dp(X509 *certificate) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1029 STACK_OF(DIST_POINT) *dps;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1030 int i, j, result;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1031 PyObject *lst;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1032
87311 40bfddda43d4 Issue #19682: Fix compatibility issue with old version of OpenSSL that Christian Heimes <christian@cheimes.de> parents: 87303 diff changeset	1033 #if OPENSSL_VERSION_NUMBER < 0x10001000L
40bfddda43d4 Issue #19682: Fix compatibility issue with old version of OpenSSL that Christian Heimes <christian@cheimes.de> parents: 87303 diff changeset	1034 dps = X509_get_ext_d2i(certificate, NID_crl_distribution_points,
40bfddda43d4 Issue #19682: Fix compatibility issue with old version of OpenSSL that Christian Heimes <christian@cheimes.de> parents: 87303 diff changeset	1035 NULL, NULL);
40bfddda43d4 Issue #19682: Fix compatibility issue with old version of OpenSSL that Christian Heimes <christian@cheimes.de> parents: 87303 diff changeset	1036 #else
87303 468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1037 /* Calls x509v3_cache_extensions and sets up crldp */
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1038 X509_check_ca(certificate);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1039 dps = certificate->crldp;
87311 40bfddda43d4 Issue #19682: Fix compatibility issue with old version of OpenSSL that Christian Heimes <christian@cheimes.de> parents: 87303 diff changeset	1040 #endif
40bfddda43d4 Issue #19682: Fix compatibility issue with old version of OpenSSL that Christian Heimes <christian@cheimes.de> parents: 87303 diff changeset	1041
87303 468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1042 if (dps == NULL) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1043 return Py_None;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1044 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1045
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1046 if ((lst = PyList_New(0)) == NULL) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1047 return NULL;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1048 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1049
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1050 for (i=0; i < sk_DIST_POINT_num(dps); i++) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1051 DIST_POINT *dp;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1052 STACK_OF(GENERAL_NAME) *gns;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1053
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1054 dp = sk_DIST_POINT_value(dps, i);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1055 gns = dp->distpoint->name.fullname;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1056
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1057 for (j=0; j < sk_GENERAL_NAME_num(gns); j++) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1058 GENERAL_NAME *gn;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1059 ASN1_IA5STRING *uri;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1060 PyObject *ouri;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1061
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1062 gn = sk_GENERAL_NAME_value(gns, j);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1063 if (gn->type != GEN_URI) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1064 continue;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1065 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1066 uri = gn->d.uniformResourceIdentifier;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1067 ouri = PyUnicode_FromStringAndSize((char *)uri->data,
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1068 uri->length);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1069 if (ouri == NULL) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1070 Py_DECREF(lst);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1071 return NULL;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1072 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1073 result = PyList_Append(lst, ouri);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1074 Py_DECREF(ouri);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1075 if (result < 0) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1076 Py_DECREF(lst);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1077 return NULL;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1078 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1079 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1080 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1081 /* convert to tuple or None */
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1082 if (PyList_Size(lst) == 0) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1083 Py_DECREF(lst);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1084 return Py_None;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1085 } else {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1086 PyObject *tup;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1087 tup = PyList_AsTuple(lst);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1088 Py_DECREF(lst);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1089 return tup;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1090 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1091 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1092
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1093 static PyObject *
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1094 _decode_certificate(X509 *certificate) {
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1095
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1096 PyObject *retval = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1097 BIO *biobuf = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1098 PyObject *peer;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1099 PyObject *peer_alt_names = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1100 PyObject *issuer;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1101 PyObject *version;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1102 PyObject *sn_obj;
87303 468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1103 PyObject *obj;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1104 ASN1_INTEGER *serialNumber;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1105 char buf[2048];
87303 468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1106 int len, result;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1107 ASN1_TIME notBefore, notAfter;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1108 PyObject pnotBefore, pnotAfter;
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1109
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1110 retval = PyDict_New();
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1111 if (retval == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1112 return NULL;
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1113
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1114 peer = _create_tuple_for_X509_NAME(
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1115 X509_get_subject_name(certificate));
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1116 if (peer == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1117 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1118 if (PyDict_SetItemString(retval, (const char *) "subject", peer) < 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1119 Py_DECREF(peer);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1120 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1121 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1122 Py_DECREF(peer);
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1123
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1124 issuer = _create_tuple_for_X509_NAME(
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1125 X509_get_issuer_name(certificate));
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1126 if (issuer == NULL)
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1127 goto fail0;
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1128 if (PyDict_SetItemString(retval, (const char *)"issuer", issuer) < 0) {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1129 Py_DECREF(issuer);
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1130 goto fail0;
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1131 }
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1132 Py_DECREF(issuer);
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	1133
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1134 version = PyLong_FromLong(X509_get_version(certificate) + 1);
84838 7d6781ec35ea Check return value of PyLong_FromLong(X509_get_version()). It might be NULL if Christian Heimes <christian@cheimes.de> parents: 84332 diff changeset	1135 if (version == NULL)
7d6781ec35ea Check return value of PyLong_FromLong(X509_get_version()). It might be NULL if Christian Heimes <christian@cheimes.de> parents: 84332 diff changeset	1136 goto fail0;
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1137 if (PyDict_SetItemString(retval, "version", version) < 0) {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1138 Py_DECREF(version);
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1139 goto fail0;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1140 }
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1141 Py_DECREF(version);
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	1142
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1143 /* get a memory buffer */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1144 biobuf = BIO_new(BIO_s_mem());
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	1145
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1146 (void) BIO_reset(biobuf);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1147 serialNumber = X509_get_serialNumber(certificate);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1148 /* should not exceed 20 octets, 160 bits, so buf is big enough */
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1149 i2a_ASN1_INTEGER(biobuf, serialNumber);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1150 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1151 if (len < 0) {
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1152 _setSSLError(NULL, 0, __FILE__, __LINE__);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1153 goto fail1;
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1154 }
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1155 sn_obj = PyUnicode_FromStringAndSize(buf, len);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1156 if (sn_obj == NULL)
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1157 goto fail1;
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1158 if (PyDict_SetItemString(retval, "serialNumber", sn_obj) < 0) {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1159 Py_DECREF(sn_obj);
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1160 goto fail1;
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1161 }
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1162 Py_DECREF(sn_obj);
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1163
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1164 (void) BIO_reset(biobuf);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1165 notBefore = X509_get_notBefore(certificate);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1166 ASN1_TIME_print(biobuf, notBefore);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1167 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1168 if (len < 0) {
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1169 _setSSLError(NULL, 0, __FILE__, __LINE__);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1170 goto fail1;
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1171 }
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1172 pnotBefore = PyUnicode_FromStringAndSize(buf, len);
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1173 if (pnotBefore == NULL)
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1174 goto fail1;
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1175 if (PyDict_SetItemString(retval, "notBefore", pnotBefore) < 0) {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1176 Py_DECREF(pnotBefore);
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1177 goto fail1;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1178 }
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1179 Py_DECREF(pnotBefore);
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1180
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1181 (void) BIO_reset(biobuf);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1182 notAfter = X509_get_notAfter(certificate);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1183 ASN1_TIME_print(biobuf, notAfter);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1184 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1185 if (len < 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1186 _setSSLError(NULL, 0, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1187 goto fail1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1188 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1189 pnotAfter = PyUnicode_FromStringAndSize(buf, len);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1190 if (pnotAfter == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1191 goto fail1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1192 if (PyDict_SetItemString(retval, "notAfter", pnotAfter) < 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1193 Py_DECREF(pnotAfter);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1194 goto fail1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1195 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1196 Py_DECREF(pnotAfter);
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1197
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1198 /* Now look for subjectAltName */
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1199
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1200 peer_alt_names = _get_peer_alt_names(certificate);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1201 if (peer_alt_names == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1202 goto fail1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1203 else if (peer_alt_names != Py_None) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1204 if (PyDict_SetItemString(retval, "subjectAltName",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1205 peer_alt_names) < 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1206 Py_DECREF(peer_alt_names);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1207 goto fail1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1208 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1209 Py_DECREF(peer_alt_names);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1210 }
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	1211
87303 468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1212 /* Authority Information Access: OCSP URIs */
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1213 obj = _get_aia_uri(certificate, NID_ad_OCSP);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1214 if (obj == NULL) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1215 goto fail1;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1216 } else if (obj != Py_None) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1217 result = PyDict_SetItemString(retval, "OCSP", obj);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1218 Py_DECREF(obj);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1219 if (result < 0) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1220 goto fail1;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1221 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1222 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1223
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1224 obj = _get_aia_uri(certificate, NID_ad_ca_issuers);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1225 if (obj == NULL) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1226 goto fail1;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1227 } else if (obj != Py_None) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1228 result = PyDict_SetItemString(retval, "caIssuers", obj);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1229 Py_DECREF(obj);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1230 if (result < 0) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1231 goto fail1;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1232 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1233 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1234
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1235 /* CDP (CRL distribution points) */
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1236 obj = _get_crl_dp(certificate);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1237 if (obj == NULL) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1238 goto fail1;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1239 } else if (obj != Py_None) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1240 result = PyDict_SetItemString(retval, "crlDistributionPoints", obj);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1241 Py_DECREF(obj);
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1242 if (result < 0) {
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1243 goto fail1;
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1244 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1245 }
468d18bffdea Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP Christian Heimes <christian@cheimes.de> parents: 87302 diff changeset	1246
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1247 BIO_free(biobuf);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1248 return retval;
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1249
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1250 fail1:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1251 if (biobuf != NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1252 BIO_free(biobuf);
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1253 fail0:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1254 Py_XDECREF(retval);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1255 return NULL;
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1256 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1257
84185 38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1258 static PyObject *
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1259 _certificate_to_der(X509 *certificate)
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1260 {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1261 unsigned char *bytes_buf = NULL;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1262 int len;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1263 PyObject *retval;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1264
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1265 bytes_buf = NULL;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1266 len = i2d_X509(certificate, &bytes_buf);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1267 if (len < 0) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1268 _setSSLError(NULL, 0, __FILE__, __LINE__);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1269 return NULL;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1270 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1271 /* this is actually an immutable bytes sequence */
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1272 retval = PyBytes_FromStringAndSize((const char *) bytes_buf, len);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1273 OPENSSL_free(bytes_buf);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1274 return retval;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1275 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1276
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1277 static PyObject *
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1278 PySSL_test_decode_certificate (PyObject mod, PyObject args) {
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1279
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1280 PyObject *retval = NULL;
61639 08abbdc99be6 Issue #8477: _ssl._test_decode_cert() supports str with surrogates and bytes Victor Stinner <victor.stinner@haypocalc.com> parents: 61637 diff changeset	1281 PyObject *filename;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1282 X509 *x=NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1283 BIO *cert;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1284
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1285 if (!PyArg_ParseTuple(args, "O&:test_decode_certificate",
eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1286 PyUnicode_FSConverter, &filename))
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1287 return NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1288
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1289 if ((cert=BIO_new(BIO_s_file())) == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1290 PyErr_SetString(PySSLErrorObject,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1291 "Can't malloc memory to read file");
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1292 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1293 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1294
61639 08abbdc99be6 Issue #8477: _ssl._test_decode_cert() supports str with surrogates and bytes Victor Stinner <victor.stinner@haypocalc.com> parents: 61637 diff changeset	1295 if (BIO_read_filename(cert, PyBytes_AsString(filename)) <= 0) {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1296 PyErr_SetString(PySSLErrorObject,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1297 "Can't open file");
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1298 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1299 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1300
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1301 x = PEM_read_bio_X509_AUX(cert,NULL, NULL, NULL);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1302 if (x == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1303 PyErr_SetString(PySSLErrorObject,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1304 "Error decoding PEM-encoded file");
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1305 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1306 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1307
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1308 retval = _decode_certificate(x);
63694 c4bbda2d4c49 Merged revisions 83677 via svnmerge from Mark Dickinson <dickinsm@gmail.com> parents: 62489 diff changeset	1309 X509_free(x);
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1310
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1311 fail0:
61639 08abbdc99be6 Issue #8477: _ssl._test_decode_cert() supports str with surrogates and bytes Victor Stinner <victor.stinner@haypocalc.com> parents: 61637 diff changeset	1312 Py_DECREF(filename);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1313 if (cert != NULL) BIO_free(cert);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1314 return retval;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1315 }
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1316
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1317
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1318 static PyObject *
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1319 PySSL_peercert(PySSLSocket self, PyObject args)
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1320 {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1321 int verification;
78605 b878df1d23b1 Issue #15604: Update uses of PyObject_IsTrue() to check for and handle errors correctly. Antoine Pitrou <solipsis@pitrou.net> parents: 77578 78604 diff changeset	1322 int binary_mode = 0;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1323
78605 b878df1d23b1 Issue #15604: Update uses of PyObject_IsTrue() to check for and handle errors correctly. Antoine Pitrou <solipsis@pitrou.net> parents: 77578 78604 diff changeset	1324 if (!PyArg_ParseTuple(args, "\|p:peer_certificate", &binary_mode))
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1325 return NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1326
85857 ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	1327 if (!self->handshake_done) {
ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	1328 PyErr_SetString(PyExc_ValueError,
ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	1329 "handshake not done yet");
ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	1330 return NULL;
ddcdf7f7eac8 Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done. Antoine Pitrou <solipsis@pitrou.net> parents: 85536 diff changeset	1331 }
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1332 if (!self->peer_cert)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1333 Py_RETURN_NONE;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1334
78605 b878df1d23b1 Issue #15604: Update uses of PyObject_IsTrue() to check for and handle errors correctly. Antoine Pitrou <solipsis@pitrou.net> parents: 77578 78604 diff changeset	1335 if (binary_mode) {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1336 /* return cert in DER-encoded format */
84185 38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	1337 return _certificate_to_der(self->peer_cert);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1338 } else {
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1339 verification = SSL_CTX_get_verify_mode(SSL_get_SSL_CTX(self->ssl));
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1340 if ((verification & SSL_VERIFY_PEER) == 0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1341 return PyDict_New();
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1342 else
66114 eeebb622fd08 Issue #10022: The dictionary returned by the `getpeercert()` method Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	1343 return _decode_certificate(self->peer_cert);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1344 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1345 }
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1346
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1347 PyDoc_STRVAR(PySSL_peercert_doc,
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1348 "peer_certificate([der=False]) -> certificate\n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1349 \n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1350 Returns the certificate for the peer. If no certificate was provided,\n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1351 returns None. If a certificate was provided, but not validated, returns\n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1352 an empty dictionary. Otherwise returns a dict containing information\n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1353 about the peer certificate.\n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1354 \n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1355 If the optional argument is True, returns a DER-encoded copy of the\n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1356 peer certificate, or None if no certificate was provided. This will\n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1357 return the certificate even if it wasn't validated.");
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1358
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1359 static PyObject PySSL_cipher (PySSLSocket self) {
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1360
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1361 PyObject retval, v;
65272 4755744724f2 Merged revisions 85432 via svnmerge from Benjamin Peterson <benjamin@python.org> parents: 64404 diff changeset	1362 const SSL_CIPHER *current;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1363 char *cipher_name;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1364 char *cipher_protocol;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1365
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1366 if (self->ssl == NULL)
66806 800563ac057e Merged revisions 87140 via svnmerge from Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> parents: 65272 diff changeset	1367 Py_RETURN_NONE;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1368 current = SSL_get_current_cipher(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1369 if (current == NULL)
66806 800563ac057e Merged revisions 87140 via svnmerge from Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> parents: 65272 diff changeset	1370 Py_RETURN_NONE;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1371
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1372 retval = PyTuple_New(3);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1373 if (retval == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1374 return NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1375
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1376 cipher_name = (char *) SSL_CIPHER_get_name(current);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1377 if (cipher_name == NULL) {
66806 800563ac057e Merged revisions 87140 via svnmerge from Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> parents: 65272 diff changeset	1378 Py_INCREF(Py_None);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1379 PyTuple_SET_ITEM(retval, 0, Py_None);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1380 } else {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1381 v = PyUnicode_FromString(cipher_name);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1382 if (v == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1383 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1384 PyTuple_SET_ITEM(retval, 0, v);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1385 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1386 cipher_protocol = SSL_CIPHER_get_version(current);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1387 if (cipher_protocol == NULL) {
66806 800563ac057e Merged revisions 87140 via svnmerge from Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> parents: 65272 diff changeset	1388 Py_INCREF(Py_None);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1389 PyTuple_SET_ITEM(retval, 1, Py_None);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1390 } else {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1391 v = PyUnicode_FromString(cipher_protocol);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1392 if (v == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1393 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1394 PyTuple_SET_ITEM(retval, 1, v);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1395 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1396 v = PyLong_FromLong(SSL_CIPHER_get_bits(current, NULL));
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1397 if (v == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1398 goto fail0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1399 PyTuple_SET_ITEM(retval, 2, v);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1400 return retval;
43948 8e0c4c710375 Make read() and certificate() return bytes instead of bytearray instances. Guido van Rossum <guido@python.org> parents: 43869 diff changeset	1401
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1402 fail0:
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1403 Py_DECREF(retval);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1404 return NULL;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1405 }
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	1406
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1407 #ifdef OPENSSL_NPN_NEGOTIATED
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1408 static PyObject PySSL_selected_npn_protocol(PySSLSocket self) {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1409 const unsigned char *out;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1410 unsigned int outlen;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1411
84269 1bd49f8a30da _ssl.c: strip trailing spaces Victor Stinner <victor.stinner@gmail.com> parents: 81463 diff changeset	1412 SSL_get0_next_proto_negotiated(self->ssl,
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1413 &out, &outlen);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1414
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1415 if (out == NULL)
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1416 Py_RETURN_NONE;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1417 return PyUnicode_FromStringAndSize((char *) out, outlen);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1418 }
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1419 #endif
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1420
74091 20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1421 static PyObject PySSL_compression(PySSLSocket self) {
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1422 #ifdef OPENSSL_NO_COMP
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1423 Py_RETURN_NONE;
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1424 #else
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1425 const COMP_METHOD *comp_method;
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1426 const char *short_name;
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1427
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1428 if (self->ssl == NULL)
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1429 Py_RETURN_NONE;
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1430 comp_method = SSL_get_current_compression(self->ssl);
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1431 if (comp_method == NULL \|\| comp_method->type == NID_undef)
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1432 Py_RETURN_NONE;
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1433 short_name = OBJ_nid2sn(comp_method->type);
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1434 if (short_name == NULL)
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1435 Py_RETURN_NONE;
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1436 return PyUnicode_DecodeFSDefault(short_name);
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1437 #endif
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1438 }
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1439
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1440 static PySSLContext PySSL_get_context(PySSLSocket self, void *closure) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1441 Py_INCREF(self->ctx);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1442 return self->ctx;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1443 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1444
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1445 static int PySSL_set_context(PySSLSocket self, PyObject value,
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1446 void *closure) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1447
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1448 if (PyObject_TypeCheck(value, &PySSLContext_Type)) {
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	1449 #if !HAVE_SNI
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	1450 PyErr_SetString(PyExc_NotImplementedError, "setting a socket's "
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	1451 "context is not supported by your OpenSSL library");
83023 ad9effdc0ac3 Further compiling fixes (issue #17581) Antoine Pitrou <solipsis@pitrou.net> parents: 83021 diff changeset	1452 return -1;
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	1453 #else
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1454 Py_INCREF(value);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1455 Py_DECREF(self->ctx);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1456 self->ctx = (PySSLContext *) value;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1457 SSL_set_SSL_CTX(self->ssl, self->ctx->ctx);
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	1458 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1459 } else {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1460 PyErr_SetString(PyExc_TypeError, "The value must be a SSLContext");
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1461 return -1;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1462 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1463
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1464 return 0;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1465 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1466
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1467 PyDoc_STRVAR(PySSL_set_context_doc,
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1468 "_setter_context(ctx)\n\
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1469 \
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1470 This changes the context associated with the SSLSocket. This is typically\n\
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1471 used from within a callback function set by the set_servername_callback\n\
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1472 on the SSLContext to change the certificate information associated with the\n\
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1473 SSLSocket before the cryptographic exchange handshake messages\n");
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1474
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1475
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1476
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1477 static void PySSL_dealloc(PySSLSocket *self)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1478 {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1479 if (self->peer_cert) /* Possible not to have one? */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1480 X509_free (self->peer_cert);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1481 if (self->ssl)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1482 SSL_free(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1483 Py_XDECREF(self->Socket);
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1484 Py_XDECREF(self->ctx);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1485 PyObject_Del(self);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1486 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1487
39442 654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	1488 /* If the socket has a timeout, do a select()/poll() on the socket.
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1489 The argument writing indicates the direction.
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1490 Returns one of the possibilities in the timeout_state enum (above).
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1491 */
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1492
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1493 static int
32599 598a5ce63322 [Patch #945642] Fix non-blocking SSL sockets, which blocked on reads/writes in Python 2.3. Andrew M. Kuchling <amk@amk.ca> parents: 31790 diff changeset	1494 check_socket_and_wait_for_timeout(PySocketSockObject *s, int writing)
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1495 {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1496 fd_set fds;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1497 struct timeval tv;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1498 int rc;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1499
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1500 /* Nothing to do unless we're in timeout mode (not non-blocking) */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1501 if (s->sock_timeout < 0.0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1502 return SOCKET_IS_BLOCKING;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1503 else if (s->sock_timeout == 0.0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1504 return SOCKET_IS_NONBLOCKING;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1505
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1506 /* Guard against closed socket */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1507 if (s->sock_fd < 0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1508 return SOCKET_HAS_BEEN_CLOSED;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1509
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1510 /* Prefer poll, if available, since you can poll() any fd
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1511 * which can't be done with select(). */
39442 654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	1512 #ifdef HAVE_POLL
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1513 {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1514 struct pollfd pollfd;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1515 int timeout;
39442 654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	1516
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1517 pollfd.fd = s->sock_fd;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1518 pollfd.events = writing ? POLLOUT : POLLIN;
39442 654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	1519
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1520 /* s->sock_timeout is in seconds, timeout in ms */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1521 timeout = (int)(s->sock_timeout * 1000 + 0.5);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1522 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1523 rc = poll(&pollfd, 1, timeout);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1524 PySSL_END_ALLOW_THREADS
39442 654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	1525
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1526 goto normal_return;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1527 }
39442 654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	1528 #endif
654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	1529
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1530 /* Guard against socket too large for select*/
72115 852ca32eb18d Issue #12287: Fix a stack corruption in ossaudiodev module when the FD is Charles-François Natali <neologix@free.fr> parents: 71255 diff changeset	1531 if (!_PyIsSelectable_fd(s->sock_fd))
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1532 return SOCKET_TOO_LARGE_FOR_SELECT;
36452 7789cc557e1e Bug #876637, prevent stack corruption when socket descriptor Neal Norwitz <nnorwitz@gmail.com> parents: 36451 diff changeset	1533
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1534 /* Construct the arguments to select */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1535 tv.tv_sec = (int)s->sock_timeout;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1536 tv.tv_usec = (int)((s->sock_timeout - tv.tv_sec) * 1e6);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1537 FD_ZERO(&fds);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1538 FD_SET(s->sock_fd, &fds);
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1539
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1540 /* See if the socket is ready */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1541 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1542 if (writing)
87241 00348c0518f8 Safely downcast SOCKET_T to int in _ssl module Christian Heimes <christian@cheimes.de> parents: 87214 diff changeset	1543 rc = select(Py_SAFE_DOWNCAST(s->sock_fd+1, SOCKET_T, int),
00348c0518f8 Safely downcast SOCKET_T to int in _ssl module Christian Heimes <christian@cheimes.de> parents: 87214 diff changeset	1544 NULL, &fds, NULL, &tv);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1545 else
87241 00348c0518f8 Safely downcast SOCKET_T to int in _ssl module Christian Heimes <christian@cheimes.de> parents: 87214 diff changeset	1546 rc = select(Py_SAFE_DOWNCAST(s->sock_fd+1, SOCKET_T, int),
00348c0518f8 Safely downcast SOCKET_T to int in _ssl module Christian Heimes <christian@cheimes.de> parents: 87214 diff changeset	1547 &fds, NULL, NULL, &tv);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1548 PySSL_END_ALLOW_THREADS
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1549
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1550 #ifdef HAVE_POLL
39442 654c380cf8b9 Merged revisions 46753-51188 via svnmerge from Thomas Wouters <thomas@python.org> parents: 38453 diff changeset	1551 normal_return:
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1552 #endif
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1553 /* Return SOCKET_TIMED_OUT on timeout, SOCKET_OPERATION_OK otherwise
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1554 (when we are able to write or when there's something to read) */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1555 return rc == 0 ? SOCKET_HAS_TIMED_OUT : SOCKET_OPERATION_OK;
27430 1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1556 }
1ae0b142370e Support socket timeout in SSL, by Geoff Talvola. Guido van Rossum <guido@python.org> parents: 24471 diff changeset	1557
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1558 static PyObject PySSL_SSLwrite(PySSLSocket self, PyObject *args)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1559 {
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	1560 Py_buffer buf;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1561 int len;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1562 int sockstate;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1563 int err;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1564 int nonblocking;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1565 PySocketSockObject *sock
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1566 = (PySocketSockObject *) PyWeakref_GetObject(self->Socket);
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	1567
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1568 if (((PyObject*)sock) == Py_None) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1569 _setSSLError("Underlying socket connection gone",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1570 PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1571 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1572 }
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1573 Py_INCREF(sock);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1574
62480 21e86dd328f1 Issue #8682: The ssl module now temporary increments the reference count of Antoine Pitrou <solipsis@pitrou.net> parents: 61782 diff changeset	1575 if (!PyArg_ParseTuple(args, "y*:write", &buf)) {
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1576 Py_DECREF(sock);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1577 return NULL;
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1578 }
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1579
84332 bfede07268a1 Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if the input Victor Stinner <victor.stinner@gmail.com> parents: 84270 diff changeset	1580 if (buf.len > INT_MAX) {
bfede07268a1 Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if the input Victor Stinner <victor.stinner@gmail.com> parents: 84270 diff changeset	1581 PyErr_Format(PyExc_OverflowError,
bfede07268a1 Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if the input Victor Stinner <victor.stinner@gmail.com> parents: 84270 diff changeset	1582 "string longer than %d bytes", INT_MAX);
bfede07268a1 Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if the input Victor Stinner <victor.stinner@gmail.com> parents: 84270 diff changeset	1583 goto error;
bfede07268a1 Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if the input Victor Stinner <victor.stinner@gmail.com> parents: 84270 diff changeset	1584 }
bfede07268a1 Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if the input Victor Stinner <victor.stinner@gmail.com> parents: 84270 diff changeset	1585
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1586 /* just in case the blocking state of the socket has been changed */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1587 nonblocking = (sock->sock_timeout >= 0.0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1588 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1589 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1590
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1591 sockstate = check_socket_and_wait_for_timeout(sock, 1);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1592 if (sockstate == SOCKET_HAS_TIMED_OUT) {
66663 3d9a86b8cc98 Issue #10272: The ssl module now raises socket.timeout instead of a generic Antoine Pitrou <solipsis@pitrou.net> parents: 66217 diff changeset	1593 PyErr_SetString(PySocketModule.timeout_error,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1594 "The write operation timed out");
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1595 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1596 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1597 PyErr_SetString(PySSLErrorObject,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1598 "Underlying socket has been closed.");
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1599 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1600 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1601 PyErr_SetString(PySSLErrorObject,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1602 "Underlying socket too large for select().");
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1603 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1604 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1605 do {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1606 PySSL_BEGIN_ALLOW_THREADS
84332 bfede07268a1 Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if the input Victor Stinner <victor.stinner@gmail.com> parents: 84270 diff changeset	1607 len = SSL_write(self->ssl, buf.buf, (int)buf.len);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1608 err = SSL_get_error(self->ssl, len);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1609 PySSL_END_ALLOW_THREADS
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	1610 if (PyErr_CheckSignals()) {
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1611 goto error;
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	1612 }
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1613 if (err == SSL_ERROR_WANT_READ) {
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	1614 sockstate = check_socket_and_wait_for_timeout(sock, 0);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1615 } else if (err == SSL_ERROR_WANT_WRITE) {
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	1616 sockstate = check_socket_and_wait_for_timeout(sock, 1);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1617 } else {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1618 sockstate = SOCKET_OPERATION_OK;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1619 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1620 if (sockstate == SOCKET_HAS_TIMED_OUT) {
66663 3d9a86b8cc98 Issue #10272: The ssl module now raises socket.timeout instead of a generic Antoine Pitrou <solipsis@pitrou.net> parents: 66217 diff changeset	1621 PyErr_SetString(PySocketModule.timeout_error,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1622 "The write operation timed out");
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1623 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1624 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1625 PyErr_SetString(PySSLErrorObject,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1626 "Underlying socket has been closed.");
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1627 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1628 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1629 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1630 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1631 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1632
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1633 Py_DECREF(sock);
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	1634 PyBuffer_Release(&buf);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1635 if (len > 0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1636 return PyLong_FromLong(len);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1637 else
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1638 return PySSL_SetError(self, len, __FILE__, __LINE__);
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1639
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1640 error:
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1641 Py_DECREF(sock);
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	1642 PyBuffer_Release(&buf);
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1643 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1644 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1645
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1646 PyDoc_STRVAR(PySSL_SSLwrite_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1647 "write(s) -> len\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1648 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1649 Writes the string s into the SSL object. Returns the number\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1650 of bytes written.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1651
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1652 static PyObject PySSL_SSLpending(PySSLSocket self)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1653 {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1654 int count = 0;
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1655
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1656 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1657 count = SSL_pending(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1658 PySSL_END_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1659 if (count < 0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1660 return PySSL_SetError(self, count, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1661 else
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1662 return PyLong_FromLong(count);
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1663 }
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1664
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1665 PyDoc_STRVAR(PySSL_SSLpending_doc,
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1666 "pending() -> count\n\
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1667 \n\
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1668 Returns the number of already decrypted bytes available for read,\n\
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1669 pending on the connection.\n");
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1670
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1671 static PyObject PySSL_SSLread(PySSLSocket self, PyObject *args)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1672 {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1673 PyObject *dest = NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1674 Py_buffer buf;
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1675 char *mem;
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1676 int len, count;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1677 int buf_passed = 0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1678 int sockstate;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1679 int err;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1680 int nonblocking;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1681 PySocketSockObject *sock
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1682 = (PySocketSockObject *) PyWeakref_GetObject(self->Socket);
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	1683
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1684 if (((PyObject*)sock) == Py_None) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1685 _setSSLError("Underlying socket connection gone",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1686 PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1687 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1688 }
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1689 Py_INCREF(sock);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1690
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1691 buf.obj = NULL;
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1692 buf.buf = NULL;
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1693 if (!PyArg_ParseTuple(args, "i\|w*:read", &len, &buf))
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1694 goto error;
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1695
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1696 if ((buf.buf == NULL) && (buf.obj == NULL)) {
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1697 dest = PyBytes_FromStringAndSize(NULL, len);
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1698 if (dest == NULL)
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1699 goto error;
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1700 mem = PyBytes_AS_STRING(dest);
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1701 }
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1702 else {
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1703 buf_passed = 1;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1704 mem = buf.buf;
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1705 if (len <= 0 \|\| len > buf.len) {
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1706 len = (int) buf.len;
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1707 if (buf.len != len) {
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1708 PyErr_SetString(PyExc_OverflowError,
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1709 "maximum length can't fit in a C 'int'");
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1710 goto error;
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1711 }
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1712 }
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1713 }
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1714
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1715 /* just in case the blocking state of the socket has been changed */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1716 nonblocking = (sock->sock_timeout >= 0.0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1717 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1718 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: 42847 diff changeset	1719
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1720 /* first check if there are bytes ready to be read */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1721 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1722 count = SSL_pending(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1723 PySSL_END_ALLOW_THREADS
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1724
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1725 if (!count) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1726 sockstate = check_socket_and_wait_for_timeout(sock, 0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1727 if (sockstate == SOCKET_HAS_TIMED_OUT) {
66663 3d9a86b8cc98 Issue #10272: The ssl module now raises socket.timeout instead of a generic Antoine Pitrou <solipsis@pitrou.net> parents: 66217 diff changeset	1728 PyErr_SetString(PySocketModule.timeout_error,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1729 "The read operation timed out");
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1730 goto error;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1731 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1732 PyErr_SetString(PySSLErrorObject,
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	1733 "Underlying socket too large for select().");
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1734 goto error;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1735 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1736 count = 0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1737 goto done;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1738 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1739 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1740 do {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1741 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1742 count = SSL_read(self->ssl, mem, len);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1743 err = SSL_get_error(self->ssl, count);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1744 PySSL_END_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1745 if (PyErr_CheckSignals())
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1746 goto error;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1747 if (err == SSL_ERROR_WANT_READ) {
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	1748 sockstate = check_socket_and_wait_for_timeout(sock, 0);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1749 } else if (err == SSL_ERROR_WANT_WRITE) {
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	1750 sockstate = check_socket_and_wait_for_timeout(sock, 1);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1751 } else if ((err == SSL_ERROR_ZERO_RETURN) &&
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1752 (SSL_get_shutdown(self->ssl) ==
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1753 SSL_RECEIVED_SHUTDOWN))
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1754 {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1755 count = 0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1756 goto done;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1757 } else {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1758 sockstate = SOCKET_OPERATION_OK;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1759 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1760 if (sockstate == SOCKET_HAS_TIMED_OUT) {
66663 3d9a86b8cc98 Issue #10272: The ssl module now raises socket.timeout instead of a generic Antoine Pitrou <solipsis@pitrou.net> parents: 66217 diff changeset	1761 PyErr_SetString(PySocketModule.timeout_error,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1762 "The read operation timed out");
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1763 goto error;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1764 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1765 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1766 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1767 } while (err == SSL_ERROR_WANT_READ \|\| err == SSL_ERROR_WANT_WRITE);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1768 if (count <= 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1769 PySSL_SetError(self, count, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1770 goto error;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1771 }
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1772
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1773 done:
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1774 Py_DECREF(sock);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1775 if (!buf_passed) {
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1776 _PyBytes_Resize(&dest, count);
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1777 return dest;
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1778 }
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1779 else {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1780 PyBuffer_Release(&buf);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1781 return PyLong_FromLong(count);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1782 }
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1783
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1784 error:
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1785 Py_DECREF(sock);
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1786 if (!buf_passed)
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1787 Py_XDECREF(dest);
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 63694 diff changeset	1788 else
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1789 PyBuffer_Release(&buf);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1790 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1791 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1792
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1793 PyDoc_STRVAR(PySSL_SSLread_doc,
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	1794 "read([len]) -> string\n\
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1795 \n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	1796 Read up to len bytes from the SSL socket.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1797
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1798 static PyObject PySSL_SSLshutdown(PySSLSocket self)
48681 3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1799 {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1800 int err, ssl_err, sockstate, nonblocking;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1801 int zeros = 0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1802 PySocketSockObject *sock
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1803 = (PySocketSockObject *) PyWeakref_GetObject(self->Socket);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1804
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1805 /* Guard against closed socket */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1806 if ((((PyObject*)sock) == Py_None) \|\| (sock->sock_fd < 0)) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1807 _setSSLError("Underlying socket connection gone",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1808 PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1809 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1810 }
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1811 Py_INCREF(sock);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1812
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1813 /* Just in case the blocking state of the socket has been changed */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1814 nonblocking = (sock->sock_timeout >= 0.0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1815 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1816 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);
48681 3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1817
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1818 while (1) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1819 PySSL_BEGIN_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1820 /* Disable read-ahead so that unwrap can work correctly.
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1821 * Otherwise OpenSSL might read in too much data,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1822 * eating clear text data that happens to be
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1823 * transmitted after the SSL shutdown.
85231 61227b4c169f #18466: fix more typos. Patch by Févry Thibault. Ezio Melotti <ezio.melotti@gmail.com> parents: 85211 diff changeset	1824 * Should be safe to call repeatedly every time this
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1825 * function is used and the shutdown_seen_zero != 0
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1826 * condition is met.
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1827 */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1828 if (self->shutdown_seen_zero)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1829 SSL_set_read_ahead(self->ssl, 0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1830 err = SSL_shutdown(self->ssl);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1831 PySSL_END_ALLOW_THREADS
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1832 /* If err == 1, a secure shutdown with SSL_shutdown() is complete */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1833 if (err > 0)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1834 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1835 if (err == 0) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1836 /* Don't loop endlessly; instead preserve legacy
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1837 behaviour of trying SSL_shutdown() only twice.
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1838 This looks necessary for OpenSSL < 0.9.8m */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1839 if (++zeros > 1)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1840 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1841 /* Shutdown was sent, now try receiving */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1842 self->shutdown_seen_zero = 1;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1843 continue;
48681 3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1844 }
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1845
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1846 /* Possibly retry shutdown until timeout or failure */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1847 ssl_err = SSL_get_error(self->ssl, err);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1848 if (ssl_err == SSL_ERROR_WANT_READ)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1849 sockstate = check_socket_and_wait_for_timeout(sock, 0);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1850 else if (ssl_err == SSL_ERROR_WANT_WRITE)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1851 sockstate = check_socket_and_wait_for_timeout(sock, 1);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1852 else
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1853 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1854 if (sockstate == SOCKET_HAS_TIMED_OUT) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1855 if (ssl_err == SSL_ERROR_WANT_READ)
66663 3d9a86b8cc98 Issue #10272: The ssl module now raises socket.timeout instead of a generic Antoine Pitrou <solipsis@pitrou.net> parents: 66217 diff changeset	1856 PyErr_SetString(PySocketModule.timeout_error,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1857 "The read operation timed out");
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1858 else
66663 3d9a86b8cc98 Issue #10272: The ssl module now raises socket.timeout instead of a generic Antoine Pitrou <solipsis@pitrou.net> parents: 66217 diff changeset	1859 PyErr_SetString(PySocketModule.timeout_error,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1860 "The write operation timed out");
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1861 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1862 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1863 else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1864 PyErr_SetString(PySSLErrorObject,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1865 "Underlying socket too large for select().");
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1866 goto error;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1867 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1868 else if (sockstate != SOCKET_OPERATION_OK)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1869 /* Retain the SSL error code */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1870 break;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1871 }
60901 fc97784e5cc2 Merged revisions 80394 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60818 diff changeset	1872
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1873 if (err < 0) {
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1874 Py_DECREF(sock);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1875 return PySSL_SetError(self, err, __FILE__, __LINE__);
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1876 }
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1877 else
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1878 /* It's already INCREF'ed */
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1879 return (PyObject *) sock;
62481 b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1880
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1881 error:
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1882 Py_DECREF(sock);
b8b0a15f8a7c Merged revisions 82204 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61646 diff changeset	1883 return NULL;
48681 3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1884 }
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1885
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1886 PyDoc_STRVAR(PySSL_SSLshutdown_doc,
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1887 "shutdown(s) -> socket\n\
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1888 \n\
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1889 Does the SSL shutdown handshake with the remote end, and returns\n\
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1890 the underlying socket object.");
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1891
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1892 #if HAVE_OPENSSL_FINISHED
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1893 static PyObject *
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1894 PySSL_tls_unique_cb(PySSLSocket *self)
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1895 {
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1896 PyObject *retval = NULL;
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1897 char buf[PySSL_CB_MAXLEN];
84270 f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	1898 size_t len;
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1899
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1900 if (SSL_session_reused(self->ssl) ^ !self->socket_type) {
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1901 /* if session is resumed XOR we are the client */
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1902 len = SSL_get_finished(self->ssl, buf, PySSL_CB_MAXLEN);
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1903 }
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1904 else {
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1905 /* if a new session XOR we are the server */
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1906 len = SSL_get_peer_finished(self->ssl, buf, PySSL_CB_MAXLEN);
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1907 }
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1908
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1909 /* It cannot be negative in current OpenSSL version as of July 2011 */
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1910 if (len == 0)
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1911 Py_RETURN_NONE;
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1912
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1913 retval = PyBytes_FromStringAndSize(buf, len);
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1914
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1915 return retval;
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1916 }
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1917
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1918 PyDoc_STRVAR(PySSL_tls_unique_cb_doc,
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1919 "tls_unique_cb() -> bytes\n\
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1920 \n\
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1921 Returns the 'tls-unique' channel binding data, as defined by RFC 5929.\n\
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1922 \n\
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1923 If the TLS handshake is not yet complete, None is returned");
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1924
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1925 #endif /* HAVE_OPENSSL_FINISHED */
48681 3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	1926
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1927 static PyGetSetDef ssl_getsetlist[] = {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1928 {"context", (getter) PySSL_get_context,
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1929 (setter) PySSL_set_context, PySSL_set_context_doc},
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1930 {NULL}, /* sentinel */
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1931 };
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1932
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1933 static PyMethodDef PySSLMethods[] = {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1934 {"do_handshake", (PyCFunction)PySSL_SSLdo_handshake, METH_NOARGS},
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1935 {"write", (PyCFunction)PySSL_SSLwrite, METH_VARARGS,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1936 PySSL_SSLwrite_doc},
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1937 {"read", (PyCFunction)PySSL_SSLread, METH_VARARGS,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1938 PySSL_SSLread_doc},
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1939 {"pending", (PyCFunction)PySSL_SSLpending, METH_NOARGS,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1940 PySSL_SSLpending_doc},
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1941 {"peer_certificate", (PyCFunction)PySSL_peercert, METH_VARARGS,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1942 PySSL_peercert_doc},
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1943 {"cipher", (PyCFunction)PySSL_cipher, METH_NOARGS},
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1944 #ifdef OPENSSL_NPN_NEGOTIATED
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1945 {"selected_npn_protocol", (PyCFunction)PySSL_selected_npn_protocol, METH_NOARGS},
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	1946 #endif
74091 20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	1947 {"compression", (PyCFunction)PySSL_compression, METH_NOARGS},
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1948 {"shutdown", (PyCFunction)PySSL_SSLshutdown, METH_NOARGS,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1949 PySSL_SSLshutdown_doc},
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1950 #if HAVE_OPENSSL_FINISHED
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1951 {"tls_unique_cb", (PyCFunction)PySSL_tls_unique_cb, METH_NOARGS,
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1952 PySSL_tls_unique_cb_doc},
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	1953 #endif
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1954 {NULL, NULL}
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1955 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1956
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1957 static PyTypeObject PySSLSocket_Type = {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1958 PyVarObject_HEAD_INIT(NULL, 0)
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1959 "_ssl._SSLSocket", /tp_name/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1960 sizeof(PySSLSocket), /tp_basicsize/
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1961 0, /tp_itemsize/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1962 /* methods */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1963 (destructor)PySSL_dealloc, /tp_dealloc/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1964 0, /tp_print/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1965 0, /tp_getattr/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1966 0, /tp_setattr/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1967 0, /tp_reserved/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1968 0, /tp_repr/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1969 0, /tp_as_number/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1970 0, /tp_as_sequence/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1971 0, /tp_as_mapping/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1972 0, /tp_hash/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1973 0, /tp_call/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1974 0, /tp_str/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1975 0, /tp_getattro/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1976 0, /tp_setattro/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1977 0, /tp_as_buffer/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1978 Py_TPFLAGS_DEFAULT, /tp_flags/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1979 0, /tp_doc/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1980 0, /tp_traverse/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1981 0, /tp_clear/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1982 0, /tp_richcompare/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1983 0, /tp_weaklistoffset/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1984 0, /tp_iter/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1985 0, /tp_iternext/
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	1986 PySSLMethods, /tp_methods/
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1987 0, /tp_members/
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	1988 ssl_getsetlist, /tp_getset/
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1989 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	1990
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1991
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1992 /*
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1993 * _SSLContext objects
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1994 */
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1995
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1996 static PyObject *
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1997 context_new(PyTypeObject type, PyObject args, PyObject *kwds)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1998 {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	1999 char *kwlist[] = {"protocol", NULL};
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2000 PySSLContext *self;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2001 int proto_version = PY_SSL_VERSION_SSL23;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2002 SSL_CTX *ctx = NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2003
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2004 if (!PyArg_ParseTupleAndKeywords(
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2005 args, kwds, "i:_SSLContext", kwlist,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2006 &proto_version))
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2007 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2008
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2009 PySSL_BEGIN_ALLOW_THREADS
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2010 if (proto_version == PY_SSL_VERSION_TLS1)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2011 ctx = SSL_CTX_new(TLSv1_method());
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	2012 #if HAVE_TLSv1_2
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	2013 else if (proto_version == PY_SSL_VERSION_TLS1_1)
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	2014 ctx = SSL_CTX_new(TLSv1_1_method());
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	2015 else if (proto_version == PY_SSL_VERSION_TLS1_2)
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	2016 ctx = SSL_CTX_new(TLSv1_2_method());
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	2017 #endif
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2018 else if (proto_version == PY_SSL_VERSION_SSL3)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2019 ctx = SSL_CTX_new(SSLv3_method());
69998 20beec22764f (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 69114 69997 diff changeset	2020 #ifndef OPENSSL_NO_SSL2
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2021 else if (proto_version == PY_SSL_VERSION_SSL2)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2022 ctx = SSL_CTX_new(SSLv2_method());
69998 20beec22764f (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 69114 69997 diff changeset	2023 #endif
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2024 else if (proto_version == PY_SSL_VERSION_SSL23)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2025 ctx = SSL_CTX_new(SSLv23_method());
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2026 else
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2027 proto_version = -1;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2028 PySSL_END_ALLOW_THREADS
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2029
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2030 if (proto_version == -1) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2031 PyErr_SetString(PyExc_ValueError,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2032 "invalid protocol version");
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2033 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2034 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2035 if (ctx == NULL) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2036 PyErr_SetString(PySSLErrorObject,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2037 "failed to allocate SSL context");
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2038 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2039 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2040
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2041 assert(type != NULL && type->tp_alloc != NULL);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2042 self = (PySSLContext *) type->tp_alloc(type, 0);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2043 if (self == NULL) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2044 SSL_CTX_free(ctx);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2045 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2046 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2047 self->ctx = ctx;
79114 4cf53684e14e Issue #15977: Fix memory leak in Modules/_ssl.c when the function _set_npn_protocols() is called multiple times Christian Heimes <christian@cheimes.de> parents: 78605 diff changeset	2048 #ifdef OPENSSL_NPN_NEGOTIATED
4cf53684e14e Issue #15977: Fix memory leak in Modules/_ssl.c when the function _set_npn_protocols() is called multiple times Christian Heimes <christian@cheimes.de> parents: 78605 diff changeset	2049 self->npn_protocols = NULL;
4cf53684e14e Issue #15977: Fix memory leak in Modules/_ssl.c when the function _set_npn_protocols() is called multiple times Christian Heimes <christian@cheimes.de> parents: 78605 diff changeset	2050 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2051 #ifndef OPENSSL_NO_TLSEXT
84334 28f47a5d59b9 _ssl.c: strip trailing spaces Victor Stinner <victor.stinner@gmail.com> parents: 84333 diff changeset	2052 self->set_hostname = NULL;
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2053 #endif
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2054 /* Don't check host name by default */
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2055 self->check_hostname = 0;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2056 /* Defaults */
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2057 SSL_CTX_set_verify(self->ctx, SSL_VERIFY_NONE, NULL);
74648 4386686a035d Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. Antoine Pitrou <solipsis@pitrou.net> parents: 73711 74647 diff changeset	2058 SSL_CTX_set_options(self->ctx,
4386686a035d Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. Antoine Pitrou <solipsis@pitrou.net> parents: 73711 74647 diff changeset	2059 SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2060
65255 c48c09e693e6 Define a "session_id_context" at context creation. This is recommended Antoine Pitrou <solipsis@pitrou.net> parents: 65246 diff changeset	2061 #define SID_CTX "Python"
c48c09e693e6 Define a "session_id_context" at context creation. This is recommended Antoine Pitrou <solipsis@pitrou.net> parents: 65246 diff changeset	2062 SSL_CTX_set_session_id_context(self->ctx, (const unsigned char *) SID_CTX,
c48c09e693e6 Define a "session_id_context" at context creation. This is recommended Antoine Pitrou <solipsis@pitrou.net> parents: 65246 diff changeset	2063 sizeof(SID_CTX));
c48c09e693e6 Define a "session_id_context" at context creation. This is recommended Antoine Pitrou <solipsis@pitrou.net> parents: 65246 diff changeset	2064 #undef SID_CTX
c48c09e693e6 Define a "session_id_context" at context creation. This is recommended Antoine Pitrou <solipsis@pitrou.net> parents: 65246 diff changeset	2065
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2066 return (PyObject *)self;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2067 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2068
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2069 static int
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2070 context_traverse(PySSLContext self, visitproc visit, void arg)
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2071 {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2072 #ifndef OPENSSL_NO_TLSEXT
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2073 Py_VISIT(self->set_hostname);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2074 #endif
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2075 return 0;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2076 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2077
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2078 static int
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2079 context_clear(PySSLContext *self)
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2080 {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2081 #ifndef OPENSSL_NO_TLSEXT
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2082 Py_CLEAR(self->set_hostname);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2083 #endif
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2084 return 0;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2085 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2086
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2087 static void
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2088 context_dealloc(PySSLContext *self)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2089 {
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2090 context_clear(self);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2091 SSL_CTX_free(self->ctx);
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2092 #ifdef OPENSSL_NPN_NEGOTIATED
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2093 PyMem_Free(self->npn_protocols);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2094 #endif
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2095 Py_TYPE(self)->tp_free(self);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2096 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2097
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2098 static PyObject *
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2099 set_ciphers(PySSLContext self, PyObject args)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2100 {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2101 int ret;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2102 const char *cipherlist;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2103
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2104 if (!PyArg_ParseTuple(args, "s:set_ciphers", &cipherlist))
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2105 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2106 ret = SSL_CTX_set_cipher_list(self->ctx, cipherlist);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2107 if (ret == 0) {
61637 2ca4626d9c93 Fix (hopefully) the remaining test_ssl buildbot failures Antoine Pitrou <solipsis@pitrou.net> parents: 61635 diff changeset	2108 /* Clearing the error queue is necessary on some OpenSSL versions,
2ca4626d9c93 Fix (hopefully) the remaining test_ssl buildbot failures Antoine Pitrou <solipsis@pitrou.net> parents: 61635 diff changeset	2109 otherwise the error will be reported again when another SSL call
2ca4626d9c93 Fix (hopefully) the remaining test_ssl buildbot failures Antoine Pitrou <solipsis@pitrou.net> parents: 61635 diff changeset	2110 is done. */
2ca4626d9c93 Fix (hopefully) the remaining test_ssl buildbot failures Antoine Pitrou <solipsis@pitrou.net> parents: 61635 diff changeset	2111 ERR_clear_error();
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2112 PyErr_SetString(PySSLErrorObject,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2113 "No cipher can be selected.");
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2114 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2115 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2116 Py_RETURN_NONE;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2117 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2118
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2119 #ifdef OPENSSL_NPN_NEGOTIATED
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2120 /* this callback gets passed to SSL_CTX_set_next_protos_advertise_cb */
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2121 static int
84269 1bd49f8a30da _ssl.c: strip trailing spaces Victor Stinner <victor.stinner@gmail.com> parents: 81463 diff changeset	2122 _advertiseNPN_cb(SSL *s,
1bd49f8a30da _ssl.c: strip trailing spaces Victor Stinner <victor.stinner@gmail.com> parents: 81463 diff changeset	2123 const unsigned char *data, unsigned int len,
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2124 void *args)
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2125 {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2126 PySSLContext ssl_ctx = (PySSLContext ) args;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2127
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2128 if (ssl_ctx->npn_protocols == NULL) {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2129 data = (unsigned char ) "";
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2130 *len = 0;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2131 } else {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2132 data = (unsigned char ) ssl_ctx->npn_protocols;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2133 *len = ssl_ctx->npn_protocols_len;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2134 }
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2135
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2136 return SSL_TLSEXT_ERR_OK;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2137 }
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2138 /* this callback gets passed to SSL_CTX_set_next_proto_select_cb */
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2139 static int
84269 1bd49f8a30da _ssl.c: strip trailing spaces Victor Stinner <victor.stinner@gmail.com> parents: 81463 diff changeset	2140 _selectNPN_cb(SSL *s,
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2141 unsigned char *out, unsigned char outlen,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2142 const unsigned char *server, unsigned int server_len,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2143 void *args)
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2144 {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2145 PySSLContext ssl_ctx = (PySSLContext ) args;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2146
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2147 unsigned char client = (unsigned char ) ssl_ctx->npn_protocols;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2148 int client_len;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2149
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2150 if (client == NULL) {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2151 client = (unsigned char *) "";
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2152 client_len = 0;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2153 } else {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2154 client_len = ssl_ctx->npn_protocols_len;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2155 }
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2156
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2157 SSL_select_next_proto(out, outlen,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2158 server, server_len,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2159 client, client_len);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2160
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2161 return SSL_TLSEXT_ERR_OK;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2162 }
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2163 #endif
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2164
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2165 static PyObject *
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2166 _set_npn_protocols(PySSLContext self, PyObject args)
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2167 {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2168 #ifdef OPENSSL_NPN_NEGOTIATED
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2169 Py_buffer protos;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2170
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2171 if (!PyArg_ParseTuple(args, "y*:set_npn_protocols", &protos))
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2172 return NULL;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2173
79114 4cf53684e14e Issue #15977: Fix memory leak in Modules/_ssl.c when the function _set_npn_protocols() is called multiple times Christian Heimes <christian@cheimes.de> parents: 78605 diff changeset	2174 if (self->npn_protocols != NULL) {
4cf53684e14e Issue #15977: Fix memory leak in Modules/_ssl.c when the function _set_npn_protocols() is called multiple times Christian Heimes <christian@cheimes.de> parents: 78605 diff changeset	2175 PyMem_Free(self->npn_protocols);
4cf53684e14e Issue #15977: Fix memory leak in Modules/_ssl.c when the function _set_npn_protocols() is called multiple times Christian Heimes <christian@cheimes.de> parents: 78605 diff changeset	2176 }
4cf53684e14e Issue #15977: Fix memory leak in Modules/_ssl.c when the function _set_npn_protocols() is called multiple times Christian Heimes <christian@cheimes.de> parents: 78605 diff changeset	2177
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2178 self->npn_protocols = PyMem_Malloc(protos.len);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2179 if (self->npn_protocols == NULL) {
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2180 PyBuffer_Release(&protos);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2181 return PyErr_NoMemory();
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2182 }
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2183 memcpy(self->npn_protocols, protos.buf, protos.len);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2184 self->npn_protocols_len = (int) protos.len;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2185
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2186 /* set both server and client callbacks, because the context can
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2187 * be used to create both types of sockets */
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2188 SSL_CTX_set_next_protos_advertised_cb(self->ctx,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2189 _advertiseNPN_cb,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2190 self);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2191 SSL_CTX_set_next_proto_select_cb(self->ctx,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2192 _selectNPN_cb,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2193 self);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2194
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2195 PyBuffer_Release(&protos);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2196 Py_RETURN_NONE;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2197 #else
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2198 PyErr_SetString(PyExc_NotImplementedError,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2199 "The NPN extension requires OpenSSL 1.0.1 or later.");
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2200 return NULL;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2201 #endif
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2202 }
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	2203
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2204 static PyObject *
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2205 get_verify_mode(PySSLContext self, void c)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2206 {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2207 switch (SSL_CTX_get_verify_mode(self->ctx)) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2208 case SSL_VERIFY_NONE:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2209 return PyLong_FromLong(PY_SSL_CERT_NONE);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2210 case SSL_VERIFY_PEER:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2211 return PyLong_FromLong(PY_SSL_CERT_OPTIONAL);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2212 case SSL_VERIFY_PEER \| SSL_VERIFY_FAIL_IF_NO_PEER_CERT:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2213 return PyLong_FromLong(PY_SSL_CERT_REQUIRED);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2214 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2215 PyErr_SetString(PySSLErrorObject,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2216 "invalid return value from SSL_CTX_get_verify_mode");
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2217 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2218 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2219
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2220 static int
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2221 set_verify_mode(PySSLContext self, PyObject arg, void *c)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2222 {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2223 int n, mode;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2224 if (!PyArg_Parse(arg, "i", &n))
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2225 return -1;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2226 if (n == PY_SSL_CERT_NONE)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2227 mode = SSL_VERIFY_NONE;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2228 else if (n == PY_SSL_CERT_OPTIONAL)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2229 mode = SSL_VERIFY_PEER;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2230 else if (n == PY_SSL_CERT_REQUIRED)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2231 mode = SSL_VERIFY_PEER \| SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2232 else {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2233 PyErr_SetString(PyExc_ValueError,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2234 "invalid value for verify_mode");
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2235 return -1;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2236 }
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2237 if (mode == SSL_VERIFY_NONE && self->check_hostname) {
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2238 PyErr_SetString(PyExc_ValueError,
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2239 "Cannot set verify_mode to CERT_NONE when "
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2240 "check_hostname is enabled.");
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2241 return -1;
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2242 }
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2243 SSL_CTX_set_verify(self->ctx, mode, NULL);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2244 return 0;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2245 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2246
87397 40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	2247 #ifdef HAVE_OPENSSL_VERIFY_PARAM
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2248 static PyObject *
87320 83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2249 get_verify_flags(PySSLContext self, void c)
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2250 {
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2251 X509_STORE *store;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2252 unsigned long flags;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2253
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2254 store = SSL_CTX_get_cert_store(self->ctx);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2255 flags = X509_VERIFY_PARAM_get_flags(store->param);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2256 return PyLong_FromUnsignedLong(flags);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2257 }
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2258
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2259 static int
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2260 set_verify_flags(PySSLContext self, PyObject arg, void *c)
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2261 {
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2262 X509_STORE *store;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2263 unsigned long new_flags, flags, set, clear;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2264
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2265 if (!PyArg_Parse(arg, "k", &new_flags))
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2266 return -1;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2267 store = SSL_CTX_get_cert_store(self->ctx);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2268 flags = X509_VERIFY_PARAM_get_flags(store->param);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2269 clear = flags & ~new_flags;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2270 set = ~flags & new_flags;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2271 if (clear) {
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2272 if (!X509_VERIFY_PARAM_clear_flags(store->param, clear)) {
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2273 _setSSLError(NULL, 0, __FILE__, __LINE__);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2274 return -1;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2275 }
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2276 }
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2277 if (set) {
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2278 if (!X509_VERIFY_PARAM_set_flags(store->param, set)) {
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2279 _setSSLError(NULL, 0, __FILE__, __LINE__);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2280 return -1;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2281 }
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2282 }
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2283 return 0;
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2284 }
87397 40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	2285 #endif
87320 83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2286
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	2287 static PyObject *
61782 5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2288 get_options(PySSLContext self, void c)
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2289 {
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2290 return PyLong_FromLong(SSL_CTX_get_options(self->ctx));
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2291 }
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2292
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2293 static int
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2294 set_options(PySSLContext self, PyObject arg, void *c)
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2295 {
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2296 long new_opts, opts, set, clear;
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2297 if (!PyArg_Parse(arg, "l", &new_opts))
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2298 return -1;
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2299 opts = SSL_CTX_get_options(self->ctx);
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2300 clear = opts & ~new_opts;
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2301 set = ~opts & new_opts;
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2302 if (clear) {
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2303 #ifdef HAVE_SSL_CTX_CLEAR_OPTIONS
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2304 SSL_CTX_clear_options(self->ctx, clear);
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2305 #else
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2306 PyErr_SetString(PyExc_ValueError,
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2307 "can't clear options before OpenSSL 0.9.8m");
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2308 return -1;
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2309 #endif
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2310 }
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2311 if (set)
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2312 SSL_CTX_set_options(self->ctx, set);
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2313 return 0;
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2314 }
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2315
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2316 static PyObject *
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2317 get_check_hostname(PySSLContext self, void c)
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2318 {
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2319 return PyBool_FromLong(self->check_hostname);
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2320 }
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2321
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2322 static int
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2323 set_check_hostname(PySSLContext self, PyObject arg, void *c)
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2324 {
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2325 int check_hostname;
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2326 if (!PyArg_Parse(arg, "p", &check_hostname))
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2327 return -1;
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2328 if (check_hostname &&
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2329 SSL_CTX_get_verify_mode(self->ctx) == SSL_VERIFY_NONE) {
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2330 PyErr_SetString(PyExc_ValueError,
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2331 "check_hostname needs a SSL context with either "
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2332 "CERT_OPTIONAL or CERT_REQUIRED");
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2333 return -1;
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2334 }
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2335 self->check_hostname = check_hostname;
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2336 return 0;
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2337 }
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2338
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	2339
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2340 typedef struct {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2341 PyThreadState *thread_state;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2342 PyObject *callable;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2343 char *password;
84270 f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	2344 int size;
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2345 int error;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2346 } _PySSLPasswordInfo;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2347
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2348 static int
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2349 _pwinfo_set(_PySSLPasswordInfo pw_info, PyObject password,
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2350 const char *bad_type_error)
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2351 {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2352 /* Set the password and size fields of a _PySSLPasswordInfo struct
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2353 from a unicode, bytes, or byte array object.
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2354 The password field will be dynamically allocated and must be freed
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2355 by the caller */
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2356 PyObject *password_bytes = NULL;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2357 const char *data = NULL;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2358 Py_ssize_t size;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2359
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2360 if (PyUnicode_Check(password)) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2361 password_bytes = PyUnicode_AsEncodedString(password, NULL, NULL);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2362 if (!password_bytes) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2363 goto error;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2364 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2365 data = PyBytes_AS_STRING(password_bytes);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2366 size = PyBytes_GET_SIZE(password_bytes);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2367 } else if (PyBytes_Check(password)) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2368 data = PyBytes_AS_STRING(password);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2369 size = PyBytes_GET_SIZE(password);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2370 } else if (PyByteArray_Check(password)) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2371 data = PyByteArray_AS_STRING(password);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2372 size = PyByteArray_GET_SIZE(password);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2373 } else {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2374 PyErr_SetString(PyExc_TypeError, bad_type_error);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2375 goto error;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2376 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2377
84270 f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	2378 if (size > (Py_ssize_t)INT_MAX) {
f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	2379 PyErr_Format(PyExc_ValueError,
f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	2380 "password cannot be longer than %d bytes", INT_MAX);
f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	2381 goto error;
f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	2382 }
f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	2383
84495 638d43665356 Issue #18203: Replace malloc() with PyMem_Malloc() in _ssl for the password Victor Stinner <victor.stinner@gmail.com> parents: 84491 diff changeset	2384 PyMem_Free(pw_info->password);
638d43665356 Issue #18203: Replace malloc() with PyMem_Malloc() in _ssl for the password Victor Stinner <victor.stinner@gmail.com> parents: 84491 diff changeset	2385 pw_info->password = PyMem_Malloc(size);
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2386 if (!pw_info->password) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2387 PyErr_SetString(PyExc_MemoryError,
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2388 "unable to allocate password buffer");
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2389 goto error;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2390 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2391 memcpy(pw_info->password, data, size);
84270 f0d934732ab1 Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write() Victor Stinner <victor.stinner@gmail.com> parents: 84269 diff changeset	2392 pw_info->size = (int)size;
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2393
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2394 Py_XDECREF(password_bytes);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2395 return 1;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2396
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2397 error:
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2398 Py_XDECREF(password_bytes);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2399 return 0;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2400 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2401
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2402 static int
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2403 _password_callback(char buf, int size, int rwflag, void userdata)
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2404 {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2405 _PySSLPasswordInfo pw_info = (_PySSLPasswordInfo) userdata;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2406 PyObject *fn_ret = NULL;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2407
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2408 PySSL_END_ALLOW_THREADS_S(pw_info->thread_state);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2409
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2410 if (pw_info->callable) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2411 fn_ret = PyObject_CallFunctionObjArgs(pw_info->callable, NULL);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2412 if (!fn_ret) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2413 /* TODO: It would be nice to move _ctypes_add_traceback() into the
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2414 core python API, so we could use it to add a frame here */
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2415 goto error;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2416 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2417
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2418 if (!_pwinfo_set(pw_info, fn_ret,
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2419 "password callback must return a string")) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2420 goto error;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2421 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2422 Py_CLEAR(fn_ret);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2423 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2424
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2425 if (pw_info->size > size) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2426 PyErr_Format(PyExc_ValueError,
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2427 "password cannot be longer than %d bytes", size);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2428 goto error;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2429 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2430
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2431 PySSL_BEGIN_ALLOW_THREADS_S(pw_info->thread_state);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2432 memcpy(buf, pw_info->password, pw_info->size);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2433 return pw_info->size;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2434
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2435 error:
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2436 Py_XDECREF(fn_ret);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2437 PySSL_BEGIN_ALLOW_THREADS_S(pw_info->thread_state);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2438 pw_info->error = 1;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2439 return -1;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2440 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2441
61782 5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	2442 static PyObject *
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2443 load_cert_chain(PySSLContext self, PyObject args, PyObject *kwds)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2444 {
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2445 char *kwlist[] = {"certfile", "keyfile", "password", NULL};
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2446 PyObject certfile, keyfile = NULL, *password = NULL;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2447 PyObject certfile_bytes = NULL, keyfile_bytes = NULL;
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2448 pem_password_cb *orig_passwd_cb = self->ctx->default_passwd_callback;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2449 void *orig_passwd_userdata = self->ctx->default_passwd_callback_userdata;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2450 _PySSLPasswordInfo pw_info = { NULL, NULL, NULL, 0, 0 };
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2451 int r;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2452
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2453 errno = 0;
64358 063b554d3153 Try to fix some buildbot failures on test_ssl Antoine Pitrou <solipsis@pitrou.net> parents: 64352 diff changeset	2454 ERR_clear_error();
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2455 if (!PyArg_ParseTupleAndKeywords(args, kwds,
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2456 "O\|OO:load_cert_chain", kwlist,
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2457 &certfile, &keyfile, &password))
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2458 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2459 if (keyfile == Py_None)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2460 keyfile = NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2461 if (!PyUnicode_FSConverter(certfile, &certfile_bytes)) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2462 PyErr_SetString(PyExc_TypeError,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2463 "certfile should be a valid filesystem path");
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2464 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2465 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2466 if (keyfile && !PyUnicode_FSConverter(keyfile, &keyfile_bytes)) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2467 PyErr_SetString(PyExc_TypeError,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2468 "keyfile should be a valid filesystem path");
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2469 goto error;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2470 }
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2471 if (password && password != Py_None) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2472 if (PyCallable_Check(password)) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2473 pw_info.callable = password;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2474 } else if (!_pwinfo_set(&pw_info, password,
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2475 "password should be a string or callable")) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2476 goto error;
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2477 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2478 SSL_CTX_set_default_passwd_cb(self->ctx, _password_callback);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2479 SSL_CTX_set_default_passwd_cb_userdata(self->ctx, &pw_info);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2480 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2481 PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2482 r = SSL_CTX_use_certificate_chain_file(self->ctx,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2483 PyBytes_AS_STRING(certfile_bytes));
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2484 PySSL_END_ALLOW_THREADS_S(pw_info.thread_state);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2485 if (r != 1) {
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2486 if (pw_info.error) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2487 ERR_clear_error();
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2488 /* the password callback has already set the error information */
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2489 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2490 else if (errno != 0) {
64352 2dc17dcc9734 Issue #9693 - msg 115273: attempt to fix ssl module failures on certain OpenSSL versions by calling ERR_clear_error() before raising IOError Giampaolo Rodolà <g.rodola@gmail.com> parents: 64306 diff changeset	2491 ERR_clear_error();
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2492 PyErr_SetFromErrno(PyExc_IOError);
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2493 }
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2494 else {
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2495 _setSSLError(NULL, 0, __FILE__, __LINE__);
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2496 }
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2497 goto error;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2498 }
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2499 PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state);
69114 88ed3de28520 Issue #11746: Fix SSLContext.load_cert_chain() to accept elliptic curve private keys. Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	2500 r = SSL_CTX_use_PrivateKey_file(self->ctx,
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2501 PyBytes_AS_STRING(keyfile ? keyfile_bytes : certfile_bytes),
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2502 SSL_FILETYPE_PEM);
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2503 PySSL_END_ALLOW_THREADS_S(pw_info.thread_state);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2504 Py_CLEAR(keyfile_bytes);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2505 Py_CLEAR(certfile_bytes);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2506 if (r != 1) {
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2507 if (pw_info.error) {
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2508 ERR_clear_error();
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2509 /* the password callback has already set the error information */
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2510 }
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2511 else if (errno != 0) {
64352 2dc17dcc9734 Issue #9693 - msg 115273: attempt to fix ssl module failures on certain OpenSSL versions by calling ERR_clear_error() before raising IOError Giampaolo Rodolà <g.rodola@gmail.com> parents: 64306 diff changeset	2512 ERR_clear_error();
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2513 PyErr_SetFromErrno(PyExc_IOError);
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2514 }
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2515 else {
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2516 _setSSLError(NULL, 0, __FILE__, __LINE__);
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2517 }
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2518 goto error;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2519 }
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2520 PySSL_BEGIN_ALLOW_THREADS_S(pw_info.thread_state);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2521 r = SSL_CTX_check_private_key(self->ctx);
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2522 PySSL_END_ALLOW_THREADS_S(pw_info.thread_state);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2523 if (r != 1) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2524 _setSSLError(NULL, 0, __FILE__, __LINE__);
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2525 goto error;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2526 }
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2527 SSL_CTX_set_default_passwd_cb(self->ctx, orig_passwd_cb);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2528 SSL_CTX_set_default_passwd_cb_userdata(self->ctx, orig_passwd_userdata);
84495 638d43665356 Issue #18203: Replace malloc() with PyMem_Malloc() in _ssl for the password Victor Stinner <victor.stinner@gmail.com> parents: 84491 diff changeset	2529 PyMem_Free(pw_info.password);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2530 Py_RETURN_NONE;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2531
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2532 error:
72071 cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2533 SSL_CTX_set_default_passwd_cb(self->ctx, orig_passwd_cb);
cdc6c1b072a5 Issue #12803: SSLContext.load_cert_chain() now accepts a password argument Antoine Pitrou <solipsis@pitrou.net> parents: 71440 diff changeset	2534 SSL_CTX_set_default_passwd_cb_userdata(self->ctx, orig_passwd_userdata);
84495 638d43665356 Issue #18203: Replace malloc() with PyMem_Malloc() in _ssl for the password Victor Stinner <victor.stinner@gmail.com> parents: 84491 diff changeset	2535 PyMem_Free(pw_info.password);
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2536 Py_XDECREF(keyfile_bytes);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2537 Py_XDECREF(certfile_bytes);
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2538 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2539 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2540
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2541 /* internal helper function, returns -1 on error
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2542 */
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2543 static int
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2544 _add_ca_certs(PySSLContext self, void data, Py_ssize_t len,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2545 int filetype)
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2546 {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2547 BIO *biobuf = NULL;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2548 X509_STORE *store;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2549 int retval = 0, err, loaded = 0;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2550
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2551 assert(filetype == SSL_FILETYPE_ASN1 \|\| filetype == SSL_FILETYPE_PEM);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2552
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2553 if (len <= 0) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2554 PyErr_SetString(PyExc_ValueError,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2555 "Empty certificate data");
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2556 return -1;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2557 } else if (len > INT_MAX) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2558 PyErr_SetString(PyExc_OverflowError,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2559 "Certificate data is too long.");
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2560 return -1;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2561 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2562
87322 97b84261b794 downcast len to int. The code has already checked that len < INT_MAX Christian Heimes <christian@cheimes.de> parents: 87321 diff changeset	2563 biobuf = BIO_new_mem_buf(data, (int)len);
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2564 if (biobuf == NULL) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2565 _setSSLError("Can't allocate buffer", 0, __FILE__, __LINE__);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2566 return -1;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2567 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2568
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2569 store = SSL_CTX_get_cert_store(self->ctx);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2570 assert(store != NULL);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2571
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2572 while (1) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2573 X509 *cert = NULL;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2574 int r;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2575
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2576 if (filetype == SSL_FILETYPE_ASN1) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2577 cert = d2i_X509_bio(biobuf, NULL);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2578 } else {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2579 cert = PEM_read_bio_X509(biobuf, NULL,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2580 self->ctx->default_passwd_callback,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2581 self->ctx->default_passwd_callback_userdata);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2582 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2583 if (cert == NULL) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2584 break;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2585 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2586 r = X509_STORE_add_cert(store, cert);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2587 X509_free(cert);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2588 if (!r) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2589 err = ERR_peek_last_error();
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2590 if ((ERR_GET_LIB(err) == ERR_LIB_X509) &&
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2591 (ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE)) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2592 /* cert already in hash table, not an error */
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2593 ERR_clear_error();
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2594 } else {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2595 break;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2596 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2597 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2598 loaded++;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2599 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2600
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2601 err = ERR_peek_last_error();
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2602 if ((filetype == SSL_FILETYPE_ASN1) &&
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2603 (loaded > 0) &&
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2604 (ERR_GET_LIB(err) == ERR_LIB_ASN1) &&
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2605 (ERR_GET_REASON(err) == ASN1_R_HEADER_TOO_LONG)) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2606 /* EOF ASN1 file, not an error */
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2607 ERR_clear_error();
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2608 retval = 0;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2609 } else if ((filetype == SSL_FILETYPE_PEM) &&
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2610 (loaded > 0) &&
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2611 (ERR_GET_LIB(err) == ERR_LIB_PEM) &&
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2612 (ERR_GET_REASON(err) == PEM_R_NO_START_LINE)) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2613 /* EOF PEM file, not an error */
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2614 ERR_clear_error();
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2615 retval = 0;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2616 } else {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2617 _setSSLError(NULL, 0, __FILE__, __LINE__);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2618 retval = -1;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2619 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2620
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2621 BIO_free(biobuf);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2622 return retval;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2623 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2624
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2625
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2626 static PyObject *
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2627 load_verify_locations(PySSLContext self, PyObject args, PyObject *kwds)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2628 {
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2629 char *kwlist[] = {"cafile", "capath", "cadata", NULL};
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2630 PyObject cafile = NULL, capath = NULL, *cadata = NULL;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2631 PyObject cafile_bytes = NULL, capath_bytes = NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2632 const char cafile_buf = NULL, capath_buf = NULL;
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2633 int r = 0, ok = 1;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2634
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 63692 diff changeset	2635 errno = 0;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2636 if (!PyArg_ParseTupleAndKeywords(args, kwds,
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2637 "\|OOO:load_verify_locations", kwlist,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2638 &cafile, &capath, &cadata))
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2639 return NULL;
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2640
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2641 if (cafile == Py_None)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2642 cafile = NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2643 if (capath == Py_None)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2644 capath = NULL;
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2645 if (cadata == Py_None)
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2646 cadata = NULL;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2647
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2648 if (cafile == NULL && capath == NULL && cadata == NULL) {
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2649 PyErr_SetString(PyExc_TypeError,
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2650 "cafile, capath and cadata cannot be all omitted");
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2651 goto error;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2652 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2653 if (cafile && !PyUnicode_FSConverter(cafile, &cafile_bytes)) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2654 PyErr_SetString(PyExc_TypeError,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2655 "cafile should be a valid filesystem path");
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2656 goto error;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2657 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2658 if (capath && !PyUnicode_FSConverter(capath, &capath_bytes)) {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2659 PyErr_SetString(PyExc_TypeError,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2660 "capath should be a valid filesystem path");
87302 234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2661 goto error;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2662 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2663
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2664 /* validata cadata type and load cadata */
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2665 if (cadata) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2666 Py_buffer buf;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2667 PyObject *cadata_ascii = NULL;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2668
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2669 if (PyObject_GetBuffer(cadata, &buf, PyBUF_SIMPLE) == 0) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2670 if (!PyBuffer_IsContiguous(&buf, 'C') \|\| buf.ndim > 1) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2671 PyBuffer_Release(&buf);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2672 PyErr_SetString(PyExc_TypeError,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2673 "cadata should be a contiguous buffer with "
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2674 "a single dimension");
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2675 goto error;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2676 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2677 r = _add_ca_certs(self, buf.buf, buf.len, SSL_FILETYPE_ASN1);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2678 PyBuffer_Release(&buf);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2679 if (r == -1) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2680 goto error;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2681 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2682 } else {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2683 PyErr_Clear();
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2684 cadata_ascii = PyUnicode_AsASCIIString(cadata);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2685 if (cadata_ascii == NULL) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2686 PyErr_SetString(PyExc_TypeError,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2687 "cadata should be a ASCII string or a "
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2688 "bytes-like object");
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2689 goto error;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2690 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2691 r = _add_ca_certs(self,
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2692 PyBytes_AS_STRING(cadata_ascii),
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2693 PyBytes_GET_SIZE(cadata_ascii),
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2694 SSL_FILETYPE_PEM);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2695 Py_DECREF(cadata_ascii);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2696 if (r == -1) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2697 goto error;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2698 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2699 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2700 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2701
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2702 /* load cafile or capath */
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2703 if (cafile \|\| capath) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2704 if (cafile)
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2705 cafile_buf = PyBytes_AS_STRING(cafile_bytes);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2706 if (capath)
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2707 capath_buf = PyBytes_AS_STRING(capath_bytes);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2708 PySSL_BEGIN_ALLOW_THREADS
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2709 r = SSL_CTX_load_verify_locations(self->ctx, cafile_buf, capath_buf);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2710 PySSL_END_ALLOW_THREADS
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2711 if (r != 1) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2712 ok = 0;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2713 if (errno != 0) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2714 ERR_clear_error();
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2715 PyErr_SetFromErrno(PyExc_IOError);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2716 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2717 else {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2718 _setSSLError(NULL, 0, __FILE__, __LINE__);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2719 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2720 goto error;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2721 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2722 }
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2723 goto end;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2724
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2725 error:
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2726 ok = 0;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2727 end:
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2728 Py_XDECREF(cafile_bytes);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2729 Py_XDECREF(capath_bytes);
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2730 if (ok) {
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2731 Py_RETURN_NONE;
234e3c8dc52f Issue #18138: Implement cadata argument of SSLContext.load_verify_location() Christian Heimes <christian@cheimes.de> parents: 87241 diff changeset	2732 } else {
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2733 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2734 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2735 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2736
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2737 static PyObject *
74129 33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2738 load_dh_params(PySSLContext self, PyObject filepath)
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2739 {
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2740 FILE *f;
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2741 DH *dh;
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2742
85420 ef889c3d5dc6 Issue #18571: Implementation of the PEP 446: file descriptors and file handles Victor Stinner <victor.stinner@gmail.com> parents: 85379 diff changeset	2743 f = _Py_fopen_obj(filepath, "rb");
74129 33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2744 if (f == NULL) {
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2745 if (!PyErr_Occurred())
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2746 PyErr_SetFromErrnoWithFilenameObject(PyExc_OSError, filepath);
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2747 return NULL;
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2748 }
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2749 errno = 0;
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2750 PySSL_BEGIN_ALLOW_THREADS
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2751 dh = PEM_read_DHparams(f, NULL, NULL, NULL);
81463 523d5b1e3fd5 SSLContext.load_dh_params() now properly closes the input file. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2752 fclose(f);
74129 33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2753 PySSL_END_ALLOW_THREADS
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2754 if (dh == NULL) {
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2755 if (errno != 0) {
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2756 ERR_clear_error();
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2757 PyErr_SetFromErrnoWithFilenameObject(PyExc_OSError, filepath);
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2758 }
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2759 else {
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2760 _setSSLError(NULL, 0, __FILE__, __LINE__);
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2761 }
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2762 return NULL;
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2763 }
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2764 if (SSL_CTX_set_tmp_dh(self->ctx, dh) == 0)
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2765 _setSSLError(NULL, 0, __FILE__, __LINE__);
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2766 DH_free(dh);
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2767 Py_RETURN_NONE;
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2768 }
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2769
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	2770 static PyObject *
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2771 context_wrap_socket(PySSLContext self, PyObject args, PyObject *kwds)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2772 {
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2773 char *kwlist[] = {"sock", "server_side", "server_hostname", NULL};
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2774 PySocketSockObject *sock;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2775 int server_side = 0;
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2776 char *hostname = NULL;
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2777 PyObject hostname_obj, res;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2778
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2779 /* server_hostname is either None (or absent), or to be encoded
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2780 using the idna encoding. */
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2781 if (!PyArg_ParseTupleAndKeywords(args, kwds, "O!i\|O!:_wrap_socket", kwlist,
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2782 PySocketModule.Sock_Type,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2783 &sock, &server_side,
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2784 Py_TYPE(Py_None), &hostname_obj)) {
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2785 PyErr_Clear();
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2786 if (!PyArg_ParseTupleAndKeywords(args, kwds, "O!iet:_wrap_socket", kwlist,
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2787 PySocketModule.Sock_Type,
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2788 &sock, &server_side,
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2789 "idna", &hostname))
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2790 return NULL;
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	2791 #if !HAVE_SNI
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2792 PyMem_Free(hostname);
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2793 PyErr_SetString(PyExc_ValueError, "server_hostname is not supported "
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2794 "by your OpenSSL library");
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2795 return NULL;
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2796 #endif
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2797 }
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2798
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2799 res = (PyObject *) newPySSLSocket(self, sock, server_side,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2800 hostname);
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2801 if (hostname != NULL)
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2802 PyMem_Free(hostname);
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	2803 return res;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2804 }
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	2805
65223 9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2806 static PyObject *
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2807 session_stats(PySSLContext self, PyObject unused)
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2808 {
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2809 int r;
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2810 PyObject value, stats = PyDict_New();
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2811 if (!stats)
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2812 return NULL;
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2813
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2814 #define ADD_STATS(SSL_NAME, KEY_NAME) \
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2815 value = PyLong_FromLong(SSL_CTX_sess_ ## SSL_NAME (self->ctx)); \
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2816 if (value == NULL) \
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2817 goto error; \
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2818 r = PyDict_SetItemString(stats, KEY_NAME, value); \
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2819 Py_DECREF(value); \
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2820 if (r < 0) \
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2821 goto error;
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2822
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2823 ADD_STATS(number, "number");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2824 ADD_STATS(connect, "connect");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2825 ADD_STATS(connect_good, "connect_good");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2826 ADD_STATS(connect_renegotiate, "connect_renegotiate");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2827 ADD_STATS(accept, "accept");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2828 ADD_STATS(accept_good, "accept_good");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2829 ADD_STATS(accept_renegotiate, "accept_renegotiate");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2830 ADD_STATS(accept, "accept");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2831 ADD_STATS(hits, "hits");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2832 ADD_STATS(misses, "misses");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2833 ADD_STATS(timeouts, "timeouts");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2834 ADD_STATS(cache_full, "cache_full");
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2835
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2836 #undef ADD_STATS
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2837
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2838 return stats;
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2839
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2840 error:
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2841 Py_DECREF(stats);
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2842 return NULL;
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2843 }
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	2844
66217 7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2845 static PyObject *
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2846 set_default_verify_paths(PySSLContext self, PyObject unused)
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2847 {
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2848 if (!SSL_CTX_set_default_verify_paths(self->ctx)) {
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2849 _setSSLError(NULL, 0, __FILE__, __LINE__);
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2850 return NULL;
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2851 }
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2852 Py_RETURN_NONE;
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2853 }
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	2854
74103 ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	2855 #ifndef OPENSSL_NO_ECDH
74084 8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2856 static PyObject *
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2857 set_ecdh_curve(PySSLContext self, PyObject name)
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2858 {
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2859 PyObject *name_bytes;
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2860 int nid;
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2861 EC_KEY *key;
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2862
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2863 if (!PyUnicode_FSConverter(name, &name_bytes))
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2864 return NULL;
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2865 assert(PyBytes_Check(name_bytes));
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2866 nid = OBJ_sn2nid(PyBytes_AS_STRING(name_bytes));
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2867 Py_DECREF(name_bytes);
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2868 if (nid == 0) {
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2869 PyErr_Format(PyExc_ValueError,
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2870 "unknown elliptic curve name %R", name);
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2871 return NULL;
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2872 }
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2873 key = EC_KEY_new_by_curve_name(nid);
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2874 if (key == NULL) {
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2875 _setSSLError(NULL, 0, __FILE__, __LINE__);
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2876 return NULL;
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2877 }
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2878 SSL_CTX_set_tmp_ecdh(self->ctx, key);
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2879 EC_KEY_free(key);
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2880 Py_RETURN_NONE;
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2881 }
74103 ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	2882 #endif
74084 8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	2883
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	2884 #if HAVE_SNI && !defined(OPENSSL_NO_TLSEXT)
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2885 static int
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2886 _servername_callback(SSL s, int al, void *args)
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2887 {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2888 int ret;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2889 PySSLContext ssl_ctx = (PySSLContext ) args;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2890 PySSLSocket *ssl;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2891 PyObject *servername_o;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2892 PyObject *servername_idna;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2893 PyObject *result;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2894 /* The high-level ssl.SSLSocket object */
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2895 PyObject *ssl_socket;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2896 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
81559 8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2897 #ifdef WITH_THREAD
8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2898 PyGILState_STATE gstate = PyGILState_Ensure();
8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2899 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2900
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2901 if (ssl_ctx->set_hostname == NULL) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2902 /* remove race condition in this the call back while if removing the
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2903 * callback is in progress */
81559 8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2904 #ifdef WITH_THREAD
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2905 PyGILState_Release(gstate);
81559 8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2906 #endif
81299 52b4d9bfc9ea Fix returning uninitialized variable (issue #8109). Antoine Pitrou <solipsis@pitrou.net> parents: 81298 diff changeset	2907 return SSL_TLSEXT_ERR_OK;
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2908 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2909
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2910 ssl = SSL_get_app_data(s);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2911 assert(PySSLSocket_Check(ssl));
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2912 ssl_socket = PyWeakref_GetObject(ssl->Socket);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2913 Py_INCREF(ssl_socket);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2914 if (ssl_socket == Py_None) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2915 goto error;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2916 }
84334 28f47a5d59b9 _ssl.c: strip trailing spaces Victor Stinner <victor.stinner@gmail.com> parents: 84333 diff changeset	2917
83251 4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2918 if (servername == NULL) {
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2919 result = PyObject_CallFunctionObjArgs(ssl_ctx->set_hostname, ssl_socket,
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2920 Py_None, ssl_ctx, NULL);
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2921 }
83251 4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2922 else {
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2923 servername_o = PyBytes_FromString(servername);
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2924 if (servername_o == NULL) {
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2925 PyErr_WriteUnraisable((PyObject *) ssl_ctx);
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2926 goto error;
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2927 }
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2928 servername_idna = PyUnicode_FromEncodedObject(servername_o, "idna", NULL);
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2929 if (servername_idna == NULL) {
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2930 PyErr_WriteUnraisable(servername_o);
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2931 Py_DECREF(servername_o);
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2932 goto error;
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2933 }
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2934 Py_DECREF(servername_o);
83251 4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2935 result = PyObject_CallFunctionObjArgs(ssl_ctx->set_hostname, ssl_socket,
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2936 servername_idna, ssl_ctx, NULL);
4ae6095b4638 Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name. Antoine Pitrou <solipsis@pitrou.net> parents: 83026 diff changeset	2937 Py_DECREF(servername_idna);
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2938 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2939 Py_DECREF(ssl_socket);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2940
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2941 if (result == NULL) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2942 PyErr_WriteUnraisable(ssl_ctx->set_hostname);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2943 *al = SSL_AD_HANDSHAKE_FAILURE;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2944 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2945 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2946 else {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2947 if (result != Py_None) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2948 *al = (int) PyLong_AsLong(result);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2949 if (PyErr_Occurred()) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2950 PyErr_WriteUnraisable(result);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2951 *al = SSL_AD_INTERNAL_ERROR;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2952 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2953 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2954 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2955 else {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2956 ret = SSL_TLSEXT_ERR_OK;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2957 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2958 Py_DECREF(result);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2959 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2960
81559 8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2961 #ifdef WITH_THREAD
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2962 PyGILState_Release(gstate);
81559 8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2963 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2964 return ret;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2965
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2966 error:
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2967 Py_DECREF(ssl_socket);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2968 *al = SSL_AD_INTERNAL_ERROR;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2969 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
81559 8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2970 #ifdef WITH_THREAD
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2971 PyGILState_Release(gstate);
81559 8630fa732cf6 Issue #16982: Fix --without-threads build failure. Stefan Krah <skrah@bytereef.org> parents: 81464 diff changeset	2972 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2973 return ret;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2974 }
83024 fc4f68b51ba0 Fix previous fix (the cause was actually a misplaced #endif, or so it seems) Antoine Pitrou <solipsis@pitrou.net> parents: 83023 diff changeset	2975 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2976
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2977 PyDoc_STRVAR(PySSL_set_servername_callback_doc,
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2978 "set_servername_callback(method)\n\
83025 b45630913715 Improve set_servername_callback docstring. Antoine Pitrou <solipsis@pitrou.net> parents: 83024 diff changeset	2979 \n\
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2980 This sets a callback that will be called when a server name is provided by\n\
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2981 the SSL/TLS client in the SNI extension.\n\
83025 b45630913715 Improve set_servername_callback docstring. Antoine Pitrou <solipsis@pitrou.net> parents: 83024 diff changeset	2982 \n\
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2983 If the argument is None then the callback is disabled. The method is called\n\
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2984 with the SSLSocket, the server name as a string, and the SSLContext object.\n\
83025 b45630913715 Improve set_servername_callback docstring. Antoine Pitrou <solipsis@pitrou.net> parents: 83024 diff changeset	2985 See RFC 6066 for details of the SNI extension.");
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2986
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2987 static PyObject *
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2988 set_servername_callback(PySSLContext self, PyObject args)
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2989 {
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	2990 #if HAVE_SNI && !defined(OPENSSL_NO_TLSEXT)
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2991 PyObject *cb;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2992
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2993 if (!PyArg_ParseTuple(args, "O", &cb))
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2994 return NULL;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2995
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2996 Py_CLEAR(self->set_hostname);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2997 if (cb == Py_None) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2998 SSL_CTX_set_tlsext_servername_callback(self->ctx, NULL);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	2999 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3000 else {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3001 if (!PyCallable_Check(cb)) {
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3002 SSL_CTX_set_tlsext_servername_callback(self->ctx, NULL);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3003 PyErr_SetString(PyExc_TypeError,
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3004 "not a callable object");
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3005 return NULL;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3006 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3007 Py_INCREF(cb);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3008 self->set_hostname = cb;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3009 SSL_CTX_set_tlsext_servername_callback(self->ctx, _servername_callback);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3010 SSL_CTX_set_tlsext_servername_arg(self->ctx, self);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3011 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3012 Py_RETURN_NONE;
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3013 #else
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3014 PyErr_SetString(PyExc_NotImplementedError,
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3015 "The TLS extension servername callback, "
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3016 "SSL_CTX_set_tlsext_servername_callback, "
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3017 "is not in the current OpenSSL library.");
83023 ad9effdc0ac3 Further compiling fixes (issue #17581) Antoine Pitrou <solipsis@pitrou.net> parents: 83021 diff changeset	3018 return NULL;
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3019 #endif
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3020 }
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3021
84185 38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3022 PyDoc_STRVAR(PySSL_get_stats_doc,
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3023 "cert_store_stats() -> {'crl': int, 'x509_ca': int, 'x509': int}\n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3024 \n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3025 Returns quantities of loaded X.509 certificates. X.509 certificates with a\n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3026 CA extension and certificate revocation lists inside the context's cert\n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3027 store.\n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3028 NOTE: Certificates in a capath directory aren't loaded unless they have\n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3029 been used at least once.");
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3030
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3031 static PyObject *
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3032 cert_store_stats(PySSLContext *self)
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3033 {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3034 X509_STORE *store;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3035 X509_OBJECT *obj;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3036 int x509 = 0, crl = 0, pkey = 0, ca = 0, i;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3037
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3038 store = SSL_CTX_get_cert_store(self->ctx);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3039 for (i = 0; i < sk_X509_OBJECT_num(store->objs); i++) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3040 obj = sk_X509_OBJECT_value(store->objs, i);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3041 switch (obj->type) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3042 case X509_LU_X509:
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3043 x509++;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3044 if (X509_check_ca(obj->data.x509)) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3045 ca++;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3046 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3047 break;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3048 case X509_LU_CRL:
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3049 crl++;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3050 break;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3051 case X509_LU_PKEY:
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3052 pkey++;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3053 break;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3054 default:
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3055 /* Ignore X509_LU_FAIL, X509_LU_RETRY, X509_LU_PKEY.
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3056 * As far as I can tell they are internal states and never
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3057 * stored in a cert store */
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3058 break;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3059 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3060 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3061 return Py_BuildValue("{sisisi}", "x509", x509, "crl", crl,
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3062 "x509_ca", ca);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3063 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3064
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3065 PyDoc_STRVAR(PySSL_get_ca_certs_doc,
87331 ae0734493f6b Issue #18147: Add missing documentation for SSLContext.get_ca_certs(). Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	3066 "get_ca_certs(binary_form=False) -> list of loaded certificate\n\
84185 38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3067 \n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3068 Returns a list of dicts with information of loaded CA certs. If the\n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3069 optional argument is True, returns a DER-encoded copy of the CA certificate.\n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3070 NOTE: Certificates in a capath directory aren't loaded unless they have\n\
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3071 been used at least once.");
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3072
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3073 static PyObject *
87331 ae0734493f6b Issue #18147: Add missing documentation for SSLContext.get_ca_certs(). Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	3074 get_ca_certs(PySSLContext self, PyObject args, PyObject *kwds)
84185 38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3075 {
87331 ae0734493f6b Issue #18147: Add missing documentation for SSLContext.get_ca_certs(). Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	3076 char *kwlist[] = {"binary_form", NULL};
84185 38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3077 X509_STORE *store;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3078 PyObject ci = NULL, rlist = NULL;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3079 int i;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3080 int binary_mode = 0;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3081
87331 ae0734493f6b Issue #18147: Add missing documentation for SSLContext.get_ca_certs(). Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	3082 if (!PyArg_ParseTupleAndKeywords(args, kwds, "\|p:get_ca_certs",
ae0734493f6b Issue #18147: Add missing documentation for SSLContext.get_ca_certs(). Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	3083 kwlist, &binary_mode)) {
84185 38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3084 return NULL;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3085 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3086
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3087 if ((rlist = PyList_New(0)) == NULL) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3088 return NULL;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3089 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3090
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3091 store = SSL_CTX_get_cert_store(self->ctx);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3092 for (i = 0; i < sk_X509_OBJECT_num(store->objs); i++) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3093 X509_OBJECT *obj;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3094 X509 *cert;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3095
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3096 obj = sk_X509_OBJECT_value(store->objs, i);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3097 if (obj->type != X509_LU_X509) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3098 /* not a x509 cert */
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3099 continue;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3100 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3101 /* CA for any purpose */
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3102 cert = obj->data.x509;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3103 if (!X509_check_ca(cert)) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3104 continue;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3105 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3106 if (binary_mode) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3107 ci = _certificate_to_der(cert);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3108 } else {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3109 ci = _decode_certificate(cert);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3110 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3111 if (ci == NULL) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3112 goto error;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3113 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3114 if (PyList_Append(rlist, ci) == -1) {
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3115 goto error;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3116 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3117 Py_CLEAR(ci);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3118 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3119 return rlist;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3120
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3121 error:
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3122 Py_XDECREF(ci);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3123 Py_XDECREF(rlist);
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3124 return NULL;
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3125 }
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3126
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3127
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3128 static PyGetSetDef context_getsetlist[] = {
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	3129 {"check_hostname", (getter) get_check_hostname,
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87623 diff changeset	3130 (setter) set_check_hostname, NULL},
61782 5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	3131 {"options", (getter) get_options,
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	3132 (setter) set_options, NULL},
87397 40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	3133 #ifdef HAVE_OPENSSL_VERIFY_PARAM
87320 83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3134 {"verify_flags", (getter) get_verify_flags,
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3135 (setter) set_verify_flags, NULL},
87397 40d4be2b7258 Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ Christian Heimes <christian@cheimes.de> parents: 87344 diff changeset	3136 #endif
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3137 {"verify_mode", (getter) get_verify_mode,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3138 (setter) set_verify_mode, NULL},
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3139 {NULL}, /* sentinel */
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3140 };
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3141
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3142 static struct PyMethodDef context_methods[] = {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3143 {"_wrap_socket", (PyCFunction) context_wrap_socket,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3144 METH_VARARGS \| METH_KEYWORDS, NULL},
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3145 {"set_ciphers", (PyCFunction) set_ciphers,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3146 METH_VARARGS, NULL},
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	3147 {"_set_npn_protocols", (PyCFunction) _set_npn_protocols,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	3148 METH_VARARGS, NULL},
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3149 {"load_cert_chain", (PyCFunction) load_cert_chain,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3150 METH_VARARGS \| METH_KEYWORDS, NULL},
74129 33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	3151 {"load_dh_params", (PyCFunction) load_dh_params,
33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	3152 METH_O, NULL},
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3153 {"load_verify_locations", (PyCFunction) load_verify_locations,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3154 METH_VARARGS \| METH_KEYWORDS, NULL},
65223 9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	3155 {"session_stats", (PyCFunction) session_stats,
9c723afa44da Issue #10075: Add a session_stats() method to SSLContext objects. Antoine Pitrou <solipsis@pitrou.net> parents: 64403 diff changeset	3156 METH_NOARGS, NULL},
66217 7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	3157 {"set_default_verify_paths", (PyCFunction) set_default_verify_paths,
7826d907b765 Issue #10443: Add the SSLContext.set_default_verify_paths() method. Antoine Pitrou <solipsis@pitrou.net> parents: 66114 diff changeset	3158 METH_NOARGS, NULL},
74103 ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	3159 #ifndef OPENSSL_NO_ECDH
74084 8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	3160 {"set_ecdh_curve", (PyCFunction) set_ecdh_curve,
8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	3161 METH_O, NULL},
74103 ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	3162 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3163 {"set_servername_callback", (PyCFunction) set_servername_callback,
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3164 METH_VARARGS, PySSL_set_servername_callback_doc},
84185 38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3165 {"cert_store_stats", (PyCFunction) cert_store_stats,
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3166 METH_NOARGS, PySSL_get_stats_doc},
38e759e4c9e6 Issue #18147: Add diagnostic functions to ssl.SSLContext(). Christian Heimes <christian@cheimes.de> parents: 84119 diff changeset	3167 {"get_ca_certs", (PyCFunction) get_ca_certs,
87331 ae0734493f6b Issue #18147: Add missing documentation for SSLContext.get_ca_certs(). Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	3168 METH_VARARGS \| METH_KEYWORDS, PySSL_get_ca_certs_doc},
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3169 {NULL, NULL} /* sentinel */
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3170 };
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3171
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3172 static PyTypeObject PySSLContext_Type = {
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3173 PyVarObject_HEAD_INIT(NULL, 0)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3174 "_ssl._SSLContext", /tp_name/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3175 sizeof(PySSLContext), /tp_basicsize/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3176 0, /tp_itemsize/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3177 (destructor)context_dealloc, /tp_dealloc/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3178 0, /tp_print/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3179 0, /tp_getattr/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3180 0, /tp_setattr/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3181 0, /tp_reserved/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3182 0, /tp_repr/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3183 0, /tp_as_number/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3184 0, /tp_as_sequence/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3185 0, /tp_as_mapping/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3186 0, /tp_hash/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3187 0, /tp_call/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3188 0, /tp_str/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3189 0, /tp_getattro/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3190 0, /tp_setattro/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3191 0, /tp_as_buffer/
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3192 Py_TPFLAGS_DEFAULT \| Py_TPFLAGS_BASETYPE \| Py_TPFLAGS_HAVE_GC, /tp_flags/
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3193 0, /tp_doc/
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3194 (traverseproc) context_traverse, /tp_traverse/
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3195 (inquiry) context_clear, /tp_clear/
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3196 0, /tp_richcompare/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3197 0, /tp_weaklistoffset/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3198 0, /tp_iter/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3199 0, /tp_iternext/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3200 context_methods, /tp_methods/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3201 0, /tp_members/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3202 context_getsetlist, /tp_getset/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3203 0, /tp_base/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3204 0, /tp_dict/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3205 0, /tp_descr_get/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3206 0, /tp_descr_set/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3207 0, /tp_dictoffset/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3208 0, /tp_init/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3209 0, /tp_alloc/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3210 context_new, /tp_new/
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3211 };
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3212
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3213
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3214
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3215 #ifdef HAVE_OPENSSL_RAND
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3216
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3217 /* helper routines for seeding the SSL PRNG */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3218 static PyObject *
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3219 PySSL_RAND_add(PyObject self, PyObject args)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3220 {
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3221 char *buf;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3222 int len;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3223 double entropy;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3224
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3225 if (!PyArg_ParseTuple(args, "s#d:RAND_add", &buf, &len, &entropy))
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	3226 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3227 RAND_add(buf, len, entropy);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3228 Py_INCREF(Py_None);
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3229 return Py_None;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3230 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3231
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	3232 PyDoc_STRVAR(PySSL_RAND_add_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3233 "RAND_add(string, entropy)\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3234 \n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3235 Mix string into the OpenSSL PRNG state. entropy (a float) is a lower\n\
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3236 bound on the entropy contained in string. See RFC 1750.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3237
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3238 static PyObject *
70328 5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3239 PySSL_RAND(int len, int pseudo)
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3240 {
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3241 int ok;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3242 PyObject *bytes;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3243 unsigned long err;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3244 const char *errstr;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3245 PyObject *v;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3246
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3247 bytes = PyBytes_FromStringAndSize(NULL, len);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3248 if (bytes == NULL)
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3249 return NULL;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3250 if (pseudo) {
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3251 ok = RAND_pseudo_bytes((unsigned char*)PyBytes_AS_STRING(bytes), len);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3252 if (ok == 0 \|\| ok == 1)
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3253 return Py_BuildValue("NO", bytes, ok == 1 ? Py_True : Py_False);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3254 }
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3255 else {
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3256 ok = RAND_bytes((unsigned char*)PyBytes_AS_STRING(bytes), len);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3257 if (ok == 1)
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3258 return bytes;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3259 }
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3260 Py_DECREF(bytes);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3261
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3262 err = ERR_get_error();
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3263 errstr = ERR_reason_error_string(err);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3264 v = Py_BuildValue("(ks)", err, errstr);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3265 if (v != NULL) {
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3266 PyErr_SetObject(PySSLErrorObject, v);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3267 Py_DECREF(v);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3268 }
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3269 return NULL;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3270 }
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3271
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3272 static PyObject *
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3273 PySSL_RAND_bytes(PyObject self, PyObject args)
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3274 {
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3275 int len;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3276 if (!PyArg_ParseTuple(args, "i:RAND_bytes", &len))
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3277 return NULL;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3278 return PySSL_RAND(len, 0);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3279 }
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3280
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3281 PyDoc_STRVAR(PySSL_RAND_bytes_doc,
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3282 "RAND_bytes(n) -> bytes\n\
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3283 \n\
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3284 Generate n cryptographically strong pseudo-random bytes.");
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3285
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3286 static PyObject *
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3287 PySSL_RAND_pseudo_bytes(PyObject self, PyObject args)
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3288 {
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3289 int len;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3290 if (!PyArg_ParseTuple(args, "i:RAND_pseudo_bytes", &len))
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3291 return NULL;
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3292 return PySSL_RAND(len, 1);
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3293 }
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3294
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3295 PyDoc_STRVAR(PySSL_RAND_pseudo_bytes_doc,
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3296 "RAND_pseudo_bytes(n) -> (bytes, is_cryptographic)\n\
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3297 \n\
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3298 Generate n pseudo-random bytes. is_cryptographic is True if the bytes\
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3299 generated are cryptographically strong.");
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3300
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3301 static PyObject *
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3302 PySSL_RAND_status(PyObject *self)
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3303 {
44099 f324631462a2 Cleanup: Replaced most PyInt_ aliases with PyLong_ and disabled the aliases in intobject.h Christian Heimes <christian@cheimes.de> parents: 43948 diff changeset	3304 return PyLong_FromLong(RAND_status());
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3305 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3306
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	3307 PyDoc_STRVAR(PySSL_RAND_status_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3308 "RAND_status() -> 0 or 1\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3309 \n\
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	3310 Returns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\n\
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	3311 It is necessary to seed the PRNG with RAND_add() on some platforms before\n\
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	3312 using the ssl() function.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3313
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3314 static PyObject *
61641 a09eb3d59ff7 Issue #8477: ssl.RAND_egd() supports str with surrogates and bytes for the path Victor Stinner <victor.stinner@haypocalc.com> parents: 61639 diff changeset	3315 PySSL_RAND_egd(PyObject self, PyObject args)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3316 {
61641 a09eb3d59ff7 Issue #8477: ssl.RAND_egd() supports str with surrogates and bytes for the path Victor Stinner <victor.stinner@haypocalc.com> parents: 61639 diff changeset	3317 PyObject *path;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3318 int bytes;
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3319
78983 827bb0554f1f Closes #15793: Stack corruption in ssl.RAND_egd() Jesus Cea <jcea@jcea.es> parents: 78604 diff changeset	3320 if (!PyArg_ParseTuple(args, "O&:RAND_egd",
61641 a09eb3d59ff7 Issue #8477: ssl.RAND_egd() supports str with surrogates and bytes for the path Victor Stinner <victor.stinner@haypocalc.com> parents: 61639 diff changeset	3321 PyUnicode_FSConverter, &path))
a09eb3d59ff7 Issue #8477: ssl.RAND_egd() supports str with surrogates and bytes for the path Victor Stinner <victor.stinner@haypocalc.com> parents: 61639 diff changeset	3322 return NULL;
a09eb3d59ff7 Issue #8477: ssl.RAND_egd() supports str with surrogates and bytes for the path Victor Stinner <victor.stinner@haypocalc.com> parents: 61639 diff changeset	3323
a09eb3d59ff7 Issue #8477: ssl.RAND_egd() supports str with surrogates and bytes for the path Victor Stinner <victor.stinner@haypocalc.com> parents: 61639 diff changeset	3324 bytes = RAND_egd(PyBytes_AsString(path));
a09eb3d59ff7 Issue #8477: ssl.RAND_egd() supports str with surrogates and bytes for the path Victor Stinner <victor.stinner@haypocalc.com> parents: 61639 diff changeset	3325 Py_DECREF(path);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3326 if (bytes == -1) {
61537 330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	3327 PyErr_SetString(PySSLErrorObject,
330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	3328 "EGD connection failed or EGD did not return "
330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	3329 "enough data to seed the PRNG");
330273ec6028 Merged revisions 81116 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61246 diff changeset	3330 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3331 }
44099 f324631462a2 Cleanup: Replaced most PyInt_ aliases with PyLong_ and disabled the aliases in intobject.h Christian Heimes <christian@cheimes.de> parents: 43948 diff changeset	3332 return PyLong_FromLong(bytes);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3333 }
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3334
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	3335 PyDoc_STRVAR(PySSL_RAND_egd_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3336 "RAND_egd(path) -> bytes\n\
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3337 \n\
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3338 Queries the entropy gather daemon (EGD) on the socket named by 'path'.\n\
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3339 Returns number of bytes read. Raises SSLError if connection to EGD\n\
85236 ae91252943bf Issue 18768: Correct doc string of RAND_edg(). Patch by Vajrasky Kok. Christian Heimes <christian@cheimes.de> parents: 85233 diff changeset	3340 fails or if it does not provide enough data to seed PRNG.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3341
85290 8e1194c39bed Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork. Christian Heimes <christian@cheimes.de> parents: 85263 diff changeset	3342 #endif /* HAVE_OPENSSL_RAND */
8e1194c39bed Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork. Christian Heimes <christian@cheimes.de> parents: 85263 diff changeset	3343
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3344
84068 a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3345 PyDoc_STRVAR(PySSL_get_default_verify_paths_doc,
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3346 "get_default_verify_paths() -> tuple\n\
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3347 \n\
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3348 Return search paths and environment vars that are used by SSLContext's\n\
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3349 set_default_verify_paths() to load default CAs. The values are\n\
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3350 'cert_file_env', 'cert_file', 'cert_dir_env', 'cert_dir'.");
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3351
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3352 static PyObject *
84119 5f7e12eb65b8 Simplify return value of ssl.get_default_verify_paths Christian Heimes <christian@cheimes.de> parents: 84077 diff changeset	3353 PySSL_get_default_verify_paths(PyObject *self)
84068 a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3354 {
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3355 PyObject *ofile_env = NULL;
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3356 PyObject *ofile = NULL;
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3357 PyObject *odir_env = NULL;
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3358 PyObject *odir = NULL;
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3359
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3360 #define convert(info, target) { \
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3361 const char *tmp = (info); \
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3362 target = NULL; \
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3363 if (!tmp) { Py_INCREF(Py_None); target = Py_None; } \
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3364 else if ((target = PyUnicode_DecodeFSDefault(tmp)) == NULL) { \
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3365 target = PyBytes_FromString(tmp); } \
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3366 if (!target) goto error; \
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3367 } while(0)
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3368
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3369 convert(X509_get_default_cert_file_env(), ofile_env);
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3370 convert(X509_get_default_cert_file(), ofile);
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3371 convert(X509_get_default_cert_dir_env(), odir_env);
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3372 convert(X509_get_default_cert_dir(), odir);
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3373 #undef convert
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3374
84119 5f7e12eb65b8 Simplify return value of ssl.get_default_verify_paths Christian Heimes <christian@cheimes.de> parents: 84077 diff changeset	3375 return Py_BuildValue("NNNN", ofile_env, ofile, odir_env, odir);
84068 a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3376
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3377 error:
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3378 Py_XDECREF(ofile_env);
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3379 Py_XDECREF(ofile);
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3380 Py_XDECREF(odir_env);
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3381 Py_XDECREF(odir);
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3382 return NULL;
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3383 }
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3384
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3385 static PyObject*
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3386 asn1obj2py(ASN1_OBJECT *obj)
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3387 {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3388 int nid;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3389 const char ln, sn;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3390 char buf[100];
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3391 int buflen;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3392
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3393 nid = OBJ_obj2nid(obj);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3394 if (nid == NID_undef) {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3395 PyErr_Format(PyExc_ValueError, "Unknown object");
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3396 return NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3397 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3398 sn = OBJ_nid2sn(nid);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3399 ln = OBJ_nid2ln(nid);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3400 buflen = OBJ_obj2txt(buf, sizeof(buf), obj, 1);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3401 if (buflen < 0) {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3402 _setSSLError(NULL, 0, __FILE__, __LINE__);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3403 return NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3404 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3405 if (buflen) {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3406 return Py_BuildValue("isss#", nid, sn, ln, buf, buflen);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3407 } else {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3408 return Py_BuildValue("issO", nid, sn, ln, Py_None);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3409 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3410 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3411
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3412 PyDoc_STRVAR(PySSL_txt2obj_doc,
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3413 "txt2obj(txt, name=False) -> (nid, shortname, longname, oid)\n\
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3414 \n\
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3415 Lookup NID, short name, long name and OID of an ASN1_OBJECT. By default\n\
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3416 objects are looked up by OID. With name=True short and long name are also\n\
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3417 matched.");
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3418
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3419 static PyObject*
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3420 PySSL_txt2obj(PyObject self, PyObject args, PyObject *kwds)
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3421 {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3422 char *kwlist[] = {"txt", "name", NULL};
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3423 PyObject *result = NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3424 char *txt;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3425 int name = 0;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3426 ASN1_OBJECT *obj;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3427
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3428 if (!PyArg_ParseTupleAndKeywords(args, kwds, "s\|p:txt2obj",
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3429 kwlist, &txt, &name)) {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3430 return NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3431 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3432 obj = OBJ_txt2obj(txt, name ? 0 : 1);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3433 if (obj == NULL) {
87344 7d914d4b05fe Issue #19448: report name / NID in exception message of ASN1Object Christian Heimes <christian@cheimes.de> parents: 87331 diff changeset	3434 PyErr_Format(PyExc_ValueError, "unknown object '%.100s'", txt);
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3435 return NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3436 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3437 result = asn1obj2py(obj);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3438 ASN1_OBJECT_free(obj);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3439 return result;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3440 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3441
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3442 PyDoc_STRVAR(PySSL_nid2obj_doc,
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3443 "nid2obj(nid) -> (nid, shortname, longname, oid)\n\
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3444 \n\
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3445 Lookup NID, short name, long name and OID of an ASN1_OBJECT by NID.");
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3446
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3447 static PyObject*
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3448 PySSL_nid2obj(PyObject self, PyObject args)
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3449 {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3450 PyObject *result = NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3451 int nid;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3452 ASN1_OBJECT *obj;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3453
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3454 if (!PyArg_ParseTuple(args, "i:nid2obj", &nid)) {
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3455 return NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3456 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3457 if (nid < NID_undef) {
87344 7d914d4b05fe Issue #19448: report name / NID in exception message of ASN1Object Christian Heimes <christian@cheimes.de> parents: 87331 diff changeset	3458 PyErr_SetString(PyExc_ValueError, "NID must be positive.");
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3459 return NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3460 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3461 obj = OBJ_nid2obj(nid);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3462 if (obj == NULL) {
87344 7d914d4b05fe Issue #19448: report name / NID in exception message of ASN1Object Christian Heimes <christian@cheimes.de> parents: 87331 diff changeset	3463 PyErr_Format(PyExc_ValueError, "unknown NID %i", nid);
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3464 return NULL;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3465 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3466 result = asn1obj2py(obj);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3467 ASN1_OBJECT_free(obj);
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3468 return result;
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3469 }
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3470
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3471 #ifdef _MSC_VER
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3472
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3473 static PyObject*
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3474 certEncodingType(DWORD encodingType)
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3475 {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3476 static PyObject *x509_asn = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3477 static PyObject *pkcs_7_asn = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3478
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3479 if (x509_asn == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3480 x509_asn = PyUnicode_InternFromString("x509_asn");
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3481 if (x509_asn == NULL)
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3482 return NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3483 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3484 if (pkcs_7_asn == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3485 pkcs_7_asn = PyUnicode_InternFromString("pkcs_7_asn");
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3486 if (pkcs_7_asn == NULL)
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3487 return NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3488 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3489 switch(encodingType) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3490 case X509_ASN_ENCODING:
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3491 Py_INCREF(x509_asn);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3492 return x509_asn;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3493 case PKCS_7_ASN_ENCODING:
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3494 Py_INCREF(pkcs_7_asn);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3495 return pkcs_7_asn;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3496 default:
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3497 return PyLong_FromLong(encodingType);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3498 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3499 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3500
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3501 static PyObject*
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3502 parseKeyUsage(PCCERT_CONTEXT pCertCtx, DWORD flags)
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3503 {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3504 CERT_ENHKEY_USAGE *usage;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3505 DWORD size, error, i;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3506 PyObject *retval;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3507
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3508 if (!CertGetEnhancedKeyUsage(pCertCtx, flags, NULL, &size)) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3509 error = GetLastError();
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3510 if (error == CRYPT_E_NOT_FOUND) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3511 Py_RETURN_TRUE;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3512 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3513 return PyErr_SetFromWindowsErr(error);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3514 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3515
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3516 usage = (CERT_ENHKEY_USAGE*)PyMem_Malloc(size);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3517 if (usage == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3518 return PyErr_NoMemory();
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3519 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3520
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3521 /* Now get the actual enhanced usage property */
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3522 if (!CertGetEnhancedKeyUsage(pCertCtx, flags, usage, &size)) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3523 PyMem_Free(usage);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3524 error = GetLastError();
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3525 if (error == CRYPT_E_NOT_FOUND) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3526 Py_RETURN_TRUE;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3527 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3528 return PyErr_SetFromWindowsErr(error);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3529 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3530 retval = PySet_New(NULL);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3531 if (retval == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3532 goto error;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3533 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3534 for (i = 0; i < usage->cUsageIdentifier; ++i) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3535 if (usage->rgpszUsageIdentifier[i]) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3536 PyObject *oid;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3537 int err;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3538 oid = PyUnicode_FromString(usage->rgpszUsageIdentifier[i]);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3539 if (oid == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3540 Py_CLEAR(retval);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3541 goto error;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3542 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3543 err = PySet_Add(retval, oid);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3544 Py_DECREF(oid);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3545 if (err == -1) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3546 Py_CLEAR(retval);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3547 goto error;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3548 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3549 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3550 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3551 error:
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3552 PyMem_Free(usage);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3553 return retval;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3554 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3555
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3556 PyDoc_STRVAR(PySSL_enum_certificates_doc,
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3557 "enum_certificates(store_name) -> []\n\
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3558 \n\
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3559 Retrieve certificates from Windows' cert store. store_name may be one of\n\
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3560 'CA', 'ROOT' or 'MY'. The system may provide more cert storages, too.\n\
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3561 The function returns a list of (bytes, encoding_type, trust) tuples. The\n\
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3562 encoding_type flag can be interpreted with X509_ASN_ENCODING or\n\
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3563 PKCS_7_ASN_ENCODING. The trust setting is either a set of OIDs or the\n\
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3564 boolean True.");
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3565
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3566 static PyObject *
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3567 PySSL_enum_certificates(PyObject self, PyObject args, PyObject *kwds)
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3568 {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3569 char *kwlist[] = {"store_name", NULL};
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3570 char *store_name;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3571 HCERTSTORE hStore = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3572 PCCERT_CONTEXT pCertCtx = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3573 PyObject keyusage = NULL, cert = NULL, enc = NULL, tup = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3574 PyObject *result = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3575
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3576 if (!PyArg_ParseTupleAndKeywords(args, kwds, "s\|s:enum_certificates",
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3577 kwlist, &store_name)) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3578 return NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3579 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3580 result = PyList_New(0);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3581 if (result == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3582 return NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3583 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3584 hStore = CertOpenSystemStore((HCRYPTPROV)NULL, store_name);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3585 if (hStore == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3586 Py_DECREF(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3587 return PyErr_SetFromWindowsErr(GetLastError());
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3588 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3589
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3590 while (pCertCtx = CertEnumCertificatesInStore(hStore, pCertCtx)) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3591 cert = PyBytes_FromStringAndSize((const char*)pCertCtx->pbCertEncoded,
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3592 pCertCtx->cbCertEncoded);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3593 if (!cert) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3594 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3595 break;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3596 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3597 if ((enc = certEncodingType(pCertCtx->dwCertEncodingType)) == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3598 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3599 break;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3600 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3601 keyusage = parseKeyUsage(pCertCtx, CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3602 if (keyusage == Py_True) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3603 Py_DECREF(keyusage);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3604 keyusage = parseKeyUsage(pCertCtx, CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3605 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3606 if (keyusage == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3607 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3608 break;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3609 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3610 if ((tup = PyTuple_New(3)) == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3611 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3612 break;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3613 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3614 PyTuple_SET_ITEM(tup, 0, cert);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3615 cert = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3616 PyTuple_SET_ITEM(tup, 1, enc);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3617 enc = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3618 PyTuple_SET_ITEM(tup, 2, keyusage);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3619 keyusage = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3620 if (PyList_Append(result, tup) < 0) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3621 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3622 break;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3623 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3624 Py_CLEAR(tup);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3625 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3626 if (pCertCtx) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3627 /* loop ended with an error, need to clean up context manually */
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3628 CertFreeCertificateContext(pCertCtx);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3629 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3630
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3631 /* In error cases cert, enc and tup may not be NULL */
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3632 Py_XDECREF(cert);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3633 Py_XDECREF(enc);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3634 Py_XDECREF(keyusage);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3635 Py_XDECREF(tup);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3636
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3637 if (!CertCloseStore(hStore, 0)) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3638 /* This error case might shadow another exception.*/
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3639 Py_XDECREF(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3640 return PyErr_SetFromWindowsErr(GetLastError());
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3641 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3642 return result;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3643 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3644
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3645 PyDoc_STRVAR(PySSL_enum_crls_doc,
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3646 "enum_crls(store_name) -> []\n\
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3647 \n\
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3648 Retrieve CRLs from Windows' cert store. store_name may be one of\n\
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3649 'CA', 'ROOT' or 'MY'. The system may provide more cert storages, too.\n\
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3650 The function returns a list of (bytes, encoding_type) tuples. The\n\
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3651 encoding_type flag can be interpreted with X509_ASN_ENCODING or\n\
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3652 PKCS_7_ASN_ENCODING.");
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3653
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3654 static PyObject *
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3655 PySSL_enum_crls(PyObject self, PyObject args, PyObject *kwds)
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3656 {
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3657 char *kwlist[] = {"store_name", NULL};
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3658 char *store_name;
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3659 HCERTSTORE hStore = NULL;
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3660 PCCRL_CONTEXT pCrlCtx = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3661 PyObject crl = NULL, enc = NULL, *tup = NULL;
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3662 PyObject *result = NULL;
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3663
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3664 if (!PyArg_ParseTupleAndKeywords(args, kwds, "s\|s:enum_crls",
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3665 kwlist, &store_name)) {
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3666 return NULL;
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3667 }
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3668 result = PyList_New(0);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3669 if (result == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3670 return NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3671 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3672 hStore = CertOpenSystemStore((HCRYPTPROV)NULL, store_name);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3673 if (hStore == NULL) {
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3674 Py_DECREF(result);
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3675 return PyErr_SetFromWindowsErr(GetLastError());
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3676 }
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3677
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3678 while (pCrlCtx = CertEnumCRLsInStore(hStore, pCrlCtx)) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3679 crl = PyBytes_FromStringAndSize((const char*)pCrlCtx->pbCrlEncoded,
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3680 pCrlCtx->cbCrlEncoded);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3681 if (!crl) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3682 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3683 break;
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3684 }
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3685 if ((enc = certEncodingType(pCrlCtx->dwCertEncodingType)) == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3686 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3687 break;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3688 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3689 if ((tup = PyTuple_New(2)) == NULL) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3690 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3691 break;
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3692 }
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3693 PyTuple_SET_ITEM(tup, 0, crl);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3694 crl = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3695 PyTuple_SET_ITEM(tup, 1, enc);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3696 enc = NULL;
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3697
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3698 if (PyList_Append(result, tup) < 0) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3699 Py_CLEAR(result);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3700 break;
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3701 }
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3702 Py_CLEAR(tup);
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3703 }
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3704 if (pCrlCtx) {
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3705 /* loop ended with an error, need to clean up context manually */
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3706 CertFreeCRLContext(pCrlCtx);
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3707 }
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3708
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3709 /* In error cases cert, enc and tup may not be NULL */
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3710 Py_XDECREF(crl);
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3711 Py_XDECREF(enc);
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3712 Py_XDECREF(tup);
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3713
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3714 if (!CertCloseStore(hStore, 0)) {
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3715 /* This error case might shadow another exception.*/
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3716 Py_XDECREF(result);
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3717 return PyErr_SetFromWindowsErr(GetLastError());
10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3718 }
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3719 return result;
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3720 }
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3721
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3722 #endif /* _MSC_VER */
48681 3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48660 diff changeset	3723
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3724 /* List of functions exported by this module. */
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3725
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3726 static PyMethodDef PySSL_methods[] = {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3727 {"_test_decode_cert", PySSL_test_decode_certificate,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3728 METH_VARARGS},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3729 #ifdef HAVE_OPENSSL_RAND
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3730 {"RAND_add", PySSL_RAND_add, METH_VARARGS,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3731 PySSL_RAND_add_doc},
70328 5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3732 {"RAND_bytes", PySSL_RAND_bytes, METH_VARARGS,
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3733 PySSL_RAND_bytes_doc},
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3734 {"RAND_pseudo_bytes", PySSL_RAND_pseudo_bytes, METH_VARARGS,
5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 69999 diff changeset	3735 PySSL_RAND_pseudo_bytes_doc},
61641 a09eb3d59ff7 Issue #8477: ssl.RAND_egd() supports str with surrogates and bytes for the path Victor Stinner <victor.stinner@haypocalc.com> parents: 61639 diff changeset	3736 {"RAND_egd", PySSL_RAND_egd, METH_VARARGS,
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3737 PySSL_RAND_egd_doc},
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3738 {"RAND_status", (PyCFunction)PySSL_RAND_status, METH_NOARGS,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3739 PySSL_RAND_status_doc},
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3740 #endif
84119 5f7e12eb65b8 Simplify return value of ssl.get_default_verify_paths Christian Heimes <christian@cheimes.de> parents: 84077 diff changeset	3741 {"get_default_verify_paths", (PyCFunction)PySSL_get_default_verify_paths,
84068 a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83918 diff changeset	3742 METH_NOARGS, PySSL_get_default_verify_paths_doc},
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3743 #ifdef _MSC_VER
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3744 {"enum_certificates", (PyCFunction)PySSL_enum_certificates,
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3745 METH_VARARGS \| METH_KEYWORDS, PySSL_enum_certificates_doc},
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3746 {"enum_crls", (PyCFunction)PySSL_enum_crls,
9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87322 diff changeset	3747 METH_VARARGS \| METH_KEYWORDS, PySSL_enum_crls_doc},
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84070 diff changeset	3748 #endif
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3749 {"txt2obj", (PyCFunction)PySSL_txt2obj,
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3750 METH_VARARGS \| METH_KEYWORDS, PySSL_txt2obj_doc},
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3751 {"nid2obj", (PyCFunction)PySSL_nid2obj,
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86806 diff changeset	3752 METH_VARARGS, PySSL_nid2obj_doc},
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3753 {NULL, NULL} /* Sentinel */
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3754 };
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3755
3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3756
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3757 #ifdef WITH_THREAD
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3758
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3759 /* an implementation of OpenSSL threading operations in terms
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3760 of the Python C thread library */
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3761
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3762 static PyThread_type_lock *_ssl_locks = NULL;
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3763
85263 f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3764 #if OPENSSL_VERSION_NUMBER >= 0x10000000
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3765 /* use new CRYPTO_THREADID API. */
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3766 static void
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3767 _ssl_threadid_callback(CRYPTO_THREADID *id)
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3768 {
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3769 CRYPTO_THREADID_set_numeric(id,
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3770 (unsigned long)PyThread_get_thread_ident());
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3771 }
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3772 #else
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3773 /* deprecated CRYPTO_set_id_callback() API. */
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3774 static unsigned long
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3775 _ssl_thread_id_function (void) {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3776 return PyThread_get_thread_ident();
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3777 }
85263 f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3778 #endif
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3779
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	3780 static void _ssl_thread_locking_function
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3781 (int mode, int n, const char *file, int line) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3782 /* this function is needed to perform locking on shared data
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3783 structures. (Note that OpenSSL uses a number of global data
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3784 structures that will be implicitly shared whenever multiple
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3785 threads use OpenSSL.) Multi-threaded applications will
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3786 crash at random if it is not set.
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3787
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3788 locking_function() must be able to handle up to
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3789 CRYPTO_num_locks() different mutex locks. It sets the n-th
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3790 lock if mode & CRYPTO_LOCK, and releases it otherwise.
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3791
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3792 file and line are the file number of the function setting the
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3793 lock. They can be useful for debugging.
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3794 */
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3795
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3796 if ((_ssl_locks == NULL) \|\|
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3797 (n < 0) \|\| ((unsigned)n >= _ssl_locks_count))
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3798 return;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3799
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3800 if (mode & CRYPTO_LOCK) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3801 PyThread_acquire_lock(_ssl_locks[n], 1);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3802 } else {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3803 PyThread_release_lock(_ssl_locks[n]);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3804 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3805 }
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3806
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3807 static int _setup_ssl_threads(void) {
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3808
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3809 unsigned int i;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3810
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3811 if (_ssl_locks == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3812 _ssl_locks_count = CRYPTO_num_locks();
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3813 _ssl_locks = (PyThread_type_lock *)
84491 41ef797e6639 Issue #18203: Replace malloc() with PyMem_Malloc() in Python modules Victor Stinner <victor.stinner@gmail.com> parents: 84334 diff changeset	3814 PyMem_Malloc(sizeof(PyThread_type_lock) * _ssl_locks_count);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3815 if (_ssl_locks == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3816 return 0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3817 memset(_ssl_locks, 0,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3818 sizeof(PyThread_type_lock) * _ssl_locks_count);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3819 for (i = 0; i < _ssl_locks_count; i++) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3820 _ssl_locks[i] = PyThread_allocate_lock();
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3821 if (_ssl_locks[i] == NULL) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3822 unsigned int j;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3823 for (j = 0; j < i; j++) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3824 PyThread_free_lock(_ssl_locks[j]);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3825 }
84491 41ef797e6639 Issue #18203: Replace malloc() with PyMem_Malloc() in Python modules Victor Stinner <victor.stinner@gmail.com> parents: 84334 diff changeset	3826 PyMem_Free(_ssl_locks);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3827 return 0;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3828 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3829 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3830 CRYPTO_set_locking_callback(_ssl_thread_locking_function);
85263 f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3831 #if OPENSSL_VERSION_NUMBER >= 0x10000000
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3832 CRYPTO_THREADID_set_callback(_ssl_threadid_callback);
f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3833 #else
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3834 CRYPTO_set_id_callback(_ssl_thread_id_function);
85263 f967ded6f9dd Issue #18777: The ssl module now uses the new CRYPTO_THREADID API of Christian Heimes <christian@cheimes.de> parents: 85236 diff changeset	3835 #endif
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3836 }
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3837 return 1;
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3838 }
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3839
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3840 #endif /* def HAVE_THREAD */
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3841
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	3842 PyDoc_STRVAR(module_doc,
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3843 "Implementation module for SSL socket operations. See the socket module\n\
23832 ed1ba37a46b7 Patch #568124: Add doc string macros. Martin v. Löwis <martin@v.loewis.de> parents: 23295 diff changeset	3844 for documentation.");
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3845
47580 94f64f11fdd0 Implement PEP 3121: new module initialization and finalization API. Martin v. Löwis <martin@v.loewis.de> parents: 47301 diff changeset	3846
94f64f11fdd0 Implement PEP 3121: new module initialization and finalization API. Martin v. Löwis <martin@v.loewis.de> parents: 47301 diff changeset	3847 static struct PyModuleDef _sslmodule = {
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3848 PyModuleDef_HEAD_INIT,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3849 "_ssl",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3850 module_doc,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3851 -1,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3852 PySSL_methods,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3853 NULL,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3854 NULL,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3855 NULL,
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3856 NULL
47580 94f64f11fdd0 Implement PEP 3121: new module initialization and finalization API. Martin v. Löwis <martin@v.loewis.de> parents: 47301 diff changeset	3857 };
94f64f11fdd0 Implement PEP 3121: new module initialization and finalization API. Martin v. Löwis <martin@v.loewis.de> parents: 47301 diff changeset	3858
71255 52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3859
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3860 static void
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3861 parse_openssl_version(unsigned long libver,
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3862 unsigned int major, unsigned int minor,
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3863 unsigned int fix, unsigned int patch,
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3864 unsigned int *status)
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3865 {
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3866 *status = libver & 0xF;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3867 libver >>= 4;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3868 *patch = libver & 0xFF;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3869 libver >>= 8;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3870 *fix = libver & 0xFF;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3871 libver >>= 8;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3872 *minor = libver & 0xFF;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3873 libver >>= 8;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3874 *major = libver & 0xFF;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3875 }
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	3876
24471 f66b3a3509c7 Excise DL_EXPORT/DL_IMPORT from Modules/. Required adding a prototype Mark Hammond <mhammond@skippinet.com.au>* parents: 24398 diff changeset	3877 PyMODINIT_FUNC
47580 94f64f11fdd0 Implement PEP 3121: new module initialization and finalization API. Martin v. Löwis <martin@v.loewis.de> parents: 47301 diff changeset	3878 PyInit__ssl(void)
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3879 {
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	3880 PyObject m, d, *r;
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	3881 unsigned long libver;
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	3882 unsigned int major, minor, fix, patch, status;
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3883 PySocketModule_APIObject *socket_api;
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	3884 struct py_ssl_error_code *errcode;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	3885 struct py_ssl_library_code *libcode;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3886
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3887 if (PyType_Ready(&PySSLContext_Type) < 0)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3888 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3889 if (PyType_Ready(&PySSLSocket_Type) < 0)
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3890 return NULL;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3891
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3892 m = PyModule_Create(&_sslmodule);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3893 if (m == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3894 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3895 d = PyModule_GetDict(m);
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3896
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3897 /* Load _socket module and its C API */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3898 socket_api = PySocketModule_ImportModuleAndAPI();
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3899 if (!socket_api)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3900 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3901 PySocketModule = *socket_api;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3902
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3903 /* Init OpenSSL */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3904 SSL_load_error_strings();
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3905 SSL_library_init();
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3906 #ifdef WITH_THREAD
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3907 /* note that this will start threading if not already started */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3908 if (!_setup_ssl_threads()) {
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3909 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3910 }
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43292 diff changeset	3911 #endif
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3912 OpenSSL_add_all_algorithms();
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	3913
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3914 /* Add symbols to module dict */
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	3915 sslerror_type_slots[0].pfunc = PyExc_OSError;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	3916 PySSLErrorObject = PyType_FromSpec(&sslerror_type_spec);
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3917 if (PySSLErrorObject == NULL)
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3918 return NULL;
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	3919
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3920 PySSLZeroReturnErrorObject = PyErr_NewExceptionWithDoc(
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3921 "ssl.SSLZeroReturnError", SSLZeroReturnError_doc,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3922 PySSLErrorObject, NULL);
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3923 PySSLWantReadErrorObject = PyErr_NewExceptionWithDoc(
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3924 "ssl.SSLWantReadError", SSLWantReadError_doc,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3925 PySSLErrorObject, NULL);
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3926 PySSLWantWriteErrorObject = PyErr_NewExceptionWithDoc(
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3927 "ssl.SSLWantWriteError", SSLWantWriteError_doc,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3928 PySSLErrorObject, NULL);
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3929 PySSLSyscallErrorObject = PyErr_NewExceptionWithDoc(
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3930 "ssl.SSLSyscallError", SSLSyscallError_doc,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3931 PySSLErrorObject, NULL);
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3932 PySSLEOFErrorObject = PyErr_NewExceptionWithDoc(
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3933 "ssl.SSLEOFError", SSLEOFError_doc,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3934 PySSLErrorObject, NULL);
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3935 if (PySSLZeroReturnErrorObject == NULL
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3936 \|\| PySSLWantReadErrorObject == NULL
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3937 \|\| PySSLWantWriteErrorObject == NULL
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3938 \|\| PySSLSyscallErrorObject == NULL
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3939 \|\| PySSLEOFErrorObject == NULL)
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3940 return NULL;
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3941 if (PyDict_SetItemString(d, "SSLError", PySSLErrorObject) != 0
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3942 \|\| PyDict_SetItemString(d, "SSLZeroReturnError", PySSLZeroReturnErrorObject) != 0
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3943 \|\| PyDict_SetItemString(d, "SSLWantReadError", PySSLWantReadErrorObject) != 0
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3944 \|\| PyDict_SetItemString(d, "SSLWantWriteError", PySSLWantWriteErrorObject) != 0
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3945 \|\| PyDict_SetItemString(d, "SSLSyscallError", PySSLSyscallErrorObject) != 0
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 73059 diff changeset	3946 \|\| PyDict_SetItemString(d, "SSLEOFError", PySSLEOFErrorObject) != 0)
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3947 return NULL;
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3948 if (PyDict_SetItemString(d, "_SSLContext",
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3949 (PyObject *)&PySSLContext_Type) != 0)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3950 return NULL;
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3951 if (PyDict_SetItemString(d, "_SSLSocket",
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 61535 diff changeset	3952 (PyObject *)&PySSLSocket_Type) != 0)
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3953 return NULL;
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3954 PyModule_AddIntConstant(m, "SSL_ERROR_ZERO_RETURN",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3955 PY_SSL_ERROR_ZERO_RETURN);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3956 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_READ",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3957 PY_SSL_ERROR_WANT_READ);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3958 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_WRITE",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3959 PY_SSL_ERROR_WANT_WRITE);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3960 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_X509_LOOKUP",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3961 PY_SSL_ERROR_WANT_X509_LOOKUP);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3962 PyModule_AddIntConstant(m, "SSL_ERROR_SYSCALL",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3963 PY_SSL_ERROR_SYSCALL);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3964 PyModule_AddIntConstant(m, "SSL_ERROR_SSL",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3965 PY_SSL_ERROR_SSL);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3966 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_CONNECT",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3967 PY_SSL_ERROR_WANT_CONNECT);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3968 /* non ssl.h errorcodes */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3969 PyModule_AddIntConstant(m, "SSL_ERROR_EOF",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3970 PY_SSL_ERROR_EOF);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3971 PyModule_AddIntConstant(m, "SSL_ERROR_INVALID_ERROR_CODE",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3972 PY_SSL_ERROR_INVALID_ERROR_CODE);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3973 /* cert requirements */
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3974 PyModule_AddIntConstant(m, "CERT_NONE",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3975 PY_SSL_CERT_NONE);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3976 PyModule_AddIntConstant(m, "CERT_OPTIONAL",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3977 PY_SSL_CERT_OPTIONAL);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3978 PyModule_AddIntConstant(m, "CERT_REQUIRED",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	3979 PY_SSL_CERT_REQUIRED);
87320 83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3980 /* CRL verification for verification_flags */
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3981 PyModule_AddIntConstant(m, "VERIFY_DEFAULT",
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3982 0);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3983 PyModule_AddIntConstant(m, "VERIFY_CRL_CHECK_LEAF",
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3984 X509_V_FLAG_CRL_CHECK);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3985 PyModule_AddIntConstant(m, "VERIFY_CRL_CHECK_CHAIN",
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3986 X509_V_FLAG_CRL_CHECK\|X509_V_FLAG_CRL_CHECK_ALL);
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3987 PyModule_AddIntConstant(m, "VERIFY_X509_STRICT",
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87311 diff changeset	3988 X509_V_FLAG_X509_STRICT);
23190 0bc3a41d4e40 Forward port of patch # 500311: Work around for buggy https servers. Martin v. Löwis <martin@v.loewis.de> parents: 21959 diff changeset	3989
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3990 /* Alert Descriptions from ssl.h */
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3991 /* note RESERVED constants no longer intended for use have been removed */
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3992 /* http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6 */
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3993
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3994 #define ADD_AD_CONSTANT(s) \
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3995 PyModule_AddIntConstant(m, "ALERT_DESCRIPTION_"#s, \
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3996 SSL_AD_##s)
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3997
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3998 ADD_AD_CONSTANT(CLOSE_NOTIFY);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	3999 ADD_AD_CONSTANT(UNEXPECTED_MESSAGE);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4000 ADD_AD_CONSTANT(BAD_RECORD_MAC);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4001 ADD_AD_CONSTANT(RECORD_OVERFLOW);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4002 ADD_AD_CONSTANT(DECOMPRESSION_FAILURE);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4003 ADD_AD_CONSTANT(HANDSHAKE_FAILURE);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4004 ADD_AD_CONSTANT(BAD_CERTIFICATE);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4005 ADD_AD_CONSTANT(UNSUPPORTED_CERTIFICATE);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4006 ADD_AD_CONSTANT(CERTIFICATE_REVOKED);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4007 ADD_AD_CONSTANT(CERTIFICATE_EXPIRED);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4008 ADD_AD_CONSTANT(CERTIFICATE_UNKNOWN);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4009 ADD_AD_CONSTANT(ILLEGAL_PARAMETER);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4010 ADD_AD_CONSTANT(UNKNOWN_CA);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4011 ADD_AD_CONSTANT(ACCESS_DENIED);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4012 ADD_AD_CONSTANT(DECODE_ERROR);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4013 ADD_AD_CONSTANT(DECRYPT_ERROR);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4014 ADD_AD_CONSTANT(PROTOCOL_VERSION);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4015 ADD_AD_CONSTANT(INSUFFICIENT_SECURITY);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4016 ADD_AD_CONSTANT(INTERNAL_ERROR);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4017 ADD_AD_CONSTANT(USER_CANCELLED);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4018 ADD_AD_CONSTANT(NO_RENEGOTIATION);
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	4019 /* Not all constants are in old OpenSSL versions */
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	4020 #ifdef SSL_AD_UNSUPPORTED_EXTENSION
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4021 ADD_AD_CONSTANT(UNSUPPORTED_EXTENSION);
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	4022 #endif
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	4023 #ifdef SSL_AD_CERTIFICATE_UNOBTAINABLE
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4024 ADD_AD_CONSTANT(CERTIFICATE_UNOBTAINABLE);
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	4025 #endif
02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	4026 #ifdef SSL_AD_UNRECOGNIZED_NAME
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4027 ADD_AD_CONSTANT(UNRECOGNIZED_NAME);
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	4028 #endif
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4029 #ifdef SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4030 ADD_AD_CONSTANT(BAD_CERTIFICATE_STATUS_RESPONSE);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4031 #endif
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4032 #ifdef SSL_AD_BAD_CERTIFICATE_HASH_VALUE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4033 ADD_AD_CONSTANT(BAD_CERTIFICATE_HASH_VALUE);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4034 #endif
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4035 #ifdef SSL_AD_UNKNOWN_PSK_IDENTITY
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4036 ADD_AD_CONSTANT(UNKNOWN_PSK_IDENTITY);
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4037 #endif
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4038
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4039 #undef ADD_AD_CONSTANT
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 79136 diff changeset	4040
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4041 /* protocol versions */
69997 b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 66806 diff changeset	4042 #ifndef OPENSSL_NO_SSL2
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4043 PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4044 PY_SSL_VERSION_SSL2);
69997 b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 66806 diff changeset	4045 #endif
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4046 PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4047 PY_SSL_VERSION_SSL3);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4048 PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4049 PY_SSL_VERSION_SSL23);
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4050 PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",
50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4051 PY_SSL_VERSION_TLS1);
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4052 #if HAVE_TLSv1_2
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4053 PyModule_AddIntConstant(m, "PROTOCOL_TLSv1_1",
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4054 PY_SSL_VERSION_TLS1_1);
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4055 PyModule_AddIntConstant(m, "PROTOCOL_TLSv1_2",
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4056 PY_SSL_VERSION_TLS1_2);
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4057 #endif
60373 9e5e9d8fa847 Merged revisions 79812 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60034 diff changeset	4058
61782 5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	4059 /* protocol options */
74648 4386686a035d Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. Antoine Pitrou <solipsis@pitrou.net> parents: 73711 74647 diff changeset	4060 PyModule_AddIntConstant(m, "OP_ALL",
4386686a035d Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. Antoine Pitrou <solipsis@pitrou.net> parents: 73711 74647 diff changeset	4061 SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
61782 5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	4062 PyModule_AddIntConstant(m, "OP_NO_SSLv2", SSL_OP_NO_SSLv2);
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	4063 PyModule_AddIntConstant(m, "OP_NO_SSLv3", SSL_OP_NO_SSLv3);
5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	4064 PyModule_AddIntConstant(m, "OP_NO_TLSv1", SSL_OP_NO_TLSv1);
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4065 #if HAVE_TLSv1_2
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4066 PyModule_AddIntConstant(m, "OP_NO_TLSv1_1", SSL_OP_NO_TLSv1_1);
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4067 PyModule_AddIntConstant(m, "OP_NO_TLSv1_2", SSL_OP_NO_TLSv1_2);
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81559 diff changeset	4068 #endif
74075 c706f76c9ea8 Issue #13635: Add ssl.OP_CIPHER_SERVER_PREFERENCE, so that SSL servers Antoine Pitrou <solipsis@pitrou.net> parents: 73712 diff changeset	4069 PyModule_AddIntConstant(m, "OP_CIPHER_SERVER_PREFERENCE",
c706f76c9ea8 Issue #13635: Add ssl.OP_CIPHER_SERVER_PREFERENCE, so that SSL servers Antoine Pitrou <solipsis@pitrou.net> parents: 73712 diff changeset	4070 SSL_OP_CIPHER_SERVER_PREFERENCE);
74129 33dea851f918 Issue #13626: Add support for SSL Diffie-Hellman key exchange, through the Antoine Pitrou <solipsis@pitrou.net> parents: 74103 diff changeset	4071 PyModule_AddIntConstant(m, "OP_SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE);
74995 c1a07c8092f7 Fix compilation when SSL_OP_SINGLE_ECDH_USE isn't defined Antoine Pitrou <solipsis@pitrou.net> parents: 74964 diff changeset	4072 #ifdef SSL_OP_SINGLE_ECDH_USE
74084 8b729d65cfd2 Issue #13627: Add support for SSL Elliptic Curve-based Diffie-Hellman Antoine Pitrou <solipsis@pitrou.net> parents: 74075 diff changeset	4073 PyModule_AddIntConstant(m, "OP_SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE);
74995 c1a07c8092f7 Fix compilation when SSL_OP_SINGLE_ECDH_USE isn't defined Antoine Pitrou <solipsis@pitrou.net> parents: 74964 diff changeset	4074 #endif
74091 20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	4075 #ifdef SSL_OP_NO_COMPRESSION
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	4076 PyModule_AddIntConstant(m, "OP_NO_COMPRESSION",
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	4077 SSL_OP_NO_COMPRESSION);
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	4078 #endif
61782 5ee47f0b26b0 Issue #4870: Add an `options` attribute to SSL contexts, as well as Antoine Pitrou <solipsis@pitrou.net> parents: 61644 diff changeset	4079
83021 02f9335b7efb Issue #17581: try to fix building on old OpenSSL versions Antoine Pitrou <solipsis@pitrou.net> parents: 82992 diff changeset	4080 #if HAVE_SNI
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	4081 r = Py_True;
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	4082 #else
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	4083 r = Py_False;
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	4084 #endif
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	4085 Py_INCREF(r);
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	4086 PyModule_AddObject(m, "HAS_SNI", r);
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65267 diff changeset	4087
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	4088 #if HAVE_OPENSSL_FINISHED
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	4089 r = Py_True;
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	4090 #else
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	4091 r = Py_False;
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	4092 #endif
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	4093 Py_INCREF(r);
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	4094 PyModule_AddObject(m, "HAS_TLS_UNIQUE", r);
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	4095
74103 ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	4096 #ifdef OPENSSL_NO_ECDH
ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	4097 r = Py_False;
ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	4098 #else
ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	4099 r = Py_True;
ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	4100 #endif
ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	4101 Py_INCREF(r);
ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	4102 PyModule_AddObject(m, "HAS_ECDH", r);
ec44f2e82707 Fix ssl module compilation if ECDH support was disabled in the OpenSSL build. Antoine Pitrou <solipsis@pitrou.net> parents: 74091 diff changeset	4103
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	4104 #ifdef OPENSSL_NPN_NEGOTIATED
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	4105 r = Py_True;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	4106 #else
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	4107 r = Py_False;
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	4108 #endif
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	4109 Py_INCREF(r);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	4110 PyModule_AddObject(m, "HAS_NPN", r);
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75043 diff changeset	4111
77578 96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4112 /* Mappings for error codes */
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4113 err_codes_to_names = PyDict_New();
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4114 err_names_to_codes = PyDict_New();
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4115 if (err_codes_to_names == NULL \|\| err_names_to_codes == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4116 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4117 errcode = error_codes;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4118 while (errcode->mnemonic != NULL) {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4119 PyObject mnemo, key;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4120 mnemo = PyUnicode_FromString(errcode->mnemonic);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4121 key = Py_BuildValue("ii", errcode->library, errcode->reason);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4122 if (mnemo == NULL \|\| key == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4123 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4124 if (PyDict_SetItem(err_codes_to_names, key, mnemo))
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4125 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4126 if (PyDict_SetItem(err_names_to_codes, mnemo, key))
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4127 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4128 Py_DECREF(key);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4129 Py_DECREF(mnemo);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4130 errcode++;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4131 }
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4132 if (PyModule_AddObject(m, "err_codes_to_names", err_codes_to_names))
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4133 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4134 if (PyModule_AddObject(m, "err_names_to_codes", err_names_to_codes))
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4135 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4136
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4137 lib_codes_to_names = PyDict_New();
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4138 if (lib_codes_to_names == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4139 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4140 libcode = library_codes;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4141 while (libcode->library != NULL) {
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4142 PyObject mnemo, key;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4143 key = PyLong_FromLong(libcode->code);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4144 mnemo = PyUnicode_FromString(libcode->library);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4145 if (key == NULL \|\| mnemo == NULL)
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4146 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4147 if (PyDict_SetItem(lib_codes_to_names, key, mnemo))
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4148 return NULL;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4149 Py_DECREF(key);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4150 Py_DECREF(mnemo);
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4151 libcode++;
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4152 }
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4153 if (PyModule_AddObject(m, "lib_codes_to_names", lib_codes_to_names))
96513d71e650 Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule. Antoine Pitrou <solipsis@pitrou.net> parents: 75865 diff changeset	4154 return NULL;
84269 1bd49f8a30da _ssl.c: strip trailing spaces Victor Stinner <victor.stinner@gmail.com> parents: 81463 diff changeset	4155
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4156 /* OpenSSL version */
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4157 /* SSLeay() gives us the version of the library linked against,
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4158 which could be different from the headers version.
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4159 */
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4160 libver = SSLeay();
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4161 r = PyLong_FromUnsignedLong(libver);
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4162 if (r == NULL)
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4163 return NULL;
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4164 if (PyModule_AddObject(m, "OPENSSL_VERSION_NUMBER", r))
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4165 return NULL;
71255 52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	4166 parse_openssl_version(libver, &major, &minor, &fix, &patch, &status);
61244 35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4167 r = Py_BuildValue("IIIII", major, minor, fix, patch, status);
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4168 if (r == NULL \|\| PyModule_AddObject(m, "OPENSSL_VERSION_INFO", r))
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4169 return NULL;
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4170 r = PyUnicode_FromString(SSLeay_version(SSLEAY_VERSION));
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4171 if (r == NULL \|\| PyModule_AddObject(m, "OPENSSL_VERSION", r))
35221c0158b5 Merged revisions 80789 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61017 diff changeset	4172 return NULL;
60373 9e5e9d8fa847 Merged revisions 79812 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60034 diff changeset	4173
71255 52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	4174 libver = OPENSSL_VERSION_NUMBER;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	4175 parse_openssl_version(libver, &major, &minor, &fix, &patch, &status);
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	4176 r = Py_BuildValue("IIIII", major, minor, fix, patch, status);
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	4177 if (r == NULL \|\| PyModule_AddObject(m, "_OPENSSL_API_VERSION", r))
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	4178 return NULL;
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	4179
61246 50a4ec37361d Merged revisions 80790 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 61018 diff changeset	4180 return m;
21959 3957d155f8c5 Break SSL support out of _socket module and place it into a new Marc-André Lemburg <mal@egenix.com> parents: diff changeset	4181 }

Mercurial > cpython-lru_cache-weakref

annotate Modules/_ssl.c @ 87690:66c1c9f32567 default tip