blob: 0c085a8874ccc95066cd2c37ab9953b3f97ababf [file] [log] [blame]
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +00001/* SSL socket module
2
3 SSL support based on patches by Brian E Gallew and Laszlo Kovacs.
4
5 This module is imported by socket.py. It should *not* be used
6 directly.
7
8*/
9
10#include "Python.h"
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +000011enum py_ssl_error {
12 /* these mirror ssl.h */
13 PY_SSL_ERROR_NONE,
14 PY_SSL_ERROR_SSL,
15 PY_SSL_ERROR_WANT_READ,
16 PY_SSL_ERROR_WANT_WRITE,
17 PY_SSL_ERROR_WANT_X509_LOOKUP,
18 PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */
19 PY_SSL_ERROR_ZERO_RETURN,
20 PY_SSL_ERROR_WANT_CONNECT,
21 /* start of non ssl.h errorcodes */
22 PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */
23 PY_SSL_ERROR_INVALID_ERROR_CODE
24};
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +000025
26/* Include symbols from _socket module */
27#include "socketmodule.h"
28
29/* Include OpenSSL header files */
30#include "openssl/rsa.h"
31#include "openssl/crypto.h"
32#include "openssl/x509.h"
33#include "openssl/pem.h"
34#include "openssl/ssl.h"
35#include "openssl/err.h"
36#include "openssl/rand.h"
37
38/* SSL error object */
39static PyObject *PySSLErrorObject;
40
41/* SSL socket object */
42
43#define X509_NAME_MAXLEN 256
44
45/* RAND_* APIs got added to OpenSSL in 0.9.5 */
46#if OPENSSL_VERSION_NUMBER >= 0x0090500fL
47# define HAVE_OPENSSL_RAND 1
48#else
49# undef HAVE_OPENSSL_RAND
50#endif
51
52typedef struct {
53 PyObject_HEAD
54 PySocketSockObject *Socket; /* Socket on which we're layered */
55 SSL_CTX* ctx;
56 SSL* ssl;
57 X509* server_cert;
58 BIO* sbio;
59 char server[X509_NAME_MAXLEN];
60 char issuer[X509_NAME_MAXLEN];
61
62} PySSLObject;
63
Jeremy Hylton938ace62002-07-17 16:30:39 +000064static PyTypeObject PySSL_Type;
65static PyObject *PySSL_SSLwrite(PySSLObject *self, PyObject *args);
66static PyObject *PySSL_SSLread(PySSLObject *self, PyObject *args);
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +000067static int check_socket_and_wait_for_timeout(PySocketSockObject *s,
68 int writing);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +000069
70#define PySSLObject_Check(v) ((v)->ob_type == &PySSL_Type)
71
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +000072typedef enum {
73 SOCKET_IS_NONBLOCKING,
74 SOCKET_IS_BLOCKING,
75 SOCKET_HAS_TIMED_OUT,
76 SOCKET_HAS_BEEN_CLOSED,
Neal Norwitz389cea82006-02-13 00:35:21 +000077 SOCKET_TOO_LARGE_FOR_SELECT,
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +000078 SOCKET_OPERATION_OK
79} timeout_state;
80
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +000081/* XXX It might be helpful to augment the error message generated
82 below with the name of the SSL function that generated the error.
83 I expect it's obvious most of the time.
84*/
85
86static PyObject *
87PySSL_SetError(PySSLObject *obj, int ret)
88{
89 PyObject *v, *n, *s;
90 char *errstr;
91 int err;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +000092 enum py_ssl_error p;
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +000093
94 assert(ret <= 0);
95
96 err = SSL_get_error(obj->ssl, ret);
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +000097
98 switch (err) {
99 case SSL_ERROR_ZERO_RETURN:
100 errstr = "TLS/SSL connection has been closed";
Jeremy Hylton4e547302002-07-02 18:25:00 +0000101 p = PY_SSL_ERROR_ZERO_RETURN;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000102 break;
103 case SSL_ERROR_WANT_READ:
104 errstr = "The operation did not complete (read)";
Jeremy Hylton4e547302002-07-02 18:25:00 +0000105 p = PY_SSL_ERROR_WANT_READ;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000106 break;
107 case SSL_ERROR_WANT_WRITE:
Jeremy Hylton4e547302002-07-02 18:25:00 +0000108 p = PY_SSL_ERROR_WANT_WRITE;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000109 errstr = "The operation did not complete (write)";
110 break;
111 case SSL_ERROR_WANT_X509_LOOKUP:
Jeremy Hylton4e547302002-07-02 18:25:00 +0000112 p = PY_SSL_ERROR_WANT_X509_LOOKUP;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000113 errstr = "The operation did not complete (X509 lookup)";
114 break;
115 case SSL_ERROR_WANT_CONNECT:
Jeremy Hylton4e547302002-07-02 18:25:00 +0000116 p = PY_SSL_ERROR_WANT_CONNECT;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000117 errstr = "The operation did not complete (connect)";
118 break;
119 case SSL_ERROR_SYSCALL:
120 {
121 unsigned long e = ERR_get_error();
Jeremy Hylton4e547302002-07-02 18:25:00 +0000122 if (e == 0) {
Neal Norwitza9002f82003-06-30 03:25:20 +0000123 if (ret == 0 || !obj->Socket) {
Jeremy Hylton4e547302002-07-02 18:25:00 +0000124 p = PY_SSL_ERROR_EOF;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000125 errstr = "EOF occurred in violation of protocol";
Jeremy Hylton4e547302002-07-02 18:25:00 +0000126 } else if (ret == -1) {
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000127 /* the underlying BIO reported an I/O error */
128 return obj->Socket->errorhandler();
Jeremy Hylton4e547302002-07-02 18:25:00 +0000129 } else { /* possible? */
130 p = PY_SSL_ERROR_SYSCALL;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000131 errstr = "Some I/O error occurred";
132 }
133 } else {
Jeremy Hylton4e547302002-07-02 18:25:00 +0000134 p = PY_SSL_ERROR_SYSCALL;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000135 /* XXX Protected by global interpreter lock */
136 errstr = ERR_error_string(e, NULL);
137 }
138 break;
139 }
140 case SSL_ERROR_SSL:
141 {
142 unsigned long e = ERR_get_error();
Jeremy Hylton4e547302002-07-02 18:25:00 +0000143 p = PY_SSL_ERROR_SSL;
144 if (e != 0)
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000145 /* XXX Protected by global interpreter lock */
146 errstr = ERR_error_string(e, NULL);
Jeremy Hylton4e547302002-07-02 18:25:00 +0000147 else { /* possible? */
148 errstr = "A failure in the SSL library occurred";
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000149 }
150 break;
151 }
152 default:
Jeremy Hylton4e547302002-07-02 18:25:00 +0000153 p = PY_SSL_ERROR_INVALID_ERROR_CODE;
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000154 errstr = "Invalid error code";
155 }
156 n = PyInt_FromLong((long) p);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000157 if (n == NULL)
158 return NULL;
159 v = PyTuple_New(2);
160 if (v == NULL) {
161 Py_DECREF(n);
162 return NULL;
163 }
164
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000165 s = PyString_FromString(errstr);
166 if (s == NULL) {
167 Py_DECREF(v);
168 Py_DECREF(n);
169 }
170 PyTuple_SET_ITEM(v, 0, n);
171 PyTuple_SET_ITEM(v, 1, s);
172 PyErr_SetObject(PySSLErrorObject, v);
Michael W. Hudson5910d812004-08-04 14:59:00 +0000173 Py_DECREF(v);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000174 return NULL;
175}
176
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000177static PySSLObject *
178newPySSLObject(PySocketSockObject *Sock, char *key_file, char *cert_file)
179{
180 PySSLObject *self;
181 char *errstr = NULL;
182 int ret;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000183 int err;
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000184 int sockstate;
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000185
186 self = PyObject_New(PySSLObject, &PySSL_Type); /* Create new object */
187 if (self == NULL){
188 errstr = "newPySSLObject error";
189 goto fail;
190 }
191 memset(self->server, '\0', sizeof(char) * X509_NAME_MAXLEN);
192 memset(self->issuer, '\0', sizeof(char) * X509_NAME_MAXLEN);
193 self->server_cert = NULL;
194 self->ssl = NULL;
195 self->ctx = NULL;
196 self->Socket = NULL;
197
198 if ((key_file && !cert_file) || (!key_file && cert_file)) {
199 errstr = "Both the key & certificate files must be specified";
200 goto fail;
201 }
202
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000203 Py_BEGIN_ALLOW_THREADS
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000204 self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000205 Py_END_ALLOW_THREADS
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000206 if (self->ctx == NULL) {
207 errstr = "SSL_CTX_new error";
208 goto fail;
209 }
210
211 if (key_file) {
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000212 Py_BEGIN_ALLOW_THREADS
213 ret = SSL_CTX_use_PrivateKey_file(self->ctx, key_file,
214 SSL_FILETYPE_PEM);
215 Py_END_ALLOW_THREADS
216 if (ret < 1) {
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000217 errstr = "SSL_CTX_use_PrivateKey_file error";
218 goto fail;
219 }
220
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000221 Py_BEGIN_ALLOW_THREADS
222 ret = SSL_CTX_use_certificate_chain_file(self->ctx,
223 cert_file);
224 Py_END_ALLOW_THREADS
Andrew M. Kuchling27d3dda2004-07-10 21:36:55 +0000225 SSL_CTX_set_options(self->ctx, SSL_OP_ALL); /* ssl compatibility */
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000226 if (ret < 1) {
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000227 errstr = "SSL_CTX_use_certificate_chain_file error";
228 goto fail;
229 }
230 }
231
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000232 Py_BEGIN_ALLOW_THREADS
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000233 SSL_CTX_set_verify(self->ctx,
234 SSL_VERIFY_NONE, NULL); /* set verify lvl */
235 self->ssl = SSL_new(self->ctx); /* New ssl struct */
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000236 Py_END_ALLOW_THREADS
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000237 SSL_set_fd(self->ssl, Sock->sock_fd); /* Set the socket for SSL */
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000238
Walter Dörwaldf0dfc7a2003-10-20 14:01:56 +0000239 /* If the socket is in non-blocking mode or timeout mode, set the BIO
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000240 * to non-blocking mode (blocking is the default)
241 */
242 if (Sock->sock_timeout >= 0.0) {
243 /* Set both the read and write BIO's to non-blocking mode */
244 BIO_set_nbio(SSL_get_rbio(self->ssl), 1);
245 BIO_set_nbio(SSL_get_wbio(self->ssl), 1);
246 }
247
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000248 Py_BEGIN_ALLOW_THREADS
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000249 SSL_set_connect_state(self->ssl);
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000250 Py_END_ALLOW_THREADS
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000251
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000252 /* Actually negotiate SSL connection */
253 /* XXX If SSL_connect() returns 0, it's also a failure. */
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000254 sockstate = 0;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000255 do {
256 Py_BEGIN_ALLOW_THREADS
257 ret = SSL_connect(self->ssl);
258 err = SSL_get_error(self->ssl, ret);
259 Py_END_ALLOW_THREADS
Martin v. Löwisafec8e32003-06-28 07:40:23 +0000260 if(PyErr_CheckSignals()) {
261 goto fail;
262 }
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000263 if (err == SSL_ERROR_WANT_READ) {
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000264 sockstate = check_socket_and_wait_for_timeout(Sock, 0);
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000265 } else if (err == SSL_ERROR_WANT_WRITE) {
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000266 sockstate = check_socket_and_wait_for_timeout(Sock, 1);
267 } else {
268 sockstate = SOCKET_OPERATION_OK;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000269 }
Neal Norwitz19cbcad2006-02-07 06:59:20 +0000270 if (sockstate == SOCKET_HAS_TIMED_OUT) {
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000271 PyErr_SetString(PySSLErrorObject, "The connect operation timed out");
Martin v. Löwisafec8e32003-06-28 07:40:23 +0000272 goto fail;
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000273 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
274 PyErr_SetString(PySSLErrorObject, "Underlying socket has been closed.");
275 goto fail;
Neal Norwitz389cea82006-02-13 00:35:21 +0000276 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
Neal Norwitz082b2df2006-02-07 07:04:46 +0000277 PyErr_SetString(PySSLErrorObject, "Underlying socket too large for select().");
278 goto fail;
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000279 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
280 break;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000281 }
282 } while (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000283 if (ret <= 0) {
284 PySSL_SetError(self, ret);
285 goto fail;
286 }
287 self->ssl->debug = 1;
288
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000289 Py_BEGIN_ALLOW_THREADS
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000290 if ((self->server_cert = SSL_get_peer_certificate(self->ssl))) {
291 X509_NAME_oneline(X509_get_subject_name(self->server_cert),
292 self->server, X509_NAME_MAXLEN);
293 X509_NAME_oneline(X509_get_issuer_name(self->server_cert),
294 self->issuer, X509_NAME_MAXLEN);
295 }
Martin v. Löwis09c35f72002-07-28 09:57:45 +0000296 Py_END_ALLOW_THREADS
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000297 self->Socket = Sock;
298 Py_INCREF(self->Socket);
299 return self;
300 fail:
301 if (errstr)
302 PyErr_SetString(PySSLErrorObject, errstr);
303 Py_DECREF(self);
304 return NULL;
305}
306
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000307static PyObject *
308PySocket_ssl(PyObject *self, PyObject *args)
309{
310 PySSLObject *rv;
311 PySocketSockObject *Sock;
312 char *key_file = NULL;
313 char *cert_file = NULL;
314
315 if (!PyArg_ParseTuple(args, "O!|zz:ssl",
316 PySocketModule.Sock_Type,
317 (PyObject*)&Sock,
318 &key_file, &cert_file))
319 return NULL;
320
321 rv = newPySSLObject(Sock, key_file, cert_file);
322 if (rv == NULL)
323 return NULL;
324 return (PyObject *)rv;
325}
326
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000327PyDoc_STRVAR(ssl_doc,
328"ssl(socket, [keyfile, certfile]) -> sslobject");
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000329
330/* SSL object methods */
331
332static PyObject *
333PySSL_server(PySSLObject *self)
334{
335 return PyString_FromString(self->server);
336}
337
338static PyObject *
339PySSL_issuer(PySSLObject *self)
340{
341 return PyString_FromString(self->issuer);
342}
343
344
345static void PySSL_dealloc(PySSLObject *self)
346{
347 if (self->server_cert) /* Possible not to have one? */
348 X509_free (self->server_cert);
349 if (self->ssl)
350 SSL_free(self->ssl);
351 if (self->ctx)
352 SSL_CTX_free(self->ctx);
353 Py_XDECREF(self->Socket);
354 PyObject_Del(self);
355}
356
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000357/* If the socket has a timeout, do a select() on the socket.
358 The argument writing indicates the direction.
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000359 Returns one of the possibilities in the timeout_state enum (above).
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000360 */
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000361
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000362static int
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000363check_socket_and_wait_for_timeout(PySocketSockObject *s, int writing)
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000364{
365 fd_set fds;
366 struct timeval tv;
367 int rc;
368
369 /* Nothing to do unless we're in timeout mode (not non-blocking) */
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000370 if (s->sock_timeout < 0.0)
371 return SOCKET_IS_BLOCKING;
372 else if (s->sock_timeout == 0.0)
373 return SOCKET_IS_NONBLOCKING;
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000374
375 /* Guard against closed socket */
376 if (s->sock_fd < 0)
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000377 return SOCKET_HAS_BEEN_CLOSED;
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000378
Neal Norwitz082b2df2006-02-07 07:04:46 +0000379 /* Guard against socket too large for select*/
Martin v. Löwisf84d1b92006-02-11 09:27:05 +0000380#ifndef Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE
Neal Norwitz082b2df2006-02-07 07:04:46 +0000381 if (s->sock_fd >= FD_SETSIZE)
Neal Norwitz389cea82006-02-13 00:35:21 +0000382 return SOCKET_TOO_LARGE_FOR_SELECT;
Martin v. Löwisf84d1b92006-02-11 09:27:05 +0000383#endif
Neal Norwitz082b2df2006-02-07 07:04:46 +0000384
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000385 /* Construct the arguments to select */
386 tv.tv_sec = (int)s->sock_timeout;
387 tv.tv_usec = (int)((s->sock_timeout - tv.tv_sec) * 1e6);
388 FD_ZERO(&fds);
389 FD_SET(s->sock_fd, &fds);
390
391 /* See if the socket is ready */
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000392 Py_BEGIN_ALLOW_THREADS
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000393 if (writing)
394 rc = select(s->sock_fd+1, NULL, &fds, NULL, &tv);
395 else
396 rc = select(s->sock_fd+1, &fds, NULL, NULL, &tv);
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000397 Py_END_ALLOW_THREADS
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000398
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000399 /* Return SOCKET_TIMED_OUT on timeout, SOCKET_OPERATION_OK otherwise
400 (when we are able to write or when there's something to read) */
401 return rc == 0 ? SOCKET_HAS_TIMED_OUT : SOCKET_OPERATION_OK;
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000402}
403
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000404static PyObject *PySSL_SSLwrite(PySSLObject *self, PyObject *args)
405{
406 char *data;
407 int len;
Martin v. Löwis405a7952003-10-27 14:24:37 +0000408 int count;
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000409 int sockstate;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000410 int err;
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000411
Martin v. Löwis405a7952003-10-27 14:24:37 +0000412 if (!PyArg_ParseTuple(args, "s#:write", &data, &count))
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000413 return NULL;
414
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000415 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
416 if (sockstate == SOCKET_HAS_TIMED_OUT) {
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000417 PyErr_SetString(PySSLErrorObject, "The write operation timed out");
418 return NULL;
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000419 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
420 PyErr_SetString(PySSLErrorObject, "Underlying socket has been closed.");
421 return NULL;
Neal Norwitz389cea82006-02-13 00:35:21 +0000422 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
Neal Norwitz082b2df2006-02-07 07:04:46 +0000423 PyErr_SetString(PySSLErrorObject, "Underlying socket too large for select().");
424 return NULL;
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000425 }
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000426 do {
427 err = 0;
428 Py_BEGIN_ALLOW_THREADS
Martin v. Löwis405a7952003-10-27 14:24:37 +0000429 len = SSL_write(self->ssl, data, count);
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000430 err = SSL_get_error(self->ssl, len);
431 Py_END_ALLOW_THREADS
Martin v. Löwisafec8e32003-06-28 07:40:23 +0000432 if(PyErr_CheckSignals()) {
433 return NULL;
434 }
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000435 if (err == SSL_ERROR_WANT_READ) {
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000436 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000437 } else if (err == SSL_ERROR_WANT_WRITE) {
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000438 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
439 } else {
440 sockstate = SOCKET_OPERATION_OK;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000441 }
Neal Norwitz19cbcad2006-02-07 06:59:20 +0000442 if (sockstate == SOCKET_HAS_TIMED_OUT) {
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000443 PyErr_SetString(PySSLErrorObject, "The write operation timed out");
444 return NULL;
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000445 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
446 PyErr_SetString(PySSLErrorObject, "Underlying socket has been closed.");
447 return NULL;
448 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
449 break;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000450 }
451 } while (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000452 if (len > 0)
453 return PyInt_FromLong(len);
454 else
455 return PySSL_SetError(self, len);
456}
457
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000458PyDoc_STRVAR(PySSL_SSLwrite_doc,
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000459"write(s) -> len\n\
460\n\
461Writes the string s into the SSL object. Returns the number\n\
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000462of bytes written.");
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000463
464static PyObject *PySSL_SSLread(PySSLObject *self, PyObject *args)
465{
466 PyObject *buf;
467 int count = 0;
468 int len = 1024;
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000469 int sockstate;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000470 int err;
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000471
472 if (!PyArg_ParseTuple(args, "|i:read", &len))
473 return NULL;
474
475 if (!(buf = PyString_FromStringAndSize((char *) 0, len)))
476 return NULL;
Georg Brandl43f08a82006-03-31 18:01:16 +0000477
478 /* first check if there are bytes ready to be read */
479 Py_BEGIN_ALLOW_THREADS
480 count = SSL_pending(self->ssl);
481 Py_END_ALLOW_THREADS
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000482
Georg Brandl43f08a82006-03-31 18:01:16 +0000483 if (!count) {
484 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
485 if (sockstate == SOCKET_HAS_TIMED_OUT) {
486 PyErr_SetString(PySSLErrorObject, "The read operation timed out");
487 Py_DECREF(buf);
488 return NULL;
489 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
490 PyErr_SetString(PySSLErrorObject, "Underlying socket too large for select().");
491 return NULL;
492 }
Guido van Rossum99d4abf2003-01-27 22:22:50 +0000493 }
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000494 do {
495 err = 0;
496 Py_BEGIN_ALLOW_THREADS
497 count = SSL_read(self->ssl, PyString_AsString(buf), len);
498 err = SSL_get_error(self->ssl, count);
499 Py_END_ALLOW_THREADS
Martin v. Löwisafec8e32003-06-28 07:40:23 +0000500 if(PyErr_CheckSignals()) {
501 Py_DECREF(buf);
502 return NULL;
503 }
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000504 if (err == SSL_ERROR_WANT_READ) {
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000505 sockstate = check_socket_and_wait_for_timeout(self->Socket, 0);
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000506 } else if (err == SSL_ERROR_WANT_WRITE) {
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000507 sockstate = check_socket_and_wait_for_timeout(self->Socket, 1);
508 } else {
509 sockstate = SOCKET_OPERATION_OK;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000510 }
Neal Norwitz19cbcad2006-02-07 06:59:20 +0000511 if (sockstate == SOCKET_HAS_TIMED_OUT) {
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000512 PyErr_SetString(PySSLErrorObject, "The read operation timed out");
Martin v. Löwisafec8e32003-06-28 07:40:23 +0000513 Py_DECREF(buf);
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000514 return NULL;
Andrew M. Kuchling9c3efe32004-07-10 21:15:17 +0000515 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
516 break;
Guido van Rossum4f707ac2003-01-31 18:13:18 +0000517 }
518 } while (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000519 if (count <= 0) {
520 Py_DECREF(buf);
521 return PySSL_SetError(self, count);
522 }
Tim Peters5de98422002-04-27 18:44:32 +0000523 if (count != len)
524 _PyString_Resize(&buf, count);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000525 return buf;
526}
527
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000528PyDoc_STRVAR(PySSL_SSLread_doc,
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000529"read([len]) -> string\n\
530\n\
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000531Read up to len bytes from the SSL socket.");
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000532
533static PyMethodDef PySSLMethods[] = {
534 {"write", (PyCFunction)PySSL_SSLwrite, METH_VARARGS,
535 PySSL_SSLwrite_doc},
536 {"read", (PyCFunction)PySSL_SSLread, METH_VARARGS,
537 PySSL_SSLread_doc},
538 {"server", (PyCFunction)PySSL_server, METH_NOARGS},
539 {"issuer", (PyCFunction)PySSL_issuer, METH_NOARGS},
540 {NULL, NULL}
541};
542
543static PyObject *PySSL_getattr(PySSLObject *self, char *name)
544{
545 return Py_FindMethod(PySSLMethods, (PyObject *)self, name);
546}
547
Jeremy Hylton938ace62002-07-17 16:30:39 +0000548static PyTypeObject PySSL_Type = {
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000549 PyObject_HEAD_INIT(NULL)
550 0, /*ob_size*/
551 "socket.SSL", /*tp_name*/
552 sizeof(PySSLObject), /*tp_basicsize*/
553 0, /*tp_itemsize*/
554 /* methods */
555 (destructor)PySSL_dealloc, /*tp_dealloc*/
556 0, /*tp_print*/
557 (getattrfunc)PySSL_getattr, /*tp_getattr*/
558 0, /*tp_setattr*/
559 0, /*tp_compare*/
560 0, /*tp_repr*/
561 0, /*tp_as_number*/
562 0, /*tp_as_sequence*/
563 0, /*tp_as_mapping*/
564 0, /*tp_hash*/
565};
566
567#ifdef HAVE_OPENSSL_RAND
568
569/* helper routines for seeding the SSL PRNG */
570static PyObject *
571PySSL_RAND_add(PyObject *self, PyObject *args)
572{
573 char *buf;
574 int len;
575 double entropy;
576
577 if (!PyArg_ParseTuple(args, "s#d:RAND_add", &buf, &len, &entropy))
578 return NULL;
579 RAND_add(buf, len, entropy);
580 Py_INCREF(Py_None);
581 return Py_None;
582}
583
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000584PyDoc_STRVAR(PySSL_RAND_add_doc,
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000585"RAND_add(string, entropy)\n\
586\n\
587Mix string into the OpenSSL PRNG state. entropy (a float) is a lower\n\
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000588bound on the entropy contained in string.");
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000589
590static PyObject *
591PySSL_RAND_status(PyObject *self)
592{
593 return PyInt_FromLong(RAND_status());
594}
595
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000596PyDoc_STRVAR(PySSL_RAND_status_doc,
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000597"RAND_status() -> 0 or 1\n\
598\n\
599Returns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\n\
600It is necessary to seed the PRNG with RAND_add() on some platforms before\n\
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000601using the ssl() function.");
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000602
603static PyObject *
604PySSL_RAND_egd(PyObject *self, PyObject *arg)
605{
606 int bytes;
607
608 if (!PyString_Check(arg))
609 return PyErr_Format(PyExc_TypeError,
610 "RAND_egd() expected string, found %s",
611 arg->ob_type->tp_name);
612 bytes = RAND_egd(PyString_AS_STRING(arg));
613 if (bytes == -1) {
614 PyErr_SetString(PySSLErrorObject,
615 "EGD connection failed or EGD did not return "
616 "enough data to seed the PRNG");
617 return NULL;
618 }
619 return PyInt_FromLong(bytes);
620}
621
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000622PyDoc_STRVAR(PySSL_RAND_egd_doc,
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000623"RAND_egd(path) -> bytes\n\
624\n\
625Queries the entropy gather daemon (EGD) on socket path. Returns number\n\
626of bytes read. Raises socket.sslerror if connection to EGD fails or\n\
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000627if it does provide enough data to seed PRNG.");
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000628
629#endif
630
631/* List of functions exported by this module. */
632
633static PyMethodDef PySSL_methods[] = {
634 {"ssl", PySocket_ssl,
635 METH_VARARGS, ssl_doc},
636#ifdef HAVE_OPENSSL_RAND
637 {"RAND_add", PySSL_RAND_add, METH_VARARGS,
638 PySSL_RAND_add_doc},
639 {"RAND_egd", PySSL_RAND_egd, METH_O,
640 PySSL_RAND_egd_doc},
641 {"RAND_status", (PyCFunction)PySSL_RAND_status, METH_NOARGS,
642 PySSL_RAND_status_doc},
643#endif
644 {NULL, NULL} /* Sentinel */
645};
646
647
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000648PyDoc_STRVAR(module_doc,
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000649"Implementation module for SSL socket operations. See the socket module\n\
Martin v. Löwis14f8b4c2002-06-13 20:33:02 +0000650for documentation.");
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000651
Mark Hammondfe51c6d2002-08-02 02:27:13 +0000652PyMODINIT_FUNC
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000653init_ssl(void)
654{
655 PyObject *m, *d;
656
657 PySSL_Type.ob_type = &PyType_Type;
658
659 m = Py_InitModule3("_ssl", PySSL_methods, module_doc);
Neal Norwitz1ac754f2006-01-19 06:09:39 +0000660 if (m == NULL)
661 return;
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000662 d = PyModule_GetDict(m);
663
664 /* Load _socket module and its C API */
665 if (PySocketModule_ImportModuleAndAPI())
666 return;
667
668 /* Init OpenSSL */
669 SSL_load_error_strings();
670 SSLeay_add_ssl_algorithms();
671
672 /* Add symbols to module dict */
Brett Cannon06c34792004-03-23 23:16:54 +0000673 PySSLErrorObject = PyErr_NewException("socket.sslerror",
674 PySocketModule.error,
675 NULL);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000676 if (PySSLErrorObject == NULL)
677 return;
678 PyDict_SetItemString(d, "sslerror", PySSLErrorObject);
679 if (PyDict_SetItemString(d, "SSLType",
680 (PyObject *)&PySSL_Type) != 0)
681 return;
682 PyModule_AddIntConstant(m, "SSL_ERROR_ZERO_RETURN",
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000683 PY_SSL_ERROR_ZERO_RETURN);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000684 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_READ",
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000685 PY_SSL_ERROR_WANT_READ);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000686 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_WRITE",
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000687 PY_SSL_ERROR_WANT_WRITE);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000688 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_X509_LOOKUP",
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000689 PY_SSL_ERROR_WANT_X509_LOOKUP);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000690 PyModule_AddIntConstant(m, "SSL_ERROR_SYSCALL",
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000691 PY_SSL_ERROR_SYSCALL);
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000692 PyModule_AddIntConstant(m, "SSL_ERROR_SSL",
Martin v. Löwis6af3e2d2002-04-20 07:47:40 +0000693 PY_SSL_ERROR_SSL);
694 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_CONNECT",
695 PY_SSL_ERROR_WANT_CONNECT);
696 /* non ssl.h errorcodes */
697 PyModule_AddIntConstant(m, "SSL_ERROR_EOF",
698 PY_SSL_ERROR_EOF);
699 PyModule_AddIntConstant(m, "SSL_ERROR_INVALID_ERROR_CODE",
700 PY_SSL_ERROR_INVALID_ERROR_CODE);
701
Marc-André Lemburga5d2b4c2002-02-16 18:23:30 +0000702}