Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1 | /* SSL socket module |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 2 | |
| 3 | SSL support based on patches by Brian E Gallew and Laszlo Kovacs. |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 4 | Re-worked a bit by Bill Janssen to add server-side support and |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 5 | certificate decoding. Chris Stawarz contributed some non-blocking |
| 6 | patches. |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 7 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 8 | This module is imported by ssl.py. It should *not* be used |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 9 | directly. |
| 10 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 11 | XXX should partial writes be enabled, SSL_MODE_ENABLE_PARTIAL_WRITE? |
Antoine Pitrou | 5a1c4d1 | 2010-04-23 21:11:10 +0000 | [diff] [blame] | 12 | |
| 13 | XXX integrate several "shutdown modes" as suggested in |
| 14 | http://bugs.python.org/issue8108#msg102867 ? |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 15 | */ |
| 16 | |
| 17 | #include "Python.h" |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 18 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 19 | #ifdef WITH_THREAD |
| 20 | #include "pythread.h" |
| 21 | #define PySSL_BEGIN_ALLOW_THREADS { \ |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 22 | PyThreadState *_save = NULL; \ |
| 23 | if (_ssl_locks_count>0) {_save = PyEval_SaveThread();} |
| 24 | #define PySSL_BLOCK_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save)}; |
| 25 | #define PySSL_UNBLOCK_THREADS if (_ssl_locks_count>0){_save = PyEval_SaveThread()}; |
| 26 | #define PySSL_END_ALLOW_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save);} \ |
| 27 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 28 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 29 | #else /* no WITH_THREAD */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 30 | |
| 31 | #define PySSL_BEGIN_ALLOW_THREADS |
| 32 | #define PySSL_BLOCK_THREADS |
| 33 | #define PySSL_UNBLOCK_THREADS |
| 34 | #define PySSL_END_ALLOW_THREADS |
| 35 | |
| 36 | #endif |
| 37 | |
Martin v. Löwis | 6af3e2d | 2002-04-20 07:47:40 +0000 | [diff] [blame] | 38 | enum py_ssl_error { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 39 | /* these mirror ssl.h */ |
| 40 | PY_SSL_ERROR_NONE, |
| 41 | PY_SSL_ERROR_SSL, |
| 42 | PY_SSL_ERROR_WANT_READ, |
| 43 | PY_SSL_ERROR_WANT_WRITE, |
| 44 | PY_SSL_ERROR_WANT_X509_LOOKUP, |
| 45 | PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */ |
| 46 | PY_SSL_ERROR_ZERO_RETURN, |
| 47 | PY_SSL_ERROR_WANT_CONNECT, |
| 48 | /* start of non ssl.h errorcodes */ |
| 49 | PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */ |
| 50 | PY_SSL_ERROR_NO_SOCKET, /* socket has been GC'd */ |
| 51 | PY_SSL_ERROR_INVALID_ERROR_CODE |
Martin v. Löwis | 6af3e2d | 2002-04-20 07:47:40 +0000 | [diff] [blame] | 52 | }; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 53 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 54 | enum py_ssl_server_or_client { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 55 | PY_SSL_CLIENT, |
| 56 | PY_SSL_SERVER |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 57 | }; |
| 58 | |
| 59 | enum py_ssl_cert_requirements { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 60 | PY_SSL_CERT_NONE, |
| 61 | PY_SSL_CERT_OPTIONAL, |
| 62 | PY_SSL_CERT_REQUIRED |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 63 | }; |
| 64 | |
| 65 | enum py_ssl_version { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 66 | PY_SSL_VERSION_SSL2, |
| 67 | PY_SSL_VERSION_SSL3, |
| 68 | PY_SSL_VERSION_SSL23, |
| 69 | PY_SSL_VERSION_TLS1 |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 70 | }; |
| 71 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 72 | /* Include symbols from _socket module */ |
| 73 | #include "socketmodule.h" |
| 74 | |
Benjamin Peterson | b173f78 | 2009-05-05 22:31:58 +0000 | [diff] [blame] | 75 | static PySocketModule_APIObject PySocketModule; |
| 76 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 77 | #if defined(HAVE_POLL_H) |
Thomas Wouters | 0e3f591 | 2006-08-11 14:57:12 +0000 | [diff] [blame] | 78 | #include <poll.h> |
| 79 | #elif defined(HAVE_SYS_POLL_H) |
| 80 | #include <sys/poll.h> |
| 81 | #endif |
| 82 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 83 | /* Include OpenSSL header files */ |
| 84 | #include "openssl/rsa.h" |
| 85 | #include "openssl/crypto.h" |
| 86 | #include "openssl/x509.h" |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 87 | #include "openssl/x509v3.h" |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 88 | #include "openssl/pem.h" |
| 89 | #include "openssl/ssl.h" |
| 90 | #include "openssl/err.h" |
| 91 | #include "openssl/rand.h" |
| 92 | |
| 93 | /* SSL error object */ |
| 94 | static PyObject *PySSLErrorObject; |
| 95 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 96 | #ifdef WITH_THREAD |
| 97 | |
| 98 | /* serves as a flag to see whether we've initialized the SSL thread support. */ |
| 99 | /* 0 means no, greater than 0 means yes */ |
| 100 | |
| 101 | static unsigned int _ssl_locks_count = 0; |
| 102 | |
| 103 | #endif /* def WITH_THREAD */ |
| 104 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 105 | /* SSL socket object */ |
| 106 | |
| 107 | #define X509_NAME_MAXLEN 256 |
| 108 | |
| 109 | /* RAND_* APIs got added to OpenSSL in 0.9.5 */ |
| 110 | #if OPENSSL_VERSION_NUMBER >= 0x0090500fL |
| 111 | # define HAVE_OPENSSL_RAND 1 |
| 112 | #else |
| 113 | # undef HAVE_OPENSSL_RAND |
| 114 | #endif |
| 115 | |
| 116 | typedef struct { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 117 | PyObject_HEAD |
| 118 | PyObject *Socket; /* weakref to socket on which we're layered */ |
| 119 | SSL_CTX* ctx; |
| 120 | SSL* ssl; |
| 121 | X509* peer_cert; |
| 122 | int shutdown_seen_zero; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 123 | |
| 124 | } PySSLObject; |
| 125 | |
Jeremy Hylton | 938ace6 | 2002-07-17 16:30:39 +0000 | [diff] [blame] | 126 | static PyTypeObject PySSL_Type; |
| 127 | static PyObject *PySSL_SSLwrite(PySSLObject *self, PyObject *args); |
| 128 | static PyObject *PySSL_SSLread(PySSLObject *self, PyObject *args); |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 129 | static int check_socket_and_wait_for_timeout(PySocketSockObject *s, |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 130 | int writing); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 131 | static PyObject *PySSL_peercert(PySSLObject *self, PyObject *args); |
| 132 | static PyObject *PySSL_cipher(PySSLObject *self); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 133 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 134 | #define PySSLObject_Check(v) (Py_TYPE(v) == &PySSL_Type) |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 135 | |
Andrew M. Kuchling | 9c3efe3 | 2004-07-10 21:15:17 +0000 | [diff] [blame] | 136 | typedef enum { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 137 | SOCKET_IS_NONBLOCKING, |
| 138 | SOCKET_IS_BLOCKING, |
| 139 | SOCKET_HAS_TIMED_OUT, |
| 140 | SOCKET_HAS_BEEN_CLOSED, |
| 141 | SOCKET_TOO_LARGE_FOR_SELECT, |
| 142 | SOCKET_OPERATION_OK |
Andrew M. Kuchling | 9c3efe3 | 2004-07-10 21:15:17 +0000 | [diff] [blame] | 143 | } timeout_state; |
| 144 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 145 | /* Wrap error strings with filename and line # */ |
| 146 | #define STRINGIFY1(x) #x |
| 147 | #define STRINGIFY2(x) STRINGIFY1(x) |
| 148 | #define ERRSTR1(x,y,z) (x ":" y ": " z) |
| 149 | #define ERRSTR(x) ERRSTR1("_ssl.c", STRINGIFY2(__LINE__), x) |
| 150 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 151 | /* XXX It might be helpful to augment the error message generated |
| 152 | below with the name of the SSL function that generated the error. |
| 153 | I expect it's obvious most of the time. |
| 154 | */ |
| 155 | |
| 156 | static PyObject * |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 157 | PySSL_SetError(PySSLObject *obj, int ret, char *filename, int lineno) |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 158 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 159 | PyObject *v; |
| 160 | char buf[2048]; |
| 161 | char *errstr; |
| 162 | int err; |
| 163 | enum py_ssl_error p = PY_SSL_ERROR_NONE; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 164 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 165 | assert(ret <= 0); |
Martin v. Löwis | 6af3e2d | 2002-04-20 07:47:40 +0000 | [diff] [blame] | 166 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 167 | if (obj->ssl != NULL) { |
| 168 | err = SSL_get_error(obj->ssl, ret); |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 169 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 170 | switch (err) { |
| 171 | case SSL_ERROR_ZERO_RETURN: |
| 172 | errstr = "TLS/SSL connection has been closed"; |
| 173 | p = PY_SSL_ERROR_ZERO_RETURN; |
| 174 | break; |
| 175 | case SSL_ERROR_WANT_READ: |
| 176 | errstr = "The operation did not complete (read)"; |
| 177 | p = PY_SSL_ERROR_WANT_READ; |
| 178 | break; |
| 179 | case SSL_ERROR_WANT_WRITE: |
| 180 | p = PY_SSL_ERROR_WANT_WRITE; |
| 181 | errstr = "The operation did not complete (write)"; |
| 182 | break; |
| 183 | case SSL_ERROR_WANT_X509_LOOKUP: |
| 184 | p = PY_SSL_ERROR_WANT_X509_LOOKUP; |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 185 | errstr = "The operation did not complete (X509 lookup)"; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 186 | break; |
| 187 | case SSL_ERROR_WANT_CONNECT: |
| 188 | p = PY_SSL_ERROR_WANT_CONNECT; |
| 189 | errstr = "The operation did not complete (connect)"; |
| 190 | break; |
| 191 | case SSL_ERROR_SYSCALL: |
| 192 | { |
| 193 | unsigned long e = ERR_get_error(); |
| 194 | if (e == 0) { |
| 195 | PySocketSockObject *s |
| 196 | = (PySocketSockObject *) PyWeakref_GetObject(obj->Socket); |
| 197 | if (ret == 0 || (((PyObject *)s) == Py_None)) { |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 198 | p = PY_SSL_ERROR_EOF; |
| 199 | errstr = "EOF occurred in violation of protocol"; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 200 | } else if (ret == -1) { |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 201 | /* underlying BIO reported an I/O error */ |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 202 | Py_INCREF(s); |
Antoine Pitrou | 321257d | 2010-05-16 23:18:00 +0000 | [diff] [blame] | 203 | ERR_clear_error(); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 204 | v = s->errorhandler(); |
| 205 | Py_DECREF(s); |
| 206 | return v; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 207 | } else { /* possible? */ |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 208 | p = PY_SSL_ERROR_SYSCALL; |
| 209 | errstr = "Some I/O error occurred"; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 210 | } |
| 211 | } else { |
| 212 | p = PY_SSL_ERROR_SYSCALL; |
| 213 | /* XXX Protected by global interpreter lock */ |
| 214 | errstr = ERR_error_string(e, NULL); |
| 215 | } |
| 216 | break; |
| 217 | } |
| 218 | case SSL_ERROR_SSL: |
| 219 | { |
| 220 | unsigned long e = ERR_get_error(); |
| 221 | p = PY_SSL_ERROR_SSL; |
| 222 | if (e != 0) |
| 223 | /* XXX Protected by global interpreter lock */ |
| 224 | errstr = ERR_error_string(e, NULL); |
| 225 | else { /* possible? */ |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 226 | errstr = "A failure in the SSL library occurred"; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 227 | } |
| 228 | break; |
| 229 | } |
| 230 | default: |
| 231 | p = PY_SSL_ERROR_INVALID_ERROR_CODE; |
| 232 | errstr = "Invalid error code"; |
| 233 | } |
| 234 | } else { |
| 235 | errstr = ERR_error_string(ERR_peek_last_error(), NULL); |
| 236 | } |
| 237 | PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr); |
Antoine Pitrou | 321257d | 2010-05-16 23:18:00 +0000 | [diff] [blame] | 238 | ERR_clear_error(); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 239 | v = Py_BuildValue("(is)", p, buf); |
| 240 | if (v != NULL) { |
| 241 | PyErr_SetObject(PySSLErrorObject, v); |
| 242 | Py_DECREF(v); |
| 243 | } |
| 244 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 245 | } |
| 246 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 247 | static PyObject * |
| 248 | _setSSLError (char *errstr, int errcode, char *filename, int lineno) { |
| 249 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 250 | char buf[2048]; |
| 251 | PyObject *v; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 252 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 253 | if (errstr == NULL) { |
| 254 | errcode = ERR_peek_last_error(); |
| 255 | errstr = ERR_error_string(errcode, NULL); |
| 256 | } |
| 257 | PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr); |
Antoine Pitrou | 321257d | 2010-05-16 23:18:00 +0000 | [diff] [blame] | 258 | ERR_clear_error(); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 259 | v = Py_BuildValue("(is)", errcode, buf); |
| 260 | if (v != NULL) { |
| 261 | PyErr_SetObject(PySSLErrorObject, v); |
| 262 | Py_DECREF(v); |
| 263 | } |
| 264 | return NULL; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 265 | } |
| 266 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 267 | static PySSLObject * |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 268 | newPySSLObject(PySocketSockObject *Sock, char *key_file, char *cert_file, |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 269 | enum py_ssl_server_or_client socket_type, |
| 270 | enum py_ssl_cert_requirements certreq, |
| 271 | enum py_ssl_version proto_version, |
| 272 | char *cacerts_file) |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 273 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 274 | PySSLObject *self; |
| 275 | char *errstr = NULL; |
| 276 | int ret; |
| 277 | int verification_mode; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 278 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 279 | self = PyObject_New(PySSLObject, &PySSL_Type); /* Create new object */ |
| 280 | if (self == NULL) |
| 281 | return NULL; |
| 282 | self->peer_cert = NULL; |
| 283 | self->ssl = NULL; |
| 284 | self->ctx = NULL; |
| 285 | self->Socket = NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 286 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 287 | /* Make sure the SSL error state is initialized */ |
| 288 | (void) ERR_get_state(); |
| 289 | ERR_clear_error(); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 290 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 291 | if ((key_file && !cert_file) || (!key_file && cert_file)) { |
| 292 | errstr = ERRSTR("Both the key & certificate files " |
| 293 | "must be specified"); |
| 294 | goto fail; |
| 295 | } |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 296 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 297 | if ((socket_type == PY_SSL_SERVER) && |
| 298 | ((key_file == NULL) || (cert_file == NULL))) { |
| 299 | errstr = ERRSTR("Both the key & certificate files " |
| 300 | "must be specified for server-side operation"); |
| 301 | goto fail; |
| 302 | } |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 303 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 304 | PySSL_BEGIN_ALLOW_THREADS |
| 305 | if (proto_version == PY_SSL_VERSION_TLS1) |
| 306 | self->ctx = SSL_CTX_new(TLSv1_method()); /* Set up context */ |
| 307 | else if (proto_version == PY_SSL_VERSION_SSL3) |
| 308 | self->ctx = SSL_CTX_new(SSLv3_method()); /* Set up context */ |
| 309 | else if (proto_version == PY_SSL_VERSION_SSL2) |
| 310 | self->ctx = SSL_CTX_new(SSLv2_method()); /* Set up context */ |
| 311 | else if (proto_version == PY_SSL_VERSION_SSL23) |
| 312 | self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */ |
| 313 | PySSL_END_ALLOW_THREADS |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 314 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 315 | if (self->ctx == NULL) { |
| 316 | errstr = ERRSTR("Invalid SSL protocol variant specified."); |
| 317 | goto fail; |
| 318 | } |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 319 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 320 | if (certreq != PY_SSL_CERT_NONE) { |
| 321 | if (cacerts_file == NULL) { |
| 322 | errstr = ERRSTR("No root certificates specified for " |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 323 | "verification of other-side certificates."); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 324 | goto fail; |
| 325 | } else { |
| 326 | PySSL_BEGIN_ALLOW_THREADS |
| 327 | ret = SSL_CTX_load_verify_locations(self->ctx, |
| 328 | cacerts_file, |
| 329 | NULL); |
| 330 | PySSL_END_ALLOW_THREADS |
| 331 | if (ret != 1) { |
| 332 | _setSSLError(NULL, 0, __FILE__, __LINE__); |
| 333 | goto fail; |
| 334 | } |
| 335 | } |
| 336 | } |
| 337 | if (key_file) { |
| 338 | PySSL_BEGIN_ALLOW_THREADS |
| 339 | ret = SSL_CTX_use_PrivateKey_file(self->ctx, key_file, |
| 340 | SSL_FILETYPE_PEM); |
| 341 | PySSL_END_ALLOW_THREADS |
| 342 | if (ret != 1) { |
| 343 | _setSSLError(NULL, ret, __FILE__, __LINE__); |
| 344 | goto fail; |
| 345 | } |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 346 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 347 | PySSL_BEGIN_ALLOW_THREADS |
| 348 | ret = SSL_CTX_use_certificate_chain_file(self->ctx, |
| 349 | cert_file); |
| 350 | PySSL_END_ALLOW_THREADS |
| 351 | if (ret != 1) { |
| 352 | /* |
| 353 | fprintf(stderr, "ret is %d, errcode is %lu, %lu, with file \"%s\"\n", |
| 354 | ret, ERR_peek_error(), ERR_peek_last_error(), cert_file); |
| 355 | */ |
| 356 | if (ERR_peek_last_error() != 0) { |
| 357 | _setSSLError(NULL, ret, __FILE__, __LINE__); |
| 358 | goto fail; |
| 359 | } |
| 360 | } |
| 361 | } |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 362 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 363 | /* ssl compatibility */ |
| 364 | SSL_CTX_set_options(self->ctx, SSL_OP_ALL); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 365 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 366 | verification_mode = SSL_VERIFY_NONE; |
| 367 | if (certreq == PY_SSL_CERT_OPTIONAL) |
| 368 | verification_mode = SSL_VERIFY_PEER; |
| 369 | else if (certreq == PY_SSL_CERT_REQUIRED) |
| 370 | verification_mode = (SSL_VERIFY_PEER | |
| 371 | SSL_VERIFY_FAIL_IF_NO_PEER_CERT); |
| 372 | SSL_CTX_set_verify(self->ctx, verification_mode, |
| 373 | NULL); /* set verify lvl */ |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 374 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 375 | PySSL_BEGIN_ALLOW_THREADS |
| 376 | self->ssl = SSL_new(self->ctx); /* New ssl struct */ |
| 377 | PySSL_END_ALLOW_THREADS |
| 378 | SSL_set_fd(self->ssl, Sock->sock_fd); /* Set the socket for SSL */ |
Antoine Pitrou | d59ceb5 | 2010-04-09 20:47:00 +0000 | [diff] [blame] | 379 | #ifdef SSL_MODE_AUTO_RETRY |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 380 | SSL_set_mode(self->ssl, SSL_MODE_AUTO_RETRY); |
Antoine Pitrou | d59ceb5 | 2010-04-09 20:47:00 +0000 | [diff] [blame] | 381 | #endif |
Guido van Rossum | 4f707ac | 2003-01-31 18:13:18 +0000 | [diff] [blame] | 382 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 383 | /* If the socket is in non-blocking mode or timeout mode, set the BIO |
| 384 | * to non-blocking mode (blocking is the default) |
| 385 | */ |
| 386 | if (Sock->sock_timeout >= 0.0) { |
| 387 | /* Set both the read and write BIO's to non-blocking mode */ |
| 388 | BIO_set_nbio(SSL_get_rbio(self->ssl), 1); |
| 389 | BIO_set_nbio(SSL_get_wbio(self->ssl), 1); |
| 390 | } |
Guido van Rossum | 4f707ac | 2003-01-31 18:13:18 +0000 | [diff] [blame] | 391 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 392 | PySSL_BEGIN_ALLOW_THREADS |
| 393 | if (socket_type == PY_SSL_CLIENT) |
| 394 | SSL_set_connect_state(self->ssl); |
| 395 | else |
| 396 | SSL_set_accept_state(self->ssl); |
| 397 | PySSL_END_ALLOW_THREADS |
Martin v. Löwis | 09c35f7 | 2002-07-28 09:57:45 +0000 | [diff] [blame] | 398 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 399 | self->Socket = PyWeakref_NewRef((PyObject *) Sock, Py_None); |
| 400 | return self; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 401 | fail: |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 402 | if (errstr) |
| 403 | PyErr_SetString(PySSLErrorObject, errstr); |
| 404 | Py_DECREF(self); |
| 405 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 406 | } |
| 407 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 408 | static PyObject * |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 409 | PySSL_sslwrap(PyObject *self, PyObject *args) |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 410 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 411 | PySocketSockObject *Sock; |
| 412 | int server_side = 0; |
| 413 | int verification_mode = PY_SSL_CERT_NONE; |
| 414 | int protocol = PY_SSL_VERSION_SSL23; |
| 415 | char *key_file = NULL; |
| 416 | char *cert_file = NULL; |
| 417 | char *cacerts_file = NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 418 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 419 | if (!PyArg_ParseTuple(args, "O!i|zziiz:sslwrap", |
| 420 | PySocketModule.Sock_Type, |
| 421 | &Sock, |
| 422 | &server_side, |
| 423 | &key_file, &cert_file, |
| 424 | &verification_mode, &protocol, |
| 425 | &cacerts_file)) |
| 426 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 427 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 428 | /* |
| 429 | fprintf(stderr, |
| 430 | "server_side is %d, keyfile %p, certfile %p, verify_mode %d, " |
| 431 | "protocol %d, certs %p\n", |
| 432 | server_side, key_file, cert_file, verification_mode, |
| 433 | protocol, cacerts_file); |
| 434 | */ |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 435 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 436 | return (PyObject *) newPySSLObject(Sock, key_file, cert_file, |
| 437 | server_side, verification_mode, |
| 438 | protocol, cacerts_file); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 439 | } |
| 440 | |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 441 | PyDoc_STRVAR(ssl_doc, |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 442 | "sslwrap(socket, server_side, [keyfile, certfile, certs_mode, protocol,\n" |
| 443 | " cacertsfile]) -> sslobject"); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 444 | |
| 445 | /* SSL object methods */ |
| 446 | |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 447 | static PyObject *PySSL_SSLdo_handshake(PySSLObject *self) |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 448 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 449 | int ret; |
| 450 | int err; |
| 451 | int sockstate, nonblocking; |
| 452 | PySocketSockObject *sock |
| 453 | = (PySocketSockObject *) PyWeakref_GetObject(self->Socket); |
Antoine Pitrou | ec14618 | 2010-04-24 21:30:20 +0000 | [diff] [blame] | 454 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 455 | if (((PyObject*)sock) == Py_None) { |
| 456 | _setSSLError("Underlying socket connection gone", |
| 457 | PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__); |
| 458 | return NULL; |
| 459 | } |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 460 | Py_INCREF(sock); |
Antoine Pitrou | ec14618 | 2010-04-24 21:30:20 +0000 | [diff] [blame] | 461 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 462 | /* just in case the blocking state of the socket has been changed */ |
| 463 | nonblocking = (sock->sock_timeout >= 0.0); |
| 464 | BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking); |
| 465 | BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 466 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 467 | /* Actually negotiate SSL connection */ |
| 468 | /* XXX If SSL_do_handshake() returns 0, it's also a failure. */ |
| 469 | sockstate = 0; |
| 470 | do { |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 471 | PySSL_BEGIN_ALLOW_THREADS |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 472 | ret = SSL_do_handshake(self->ssl); |
| 473 | err = SSL_get_error(self->ssl, ret); |
| 474 | PySSL_END_ALLOW_THREADS |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 475 | if (PyErr_CheckSignals()) |
| 476 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 477 | if (err == SSL_ERROR_WANT_READ) { |
| 478 | sockstate = check_socket_and_wait_for_timeout(sock, 0); |
| 479 | } else if (err == SSL_ERROR_WANT_WRITE) { |
| 480 | sockstate = check_socket_and_wait_for_timeout(sock, 1); |
| 481 | } else { |
| 482 | sockstate = SOCKET_OPERATION_OK; |
| 483 | } |
| 484 | if (sockstate == SOCKET_HAS_TIMED_OUT) { |
| 485 | PyErr_SetString(PySSLErrorObject, |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 486 | ERRSTR("The handshake operation timed out")); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 487 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 488 | } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) { |
| 489 | PyErr_SetString(PySSLErrorObject, |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 490 | ERRSTR("Underlying socket has been closed.")); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 491 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 492 | } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) { |
| 493 | PyErr_SetString(PySSLErrorObject, |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 494 | ERRSTR("Underlying socket too large for select().")); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 495 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 496 | } else if (sockstate == SOCKET_IS_NONBLOCKING) { |
| 497 | break; |
| 498 | } |
| 499 | } while (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 500 | Py_DECREF(sock); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 501 | if (ret < 1) |
| 502 | return PySSL_SetError(self, ret, __FILE__, __LINE__); |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 503 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 504 | if (self->peer_cert) |
| 505 | X509_free (self->peer_cert); |
| 506 | PySSL_BEGIN_ALLOW_THREADS |
| 507 | self->peer_cert = SSL_get_peer_certificate(self->ssl); |
| 508 | PySSL_END_ALLOW_THREADS |
| 509 | |
| 510 | Py_INCREF(Py_None); |
| 511 | return Py_None; |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 512 | |
| 513 | error: |
| 514 | Py_DECREF(sock); |
| 515 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 516 | } |
| 517 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 518 | static PyObject * |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 519 | _create_tuple_for_attribute (ASN1_OBJECT *name, ASN1_STRING *value) { |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 520 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 521 | char namebuf[X509_NAME_MAXLEN]; |
| 522 | int buflen; |
| 523 | PyObject *name_obj; |
| 524 | PyObject *value_obj; |
| 525 | PyObject *attr; |
| 526 | unsigned char *valuebuf = NULL; |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 527 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 528 | buflen = OBJ_obj2txt(namebuf, sizeof(namebuf), name, 0); |
| 529 | if (buflen < 0) { |
| 530 | _setSSLError(NULL, 0, __FILE__, __LINE__); |
| 531 | goto fail; |
| 532 | } |
| 533 | name_obj = PyUnicode_FromStringAndSize(namebuf, buflen); |
| 534 | if (name_obj == NULL) |
| 535 | goto fail; |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 536 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 537 | buflen = ASN1_STRING_to_UTF8(&valuebuf, value); |
| 538 | if (buflen < 0) { |
| 539 | _setSSLError(NULL, 0, __FILE__, __LINE__); |
| 540 | Py_DECREF(name_obj); |
| 541 | goto fail; |
| 542 | } |
| 543 | value_obj = PyUnicode_DecodeUTF8((char *) valuebuf, |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 544 | buflen, "strict"); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 545 | OPENSSL_free(valuebuf); |
| 546 | if (value_obj == NULL) { |
| 547 | Py_DECREF(name_obj); |
| 548 | goto fail; |
| 549 | } |
| 550 | attr = PyTuple_New(2); |
| 551 | if (attr == NULL) { |
| 552 | Py_DECREF(name_obj); |
| 553 | Py_DECREF(value_obj); |
| 554 | goto fail; |
| 555 | } |
| 556 | PyTuple_SET_ITEM(attr, 0, name_obj); |
| 557 | PyTuple_SET_ITEM(attr, 1, value_obj); |
| 558 | return attr; |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 559 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 560 | fail: |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 561 | return NULL; |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 562 | } |
| 563 | |
| 564 | static PyObject * |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 565 | _create_tuple_for_X509_NAME (X509_NAME *xname) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 566 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 567 | PyObject *dn = NULL; /* tuple which represents the "distinguished name" */ |
| 568 | PyObject *rdn = NULL; /* tuple to hold a "relative distinguished name" */ |
| 569 | PyObject *rdnt; |
| 570 | PyObject *attr = NULL; /* tuple to hold an attribute */ |
| 571 | int entry_count = X509_NAME_entry_count(xname); |
| 572 | X509_NAME_ENTRY *entry; |
| 573 | ASN1_OBJECT *name; |
| 574 | ASN1_STRING *value; |
| 575 | int index_counter; |
| 576 | int rdn_level = -1; |
| 577 | int retcode; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 578 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 579 | dn = PyList_New(0); |
| 580 | if (dn == NULL) |
| 581 | return NULL; |
| 582 | /* now create another tuple to hold the top-level RDN */ |
| 583 | rdn = PyList_New(0); |
| 584 | if (rdn == NULL) |
| 585 | goto fail0; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 586 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 587 | for (index_counter = 0; |
| 588 | index_counter < entry_count; |
| 589 | index_counter++) |
| 590 | { |
| 591 | entry = X509_NAME_get_entry(xname, index_counter); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 592 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 593 | /* check to see if we've gotten to a new RDN */ |
| 594 | if (rdn_level >= 0) { |
| 595 | if (rdn_level != entry->set) { |
| 596 | /* yes, new RDN */ |
| 597 | /* add old RDN to DN */ |
| 598 | rdnt = PyList_AsTuple(rdn); |
| 599 | Py_DECREF(rdn); |
| 600 | if (rdnt == NULL) |
| 601 | goto fail0; |
| 602 | retcode = PyList_Append(dn, rdnt); |
| 603 | Py_DECREF(rdnt); |
| 604 | if (retcode < 0) |
| 605 | goto fail0; |
| 606 | /* create new RDN */ |
| 607 | rdn = PyList_New(0); |
| 608 | if (rdn == NULL) |
| 609 | goto fail0; |
| 610 | } |
| 611 | } |
| 612 | rdn_level = entry->set; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 613 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 614 | /* now add this attribute to the current RDN */ |
| 615 | name = X509_NAME_ENTRY_get_object(entry); |
| 616 | value = X509_NAME_ENTRY_get_data(entry); |
| 617 | attr = _create_tuple_for_attribute(name, value); |
| 618 | /* |
| 619 | fprintf(stderr, "RDN level %d, attribute %s: %s\n", |
| 620 | entry->set, |
| 621 | PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 0)), |
| 622 | PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 1))); |
| 623 | */ |
| 624 | if (attr == NULL) |
| 625 | goto fail1; |
| 626 | retcode = PyList_Append(rdn, attr); |
| 627 | Py_DECREF(attr); |
| 628 | if (retcode < 0) |
| 629 | goto fail1; |
| 630 | } |
| 631 | /* now, there's typically a dangling RDN */ |
| 632 | if ((rdn != NULL) && (PyList_Size(rdn) > 0)) { |
| 633 | rdnt = PyList_AsTuple(rdn); |
| 634 | Py_DECREF(rdn); |
| 635 | if (rdnt == NULL) |
| 636 | goto fail0; |
| 637 | retcode = PyList_Append(dn, rdnt); |
| 638 | Py_DECREF(rdnt); |
| 639 | if (retcode < 0) |
| 640 | goto fail0; |
| 641 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 642 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 643 | /* convert list to tuple */ |
| 644 | rdnt = PyList_AsTuple(dn); |
| 645 | Py_DECREF(dn); |
| 646 | if (rdnt == NULL) |
| 647 | return NULL; |
| 648 | return rdnt; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 649 | |
| 650 | fail1: |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 651 | Py_XDECREF(rdn); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 652 | |
| 653 | fail0: |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 654 | Py_XDECREF(dn); |
| 655 | return NULL; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 656 | } |
| 657 | |
| 658 | static PyObject * |
| 659 | _get_peer_alt_names (X509 *certificate) { |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 660 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 661 | /* this code follows the procedure outlined in |
| 662 | OpenSSL's crypto/x509v3/v3_prn.c:X509v3_EXT_print() |
| 663 | function to extract the STACK_OF(GENERAL_NAME), |
| 664 | then iterates through the stack to add the |
| 665 | names. */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 666 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 667 | int i, j; |
| 668 | PyObject *peer_alt_names = Py_None; |
| 669 | PyObject *v, *t; |
| 670 | X509_EXTENSION *ext = NULL; |
| 671 | GENERAL_NAMES *names = NULL; |
| 672 | GENERAL_NAME *name; |
Benjamin Peterson | 3137095 | 2010-10-13 22:20:48 +0000 | [diff] [blame] | 673 | const X509V3_EXT_METHOD *method; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 674 | BIO *biobuf = NULL; |
| 675 | char buf[2048]; |
| 676 | char *vptr; |
| 677 | int len; |
| 678 | /* Issue #2973: ASN1_item_d2i() API changed in OpenSSL 0.9.6m */ |
Victor Stinner | 117ff17 | 2010-03-02 22:49:30 +0000 | [diff] [blame] | 679 | #if OPENSSL_VERSION_NUMBER >= 0x009060dfL |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 680 | const unsigned char *p; |
Victor Stinner | 117ff17 | 2010-03-02 22:49:30 +0000 | [diff] [blame] | 681 | #else |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 682 | unsigned char *p; |
Victor Stinner | 117ff17 | 2010-03-02 22:49:30 +0000 | [diff] [blame] | 683 | #endif |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 684 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 685 | if (certificate == NULL) |
| 686 | return peer_alt_names; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 687 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 688 | /* get a memory buffer */ |
| 689 | biobuf = BIO_new(BIO_s_mem()); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 690 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 691 | i = 0; |
| 692 | while ((i = X509_get_ext_by_NID( |
| 693 | certificate, NID_subject_alt_name, i)) >= 0) { |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 694 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 695 | if (peer_alt_names == Py_None) { |
| 696 | peer_alt_names = PyList_New(0); |
| 697 | if (peer_alt_names == NULL) |
| 698 | goto fail; |
| 699 | } |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 700 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 701 | /* now decode the altName */ |
| 702 | ext = X509_get_ext(certificate, i); |
| 703 | if(!(method = X509V3_EXT_get(ext))) { |
| 704 | PyErr_SetString |
| 705 | (PySSLErrorObject, |
| 706 | ERRSTR("No method for internalizing subjectAltName!")); |
| 707 | goto fail; |
| 708 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 709 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 710 | p = ext->value->data; |
| 711 | if (method->it) |
| 712 | names = (GENERAL_NAMES*) |
| 713 | (ASN1_item_d2i(NULL, |
| 714 | &p, |
| 715 | ext->value->length, |
| 716 | ASN1_ITEM_ptr(method->it))); |
| 717 | else |
| 718 | names = (GENERAL_NAMES*) |
| 719 | (method->d2i(NULL, |
| 720 | &p, |
| 721 | ext->value->length)); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 722 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 723 | for(j = 0; j < sk_GENERAL_NAME_num(names); j++) { |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 724 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 725 | /* get a rendering of each name in the set of names */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 726 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 727 | name = sk_GENERAL_NAME_value(names, j); |
| 728 | if (name->type == GEN_DIRNAME) { |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 729 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 730 | /* we special-case DirName as a tuple of |
| 731 | tuples of attributes */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 732 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 733 | t = PyTuple_New(2); |
| 734 | if (t == NULL) { |
| 735 | goto fail; |
| 736 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 737 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 738 | v = PyUnicode_FromString("DirName"); |
| 739 | if (v == NULL) { |
| 740 | Py_DECREF(t); |
| 741 | goto fail; |
| 742 | } |
| 743 | PyTuple_SET_ITEM(t, 0, v); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 744 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 745 | v = _create_tuple_for_X509_NAME (name->d.dirn); |
| 746 | if (v == NULL) { |
| 747 | Py_DECREF(t); |
| 748 | goto fail; |
| 749 | } |
| 750 | PyTuple_SET_ITEM(t, 1, v); |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 751 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 752 | } else { |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 753 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 754 | /* for everything else, we use the OpenSSL print form */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 755 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 756 | (void) BIO_reset(biobuf); |
| 757 | GENERAL_NAME_print(biobuf, name); |
| 758 | len = BIO_gets(biobuf, buf, sizeof(buf)-1); |
| 759 | if (len < 0) { |
| 760 | _setSSLError(NULL, 0, __FILE__, __LINE__); |
| 761 | goto fail; |
| 762 | } |
| 763 | vptr = strchr(buf, ':'); |
| 764 | if (vptr == NULL) |
| 765 | goto fail; |
| 766 | t = PyTuple_New(2); |
| 767 | if (t == NULL) |
| 768 | goto fail; |
| 769 | v = PyUnicode_FromStringAndSize(buf, (vptr - buf)); |
| 770 | if (v == NULL) { |
| 771 | Py_DECREF(t); |
| 772 | goto fail; |
| 773 | } |
| 774 | PyTuple_SET_ITEM(t, 0, v); |
| 775 | v = PyUnicode_FromStringAndSize((vptr + 1), |
| 776 | (len - (vptr - buf + 1))); |
| 777 | if (v == NULL) { |
| 778 | Py_DECREF(t); |
| 779 | goto fail; |
| 780 | } |
| 781 | PyTuple_SET_ITEM(t, 1, v); |
| 782 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 783 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 784 | /* and add that rendering to the list */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 785 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 786 | if (PyList_Append(peer_alt_names, t) < 0) { |
| 787 | Py_DECREF(t); |
| 788 | goto fail; |
| 789 | } |
| 790 | Py_DECREF(t); |
| 791 | } |
| 792 | } |
| 793 | BIO_free(biobuf); |
| 794 | if (peer_alt_names != Py_None) { |
| 795 | v = PyList_AsTuple(peer_alt_names); |
| 796 | Py_DECREF(peer_alt_names); |
| 797 | return v; |
| 798 | } else { |
| 799 | return peer_alt_names; |
| 800 | } |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 801 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 802 | |
| 803 | fail: |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 804 | if (biobuf != NULL) |
| 805 | BIO_free(biobuf); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 806 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 807 | if (peer_alt_names != Py_None) { |
| 808 | Py_XDECREF(peer_alt_names); |
| 809 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 810 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 811 | return NULL; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 812 | } |
| 813 | |
| 814 | static PyObject * |
| 815 | _decode_certificate (X509 *certificate, int verbose) { |
| 816 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 817 | PyObject *retval = NULL; |
| 818 | BIO *biobuf = NULL; |
| 819 | PyObject *peer; |
| 820 | PyObject *peer_alt_names = NULL; |
| 821 | PyObject *issuer; |
| 822 | PyObject *version; |
| 823 | PyObject *sn_obj; |
| 824 | ASN1_INTEGER *serialNumber; |
| 825 | char buf[2048]; |
| 826 | int len; |
| 827 | ASN1_TIME *notBefore, *notAfter; |
| 828 | PyObject *pnotBefore, *pnotAfter; |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 829 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 830 | retval = PyDict_New(); |
| 831 | if (retval == NULL) |
| 832 | return NULL; |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 833 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 834 | peer = _create_tuple_for_X509_NAME( |
| 835 | X509_get_subject_name(certificate)); |
| 836 | if (peer == NULL) |
| 837 | goto fail0; |
| 838 | if (PyDict_SetItemString(retval, (const char *) "subject", peer) < 0) { |
| 839 | Py_DECREF(peer); |
| 840 | goto fail0; |
| 841 | } |
| 842 | Py_DECREF(peer); |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 843 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 844 | if (verbose) { |
| 845 | issuer = _create_tuple_for_X509_NAME( |
| 846 | X509_get_issuer_name(certificate)); |
| 847 | if (issuer == NULL) |
| 848 | goto fail0; |
| 849 | if (PyDict_SetItemString(retval, (const char *)"issuer", issuer) < 0) { |
| 850 | Py_DECREF(issuer); |
| 851 | goto fail0; |
| 852 | } |
| 853 | Py_DECREF(issuer); |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 854 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 855 | version = PyLong_FromLong(X509_get_version(certificate) + 1); |
| 856 | if (PyDict_SetItemString(retval, "version", version) < 0) { |
| 857 | Py_DECREF(version); |
| 858 | goto fail0; |
| 859 | } |
| 860 | Py_DECREF(version); |
| 861 | } |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 862 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 863 | /* get a memory buffer */ |
| 864 | biobuf = BIO_new(BIO_s_mem()); |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 865 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 866 | if (verbose) { |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 867 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 868 | (void) BIO_reset(biobuf); |
| 869 | serialNumber = X509_get_serialNumber(certificate); |
| 870 | /* should not exceed 20 octets, 160 bits, so buf is big enough */ |
| 871 | i2a_ASN1_INTEGER(biobuf, serialNumber); |
| 872 | len = BIO_gets(biobuf, buf, sizeof(buf)-1); |
| 873 | if (len < 0) { |
| 874 | _setSSLError(NULL, 0, __FILE__, __LINE__); |
| 875 | goto fail1; |
| 876 | } |
| 877 | sn_obj = PyUnicode_FromStringAndSize(buf, len); |
| 878 | if (sn_obj == NULL) |
| 879 | goto fail1; |
| 880 | if (PyDict_SetItemString(retval, "serialNumber", sn_obj) < 0) { |
| 881 | Py_DECREF(sn_obj); |
| 882 | goto fail1; |
| 883 | } |
| 884 | Py_DECREF(sn_obj); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 885 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 886 | (void) BIO_reset(biobuf); |
| 887 | notBefore = X509_get_notBefore(certificate); |
| 888 | ASN1_TIME_print(biobuf, notBefore); |
| 889 | len = BIO_gets(biobuf, buf, sizeof(buf)-1); |
| 890 | if (len < 0) { |
| 891 | _setSSLError(NULL, 0, __FILE__, __LINE__); |
| 892 | goto fail1; |
| 893 | } |
| 894 | pnotBefore = PyUnicode_FromStringAndSize(buf, len); |
| 895 | if (pnotBefore == NULL) |
| 896 | goto fail1; |
| 897 | if (PyDict_SetItemString(retval, "notBefore", pnotBefore) < 0) { |
| 898 | Py_DECREF(pnotBefore); |
| 899 | goto fail1; |
| 900 | } |
| 901 | Py_DECREF(pnotBefore); |
| 902 | } |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 903 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 904 | (void) BIO_reset(biobuf); |
| 905 | notAfter = X509_get_notAfter(certificate); |
| 906 | ASN1_TIME_print(biobuf, notAfter); |
| 907 | len = BIO_gets(biobuf, buf, sizeof(buf)-1); |
| 908 | if (len < 0) { |
| 909 | _setSSLError(NULL, 0, __FILE__, __LINE__); |
| 910 | goto fail1; |
| 911 | } |
| 912 | pnotAfter = PyUnicode_FromStringAndSize(buf, len); |
| 913 | if (pnotAfter == NULL) |
| 914 | goto fail1; |
| 915 | if (PyDict_SetItemString(retval, "notAfter", pnotAfter) < 0) { |
| 916 | Py_DECREF(pnotAfter); |
| 917 | goto fail1; |
| 918 | } |
| 919 | Py_DECREF(pnotAfter); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 920 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 921 | /* Now look for subjectAltName */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 922 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 923 | peer_alt_names = _get_peer_alt_names(certificate); |
| 924 | if (peer_alt_names == NULL) |
| 925 | goto fail1; |
| 926 | else if (peer_alt_names != Py_None) { |
| 927 | if (PyDict_SetItemString(retval, "subjectAltName", |
| 928 | peer_alt_names) < 0) { |
| 929 | Py_DECREF(peer_alt_names); |
| 930 | goto fail1; |
| 931 | } |
| 932 | Py_DECREF(peer_alt_names); |
| 933 | } |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 934 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 935 | BIO_free(biobuf); |
| 936 | return retval; |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 937 | |
| 938 | fail1: |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 939 | if (biobuf != NULL) |
| 940 | BIO_free(biobuf); |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 941 | fail0: |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 942 | Py_XDECREF(retval); |
| 943 | return NULL; |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 944 | } |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 945 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 946 | |
| 947 | static PyObject * |
| 948 | PySSL_test_decode_certificate (PyObject *mod, PyObject *args) { |
| 949 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 950 | PyObject *retval = NULL; |
| 951 | char *filename = NULL; |
| 952 | X509 *x=NULL; |
| 953 | BIO *cert; |
| 954 | int verbose = 1; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 955 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 956 | if (!PyArg_ParseTuple(args, "s|i:test_decode_certificate", |
| 957 | &filename, &verbose)) |
| 958 | return NULL; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 959 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 960 | if ((cert=BIO_new(BIO_s_file())) == NULL) { |
| 961 | PyErr_SetString(PySSLErrorObject, |
| 962 | "Can't malloc memory to read file"); |
| 963 | goto fail0; |
| 964 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 965 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 966 | if (BIO_read_filename(cert,filename) <= 0) { |
| 967 | PyErr_SetString(PySSLErrorObject, |
| 968 | "Can't open file"); |
| 969 | goto fail0; |
| 970 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 971 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 972 | x = PEM_read_bio_X509_AUX(cert,NULL, NULL, NULL); |
| 973 | if (x == NULL) { |
| 974 | PyErr_SetString(PySSLErrorObject, |
| 975 | "Error decoding PEM-encoded file"); |
| 976 | goto fail0; |
| 977 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 978 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 979 | retval = _decode_certificate(x, verbose); |
Mark Dickinson | 732cc9b | 2010-08-03 18:33:11 +0000 | [diff] [blame] | 980 | X509_free(x); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 981 | |
| 982 | fail0: |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 983 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 984 | if (cert != NULL) BIO_free(cert); |
| 985 | return retval; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 986 | } |
| 987 | |
| 988 | |
| 989 | static PyObject * |
| 990 | PySSL_peercert(PySSLObject *self, PyObject *args) |
| 991 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 992 | PyObject *retval = NULL; |
| 993 | int len; |
| 994 | int verification; |
| 995 | PyObject *binary_mode = Py_None; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 996 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 997 | if (!PyArg_ParseTuple(args, "|O:peer_certificate", &binary_mode)) |
| 998 | return NULL; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 999 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1000 | if (!self->peer_cert) |
| 1001 | Py_RETURN_NONE; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1002 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1003 | if (PyObject_IsTrue(binary_mode)) { |
| 1004 | /* return cert in DER-encoded format */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1005 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1006 | unsigned char *bytes_buf = NULL; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1007 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1008 | bytes_buf = NULL; |
| 1009 | len = i2d_X509(self->peer_cert, &bytes_buf); |
| 1010 | if (len < 0) { |
| 1011 | PySSL_SetError(self, len, __FILE__, __LINE__); |
| 1012 | return NULL; |
| 1013 | } |
| 1014 | /* this is actually an immutable bytes sequence */ |
| 1015 | retval = PyBytes_FromStringAndSize |
| 1016 | ((const char *) bytes_buf, len); |
| 1017 | OPENSSL_free(bytes_buf); |
| 1018 | return retval; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1019 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1020 | } else { |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1021 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1022 | verification = SSL_CTX_get_verify_mode(self->ctx); |
| 1023 | if ((verification & SSL_VERIFY_PEER) == 0) |
| 1024 | return PyDict_New(); |
| 1025 | else |
| 1026 | return _decode_certificate (self->peer_cert, 0); |
| 1027 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1028 | } |
| 1029 | |
| 1030 | PyDoc_STRVAR(PySSL_peercert_doc, |
| 1031 | "peer_certificate([der=False]) -> certificate\n\ |
| 1032 | \n\ |
| 1033 | Returns the certificate for the peer. If no certificate was provided,\n\ |
| 1034 | returns None. If a certificate was provided, but not validated, returns\n\ |
| 1035 | an empty dictionary. Otherwise returns a dict containing information\n\ |
| 1036 | about the peer certificate.\n\ |
| 1037 | \n\ |
| 1038 | If the optional argument is True, returns a DER-encoded copy of the\n\ |
| 1039 | peer certificate, or None if no certificate was provided. This will\n\ |
| 1040 | return the certificate even if it wasn't validated."); |
| 1041 | |
| 1042 | static PyObject *PySSL_cipher (PySSLObject *self) { |
| 1043 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1044 | PyObject *retval, *v; |
Benjamin Peterson | 3137095 | 2010-10-13 22:20:48 +0000 | [diff] [blame] | 1045 | const SSL_CIPHER *current; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1046 | char *cipher_name; |
| 1047 | char *cipher_protocol; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1048 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1049 | if (self->ssl == NULL) |
| 1050 | return Py_None; |
| 1051 | current = SSL_get_current_cipher(self->ssl); |
| 1052 | if (current == NULL) |
| 1053 | return Py_None; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1054 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1055 | retval = PyTuple_New(3); |
| 1056 | if (retval == NULL) |
| 1057 | return NULL; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1058 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1059 | cipher_name = (char *) SSL_CIPHER_get_name(current); |
| 1060 | if (cipher_name == NULL) { |
| 1061 | PyTuple_SET_ITEM(retval, 0, Py_None); |
| 1062 | } else { |
| 1063 | v = PyUnicode_FromString(cipher_name); |
| 1064 | if (v == NULL) |
| 1065 | goto fail0; |
| 1066 | PyTuple_SET_ITEM(retval, 0, v); |
| 1067 | } |
| 1068 | cipher_protocol = SSL_CIPHER_get_version(current); |
| 1069 | if (cipher_protocol == NULL) { |
| 1070 | PyTuple_SET_ITEM(retval, 1, Py_None); |
| 1071 | } else { |
| 1072 | v = PyUnicode_FromString(cipher_protocol); |
| 1073 | if (v == NULL) |
| 1074 | goto fail0; |
| 1075 | PyTuple_SET_ITEM(retval, 1, v); |
| 1076 | } |
| 1077 | v = PyLong_FromLong(SSL_CIPHER_get_bits(current, NULL)); |
| 1078 | if (v == NULL) |
| 1079 | goto fail0; |
| 1080 | PyTuple_SET_ITEM(retval, 2, v); |
| 1081 | return retval; |
Guido van Rossum | f06628b | 2007-11-21 20:01:53 +0000 | [diff] [blame] | 1082 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1083 | fail0: |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1084 | Py_DECREF(retval); |
| 1085 | return NULL; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1086 | } |
| 1087 | |
Guido van Rossum | e6650f9 | 2007-12-06 19:05:55 +0000 | [diff] [blame] | 1088 | static void PySSL_dealloc(PySSLObject *self) |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1089 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1090 | if (self->peer_cert) /* Possible not to have one? */ |
| 1091 | X509_free (self->peer_cert); |
| 1092 | if (self->ssl) |
| 1093 | SSL_free(self->ssl); |
| 1094 | if (self->ctx) |
| 1095 | SSL_CTX_free(self->ctx); |
| 1096 | Py_XDECREF(self->Socket); |
| 1097 | PyObject_Del(self); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1098 | } |
| 1099 | |
Thomas Wouters | 0e3f591 | 2006-08-11 14:57:12 +0000 | [diff] [blame] | 1100 | /* If the socket has a timeout, do a select()/poll() on the socket. |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1101 | The argument writing indicates the direction. |
Andrew M. Kuchling | 9c3efe3 | 2004-07-10 21:15:17 +0000 | [diff] [blame] | 1102 | Returns one of the possibilities in the timeout_state enum (above). |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1103 | */ |
Andrew M. Kuchling | 9c3efe3 | 2004-07-10 21:15:17 +0000 | [diff] [blame] | 1104 | |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1105 | static int |
Andrew M. Kuchling | 9c3efe3 | 2004-07-10 21:15:17 +0000 | [diff] [blame] | 1106 | check_socket_and_wait_for_timeout(PySocketSockObject *s, int writing) |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1107 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1108 | fd_set fds; |
| 1109 | struct timeval tv; |
| 1110 | int rc; |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1111 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1112 | /* Nothing to do unless we're in timeout mode (not non-blocking) */ |
| 1113 | if (s->sock_timeout < 0.0) |
| 1114 | return SOCKET_IS_BLOCKING; |
| 1115 | else if (s->sock_timeout == 0.0) |
| 1116 | return SOCKET_IS_NONBLOCKING; |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1117 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1118 | /* Guard against closed socket */ |
| 1119 | if (s->sock_fd < 0) |
| 1120 | return SOCKET_HAS_BEEN_CLOSED; |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1121 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1122 | /* Prefer poll, if available, since you can poll() any fd |
| 1123 | * which can't be done with select(). */ |
Thomas Wouters | 0e3f591 | 2006-08-11 14:57:12 +0000 | [diff] [blame] | 1124 | #ifdef HAVE_POLL |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1125 | { |
| 1126 | struct pollfd pollfd; |
| 1127 | int timeout; |
Thomas Wouters | 0e3f591 | 2006-08-11 14:57:12 +0000 | [diff] [blame] | 1128 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1129 | pollfd.fd = s->sock_fd; |
| 1130 | pollfd.events = writing ? POLLOUT : POLLIN; |
Thomas Wouters | 0e3f591 | 2006-08-11 14:57:12 +0000 | [diff] [blame] | 1131 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1132 | /* s->sock_timeout is in seconds, timeout in ms */ |
| 1133 | timeout = (int)(s->sock_timeout * 1000 + 0.5); |
| 1134 | PySSL_BEGIN_ALLOW_THREADS |
| 1135 | rc = poll(&pollfd, 1, timeout); |
| 1136 | PySSL_END_ALLOW_THREADS |
Thomas Wouters | 0e3f591 | 2006-08-11 14:57:12 +0000 | [diff] [blame] | 1137 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1138 | goto normal_return; |
| 1139 | } |
Thomas Wouters | 0e3f591 | 2006-08-11 14:57:12 +0000 | [diff] [blame] | 1140 | #endif |
| 1141 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1142 | /* Guard against socket too large for select*/ |
Martin v. Löwis | f84d1b9 | 2006-02-11 09:27:05 +0000 | [diff] [blame] | 1143 | #ifndef Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1144 | if (s->sock_fd >= FD_SETSIZE) |
| 1145 | return SOCKET_TOO_LARGE_FOR_SELECT; |
Martin v. Löwis | f84d1b9 | 2006-02-11 09:27:05 +0000 | [diff] [blame] | 1146 | #endif |
Neal Norwitz | 082b2df | 2006-02-07 07:04:46 +0000 | [diff] [blame] | 1147 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1148 | /* Construct the arguments to select */ |
| 1149 | tv.tv_sec = (int)s->sock_timeout; |
| 1150 | tv.tv_usec = (int)((s->sock_timeout - tv.tv_sec) * 1e6); |
| 1151 | FD_ZERO(&fds); |
| 1152 | FD_SET(s->sock_fd, &fds); |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1153 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1154 | /* See if the socket is ready */ |
| 1155 | PySSL_BEGIN_ALLOW_THREADS |
| 1156 | if (writing) |
| 1157 | rc = select(s->sock_fd+1, NULL, &fds, NULL, &tv); |
| 1158 | else |
| 1159 | rc = select(s->sock_fd+1, &fds, NULL, NULL, &tv); |
| 1160 | PySSL_END_ALLOW_THREADS |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1161 | |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1162 | #ifdef HAVE_POLL |
Thomas Wouters | 0e3f591 | 2006-08-11 14:57:12 +0000 | [diff] [blame] | 1163 | normal_return: |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1164 | #endif |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1165 | /* Return SOCKET_TIMED_OUT on timeout, SOCKET_OPERATION_OK otherwise |
| 1166 | (when we are able to write or when there's something to read) */ |
| 1167 | return rc == 0 ? SOCKET_HAS_TIMED_OUT : SOCKET_OPERATION_OK; |
Guido van Rossum | 99d4abf | 2003-01-27 22:22:50 +0000 | [diff] [blame] | 1168 | } |
| 1169 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1170 | static PyObject *PySSL_SSLwrite(PySSLObject *self, PyObject *args) |
| 1171 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1172 | char *data; |
| 1173 | int len; |
| 1174 | int count; |
| 1175 | int sockstate; |
| 1176 | int err; |
| 1177 | int nonblocking; |
| 1178 | PySocketSockObject *sock |
| 1179 | = (PySocketSockObject *) PyWeakref_GetObject(self->Socket); |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 1180 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1181 | if (((PyObject*)sock) == Py_None) { |
| 1182 | _setSSLError("Underlying socket connection gone", |
| 1183 | PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__); |
| 1184 | return NULL; |
| 1185 | } |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1186 | Py_INCREF(sock); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1187 | |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1188 | if (!PyArg_ParseTuple(args, "y#:write", &data, &count)) { |
| 1189 | Py_DECREF(sock); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1190 | return NULL; |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1191 | } |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1192 | |
| 1193 | /* just in case the blocking state of the socket has been changed */ |
| 1194 | nonblocking = (sock->sock_timeout >= 0.0); |
| 1195 | BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking); |
| 1196 | BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking); |
| 1197 | |
| 1198 | sockstate = check_socket_and_wait_for_timeout(sock, 1); |
| 1199 | if (sockstate == SOCKET_HAS_TIMED_OUT) { |
| 1200 | PyErr_SetString(PySSLErrorObject, |
| 1201 | "The write operation timed out"); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1202 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1203 | } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) { |
| 1204 | PyErr_SetString(PySSLErrorObject, |
| 1205 | "Underlying socket has been closed."); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1206 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1207 | } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) { |
| 1208 | PyErr_SetString(PySSLErrorObject, |
| 1209 | "Underlying socket too large for select()."); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1210 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1211 | } |
| 1212 | do { |
| 1213 | err = 0; |
| 1214 | PySSL_BEGIN_ALLOW_THREADS |
| 1215 | len = SSL_write(self->ssl, data, count); |
| 1216 | err = SSL_get_error(self->ssl, len); |
| 1217 | PySSL_END_ALLOW_THREADS |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1218 | if (PyErr_CheckSignals()) |
| 1219 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1220 | if (err == SSL_ERROR_WANT_READ) { |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 1221 | sockstate = check_socket_and_wait_for_timeout(sock, 0); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1222 | } else if (err == SSL_ERROR_WANT_WRITE) { |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 1223 | sockstate = check_socket_and_wait_for_timeout(sock, 1); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1224 | } else { |
| 1225 | sockstate = SOCKET_OPERATION_OK; |
| 1226 | } |
| 1227 | if (sockstate == SOCKET_HAS_TIMED_OUT) { |
| 1228 | PyErr_SetString(PySSLErrorObject, |
| 1229 | "The write operation timed out"); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1230 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1231 | } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) { |
| 1232 | PyErr_SetString(PySSLErrorObject, |
| 1233 | "Underlying socket has been closed."); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1234 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1235 | } else if (sockstate == SOCKET_IS_NONBLOCKING) { |
| 1236 | break; |
| 1237 | } |
| 1238 | } while (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1239 | |
| 1240 | Py_DECREF(sock); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1241 | if (len > 0) |
| 1242 | return PyLong_FromLong(len); |
| 1243 | else |
| 1244 | return PySSL_SetError(self, len, __FILE__, __LINE__); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1245 | |
| 1246 | error: |
| 1247 | Py_DECREF(sock); |
| 1248 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1249 | } |
| 1250 | |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1251 | PyDoc_STRVAR(PySSL_SSLwrite_doc, |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1252 | "write(s) -> len\n\ |
| 1253 | \n\ |
| 1254 | Writes the string s into the SSL object. Returns the number\n\ |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1255 | of bytes written."); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1256 | |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1257 | static PyObject *PySSL_SSLpending(PySSLObject *self) |
| 1258 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1259 | int count = 0; |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1260 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1261 | PySSL_BEGIN_ALLOW_THREADS |
| 1262 | count = SSL_pending(self->ssl); |
| 1263 | PySSL_END_ALLOW_THREADS |
| 1264 | if (count < 0) |
| 1265 | return PySSL_SetError(self, count, __FILE__, __LINE__); |
| 1266 | else |
| 1267 | return PyLong_FromLong(count); |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1268 | } |
| 1269 | |
| 1270 | PyDoc_STRVAR(PySSL_SSLpending_doc, |
| 1271 | "pending() -> count\n\ |
| 1272 | \n\ |
| 1273 | Returns the number of already decrypted bytes available for read,\n\ |
| 1274 | pending on the connection.\n"); |
| 1275 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1276 | static PyObject *PySSL_SSLread(PySSLObject *self, PyObject *args) |
| 1277 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1278 | PyObject *dest = NULL; |
| 1279 | Py_buffer buf; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1280 | char *mem; |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1281 | int len, count; |
| 1282 | int buf_passed = 0; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1283 | int sockstate; |
| 1284 | int err; |
| 1285 | int nonblocking; |
| 1286 | PySocketSockObject *sock |
| 1287 | = (PySocketSockObject *) PyWeakref_GetObject(self->Socket); |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 1288 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1289 | if (((PyObject*)sock) == Py_None) { |
| 1290 | _setSSLError("Underlying socket connection gone", |
| 1291 | PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__); |
| 1292 | return NULL; |
| 1293 | } |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1294 | Py_INCREF(sock); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1295 | |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1296 | buf.obj = NULL; |
| 1297 | buf.buf = NULL; |
| 1298 | if (!PyArg_ParseTuple(args, "i|w*:read", &len, &buf)) |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1299 | goto error; |
| 1300 | |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1301 | if ((buf.buf == NULL) && (buf.obj == NULL)) { |
| 1302 | dest = PyBytes_FromStringAndSize(NULL, len); |
| 1303 | if (dest == NULL) |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1304 | goto error; |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1305 | mem = PyBytes_AS_STRING(dest); |
| 1306 | } |
| 1307 | else { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1308 | buf_passed = 1; |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1309 | mem = buf.buf; |
| 1310 | if (len <= 0 || len > buf.len) { |
| 1311 | len = (int) buf.len; |
| 1312 | if (buf.len != len) { |
| 1313 | PyErr_SetString(PyExc_OverflowError, |
| 1314 | "maximum length can't fit in a C 'int'"); |
| 1315 | goto error; |
| 1316 | } |
| 1317 | } |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1318 | } |
| 1319 | |
| 1320 | /* just in case the blocking state of the socket has been changed */ |
| 1321 | nonblocking = (sock->sock_timeout >= 0.0); |
| 1322 | BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking); |
| 1323 | BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking); |
| 1324 | |
| 1325 | /* first check if there are bytes ready to be read */ |
| 1326 | PySSL_BEGIN_ALLOW_THREADS |
| 1327 | count = SSL_pending(self->ssl); |
| 1328 | PySSL_END_ALLOW_THREADS |
| 1329 | |
| 1330 | if (!count) { |
| 1331 | sockstate = check_socket_and_wait_for_timeout(sock, 0); |
| 1332 | if (sockstate == SOCKET_HAS_TIMED_OUT) { |
| 1333 | PyErr_SetString(PySSLErrorObject, |
| 1334 | "The read operation timed out"); |
| 1335 | goto error; |
| 1336 | } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) { |
| 1337 | PyErr_SetString(PySSLErrorObject, |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 1338 | "Underlying socket too large for select()."); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1339 | goto error; |
| 1340 | } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) { |
| 1341 | count = 0; |
| 1342 | goto done; |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 1343 | } |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1344 | } |
| 1345 | do { |
| 1346 | err = 0; |
| 1347 | PySSL_BEGIN_ALLOW_THREADS |
| 1348 | count = SSL_read(self->ssl, mem, len); |
| 1349 | err = SSL_get_error(self->ssl, count); |
| 1350 | PySSL_END_ALLOW_THREADS |
| 1351 | if (PyErr_CheckSignals()) |
| 1352 | goto error; |
| 1353 | if (err == SSL_ERROR_WANT_READ) { |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 1354 | sockstate = check_socket_and_wait_for_timeout(sock, 0); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1355 | } else if (err == SSL_ERROR_WANT_WRITE) { |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 1356 | sockstate = check_socket_and_wait_for_timeout(sock, 1); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1357 | } else if ((err == SSL_ERROR_ZERO_RETURN) && |
| 1358 | (SSL_get_shutdown(self->ssl) == |
| 1359 | SSL_RECEIVED_SHUTDOWN)) |
| 1360 | { |
| 1361 | count = 0; |
| 1362 | goto done; |
| 1363 | } else { |
| 1364 | sockstate = SOCKET_OPERATION_OK; |
| 1365 | } |
| 1366 | if (sockstate == SOCKET_HAS_TIMED_OUT) { |
| 1367 | PyErr_SetString(PySSLErrorObject, |
| 1368 | "The read operation timed out"); |
| 1369 | goto error; |
| 1370 | } else if (sockstate == SOCKET_IS_NONBLOCKING) { |
| 1371 | break; |
| 1372 | } |
| 1373 | } while (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE); |
| 1374 | if (count <= 0) { |
| 1375 | PySSL_SetError(self, count, __FILE__, __LINE__); |
| 1376 | goto error; |
| 1377 | } |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1378 | |
| 1379 | done: |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1380 | Py_DECREF(sock); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1381 | if (!buf_passed) { |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1382 | _PyBytes_Resize(&dest, count); |
| 1383 | return dest; |
| 1384 | } |
| 1385 | else { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1386 | PyBuffer_Release(&buf); |
| 1387 | return PyLong_FromLong(count); |
| 1388 | } |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1389 | |
| 1390 | error: |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1391 | Py_DECREF(sock); |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1392 | if (!buf_passed) |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1393 | Py_XDECREF(dest); |
Antoine Pitrou | 10c4c23 | 2010-09-03 18:39:47 +0000 | [diff] [blame] | 1394 | else |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1395 | PyBuffer_Release(&buf); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1396 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1397 | } |
| 1398 | |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1399 | PyDoc_STRVAR(PySSL_SSLread_doc, |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1400 | "read([len]) -> string\n\ |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1401 | \n\ |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1402 | Read up to len bytes from the SSL socket."); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1403 | |
Bill Janssen | 40a0f66 | 2008-08-12 16:56:25 +0000 | [diff] [blame] | 1404 | static PyObject *PySSL_SSLshutdown(PySSLObject *self) |
| 1405 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1406 | int err, ssl_err, sockstate, nonblocking; |
| 1407 | int zeros = 0; |
| 1408 | PySocketSockObject *sock |
| 1409 | = (PySocketSockObject *) PyWeakref_GetObject(self->Socket); |
Bill Janssen | 40a0f66 | 2008-08-12 16:56:25 +0000 | [diff] [blame] | 1410 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1411 | /* Guard against closed socket */ |
| 1412 | if ((((PyObject*)sock) == Py_None) || (sock->sock_fd < 0)) { |
| 1413 | _setSSLError("Underlying socket connection gone", |
| 1414 | PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__); |
| 1415 | return NULL; |
| 1416 | } |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1417 | Py_INCREF(sock); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1418 | |
| 1419 | /* Just in case the blocking state of the socket has been changed */ |
| 1420 | nonblocking = (sock->sock_timeout >= 0.0); |
| 1421 | BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking); |
| 1422 | BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking); |
| 1423 | |
| 1424 | while (1) { |
| 1425 | PySSL_BEGIN_ALLOW_THREADS |
| 1426 | /* Disable read-ahead so that unwrap can work correctly. |
| 1427 | * Otherwise OpenSSL might read in too much data, |
| 1428 | * eating clear text data that happens to be |
| 1429 | * transmitted after the SSL shutdown. |
| 1430 | * Should be safe to call repeatedly everytime this |
| 1431 | * function is used and the shutdown_seen_zero != 0 |
| 1432 | * condition is met. |
| 1433 | */ |
| 1434 | if (self->shutdown_seen_zero) |
| 1435 | SSL_set_read_ahead(self->ssl, 0); |
| 1436 | err = SSL_shutdown(self->ssl); |
| 1437 | PySSL_END_ALLOW_THREADS |
| 1438 | /* If err == 1, a secure shutdown with SSL_shutdown() is complete */ |
| 1439 | if (err > 0) |
| 1440 | break; |
| 1441 | if (err == 0) { |
| 1442 | /* Don't loop endlessly; instead preserve legacy |
| 1443 | behaviour of trying SSL_shutdown() only twice. |
| 1444 | This looks necessary for OpenSSL < 0.9.8m */ |
| 1445 | if (++zeros > 1) |
| 1446 | break; |
| 1447 | /* Shutdown was sent, now try receiving */ |
| 1448 | self->shutdown_seen_zero = 1; |
| 1449 | continue; |
Bill Janssen | 40a0f66 | 2008-08-12 16:56:25 +0000 | [diff] [blame] | 1450 | } |
| 1451 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1452 | /* Possibly retry shutdown until timeout or failure */ |
| 1453 | ssl_err = SSL_get_error(self->ssl, err); |
| 1454 | if (ssl_err == SSL_ERROR_WANT_READ) |
| 1455 | sockstate = check_socket_and_wait_for_timeout(sock, 0); |
| 1456 | else if (ssl_err == SSL_ERROR_WANT_WRITE) |
| 1457 | sockstate = check_socket_and_wait_for_timeout(sock, 1); |
| 1458 | else |
| 1459 | break; |
| 1460 | if (sockstate == SOCKET_HAS_TIMED_OUT) { |
| 1461 | if (ssl_err == SSL_ERROR_WANT_READ) |
| 1462 | PyErr_SetString(PySSLErrorObject, |
| 1463 | "The read operation timed out"); |
| 1464 | else |
| 1465 | PyErr_SetString(PySSLErrorObject, |
| 1466 | "The write operation timed out"); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1467 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1468 | } |
| 1469 | else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) { |
| 1470 | PyErr_SetString(PySSLErrorObject, |
| 1471 | "Underlying socket too large for select()."); |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1472 | goto error; |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1473 | } |
| 1474 | else if (sockstate != SOCKET_OPERATION_OK) |
| 1475 | /* Retain the SSL error code */ |
| 1476 | break; |
| 1477 | } |
Antoine Pitrou | 5a1c4d1 | 2010-04-23 21:11:10 +0000 | [diff] [blame] | 1478 | |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1479 | if (err < 0) { |
| 1480 | Py_DECREF(sock); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1481 | return PySSL_SetError(self, err, __FILE__, __LINE__); |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1482 | } |
Antoine Pitrou | 94fbaac | 2010-06-24 22:49:57 +0000 | [diff] [blame] | 1483 | else |
| 1484 | /* It's already INCREF'ed */ |
| 1485 | return (PyObject *) sock; |
| 1486 | |
| 1487 | error: |
| 1488 | Py_DECREF(sock); |
| 1489 | return NULL; |
Bill Janssen | 40a0f66 | 2008-08-12 16:56:25 +0000 | [diff] [blame] | 1490 | } |
| 1491 | |
| 1492 | PyDoc_STRVAR(PySSL_SSLshutdown_doc, |
| 1493 | "shutdown(s) -> socket\n\ |
| 1494 | \n\ |
| 1495 | Does the SSL shutdown handshake with the remote end, and returns\n\ |
| 1496 | the underlying socket object."); |
| 1497 | |
| 1498 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1499 | static PyMethodDef PySSLMethods[] = { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1500 | {"do_handshake", (PyCFunction)PySSL_SSLdo_handshake, METH_NOARGS}, |
| 1501 | {"write", (PyCFunction)PySSL_SSLwrite, METH_VARARGS, |
| 1502 | PySSL_SSLwrite_doc}, |
| 1503 | {"read", (PyCFunction)PySSL_SSLread, METH_VARARGS, |
| 1504 | PySSL_SSLread_doc}, |
| 1505 | {"pending", (PyCFunction)PySSL_SSLpending, METH_NOARGS, |
| 1506 | PySSL_SSLpending_doc}, |
| 1507 | {"peer_certificate", (PyCFunction)PySSL_peercert, METH_VARARGS, |
| 1508 | PySSL_peercert_doc}, |
| 1509 | {"cipher", (PyCFunction)PySSL_cipher, METH_NOARGS}, |
| 1510 | {"shutdown", (PyCFunction)PySSL_SSLshutdown, METH_NOARGS, |
| 1511 | PySSL_SSLshutdown_doc}, |
| 1512 | {NULL, NULL} |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1513 | }; |
| 1514 | |
Jeremy Hylton | 938ace6 | 2002-07-17 16:30:39 +0000 | [diff] [blame] | 1515 | static PyTypeObject PySSL_Type = { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1516 | PyVarObject_HEAD_INIT(NULL, 0) |
| 1517 | "ssl.SSLContext", /*tp_name*/ |
| 1518 | sizeof(PySSLObject), /*tp_basicsize*/ |
| 1519 | 0, /*tp_itemsize*/ |
| 1520 | /* methods */ |
| 1521 | (destructor)PySSL_dealloc, /*tp_dealloc*/ |
| 1522 | 0, /*tp_print*/ |
| 1523 | 0, /*tp_getattr*/ |
| 1524 | 0, /*tp_setattr*/ |
| 1525 | 0, /*tp_reserved*/ |
| 1526 | 0, /*tp_repr*/ |
| 1527 | 0, /*tp_as_number*/ |
| 1528 | 0, /*tp_as_sequence*/ |
| 1529 | 0, /*tp_as_mapping*/ |
| 1530 | 0, /*tp_hash*/ |
| 1531 | 0, /*tp_call*/ |
| 1532 | 0, /*tp_str*/ |
| 1533 | 0, /*tp_getattro*/ |
| 1534 | 0, /*tp_setattro*/ |
| 1535 | 0, /*tp_as_buffer*/ |
| 1536 | Py_TPFLAGS_DEFAULT, /*tp_flags*/ |
| 1537 | 0, /*tp_doc*/ |
| 1538 | 0, /*tp_traverse*/ |
| 1539 | 0, /*tp_clear*/ |
| 1540 | 0, /*tp_richcompare*/ |
| 1541 | 0, /*tp_weaklistoffset*/ |
| 1542 | 0, /*tp_iter*/ |
| 1543 | 0, /*tp_iternext*/ |
| 1544 | PySSLMethods, /*tp_methods*/ |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1545 | }; |
| 1546 | |
| 1547 | #ifdef HAVE_OPENSSL_RAND |
| 1548 | |
| 1549 | /* helper routines for seeding the SSL PRNG */ |
| 1550 | static PyObject * |
| 1551 | PySSL_RAND_add(PyObject *self, PyObject *args) |
| 1552 | { |
| 1553 | char *buf; |
| 1554 | int len; |
| 1555 | double entropy; |
| 1556 | |
| 1557 | if (!PyArg_ParseTuple(args, "s#d:RAND_add", &buf, &len, &entropy)) |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 1558 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1559 | RAND_add(buf, len, entropy); |
| 1560 | Py_INCREF(Py_None); |
| 1561 | return Py_None; |
| 1562 | } |
| 1563 | |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1564 | PyDoc_STRVAR(PySSL_RAND_add_doc, |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1565 | "RAND_add(string, entropy)\n\ |
| 1566 | \n\ |
| 1567 | Mix string into the OpenSSL PRNG state. entropy (a float) is a lower\n\ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1568 | bound on the entropy contained in string. See RFC 1750."); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1569 | |
| 1570 | static PyObject * |
| 1571 | PySSL_RAND_status(PyObject *self) |
| 1572 | { |
Christian Heimes | 217cfd1 | 2007-12-02 14:31:20 +0000 | [diff] [blame] | 1573 | return PyLong_FromLong(RAND_status()); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1574 | } |
| 1575 | |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1576 | PyDoc_STRVAR(PySSL_RAND_status_doc, |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1577 | "RAND_status() -> 0 or 1\n\ |
| 1578 | \n\ |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1579 | Returns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\n\ |
| 1580 | It is necessary to seed the PRNG with RAND_add() on some platforms before\n\ |
| 1581 | using the ssl() function."); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1582 | |
| 1583 | static PyObject * |
| 1584 | PySSL_RAND_egd(PyObject *self, PyObject *arg) |
| 1585 | { |
| 1586 | int bytes; |
| 1587 | |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1588 | if (!PyUnicode_Check(arg)) |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 1589 | return PyErr_Format(PyExc_TypeError, |
| 1590 | "RAND_egd() expected string, found %s", |
| 1591 | Py_TYPE(arg)->tp_name); |
Marc-André Lemburg | 4cc0f24 | 2008-08-07 18:54:33 +0000 | [diff] [blame] | 1592 | bytes = RAND_egd(_PyUnicode_AsString(arg)); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1593 | if (bytes == -1) { |
Antoine Pitrou | a29b181 | 2010-05-12 14:08:45 +0000 | [diff] [blame] | 1594 | PyErr_SetString(PySSLErrorObject, |
| 1595 | "EGD connection failed or EGD did not return " |
| 1596 | "enough data to seed the PRNG"); |
| 1597 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1598 | } |
Christian Heimes | 217cfd1 | 2007-12-02 14:31:20 +0000 | [diff] [blame] | 1599 | return PyLong_FromLong(bytes); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1600 | } |
| 1601 | |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1602 | PyDoc_STRVAR(PySSL_RAND_egd_doc, |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1603 | "RAND_egd(path) -> bytes\n\ |
| 1604 | \n\ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1605 | Queries the entropy gather daemon (EGD) on the socket named by 'path'.\n\ |
| 1606 | Returns number of bytes read. Raises SSLError if connection to EGD\n\ |
| 1607 | fails or if it does provide enough data to seed PRNG."); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1608 | |
| 1609 | #endif |
| 1610 | |
Bill Janssen | 40a0f66 | 2008-08-12 16:56:25 +0000 | [diff] [blame] | 1611 | |
| 1612 | |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1613 | /* List of functions exported by this module. */ |
| 1614 | |
| 1615 | static PyMethodDef PySSL_methods[] = { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1616 | {"sslwrap", PySSL_sslwrap, |
| 1617 | METH_VARARGS, ssl_doc}, |
| 1618 | {"_test_decode_cert", PySSL_test_decode_certificate, |
| 1619 | METH_VARARGS}, |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1620 | #ifdef HAVE_OPENSSL_RAND |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1621 | {"RAND_add", PySSL_RAND_add, METH_VARARGS, |
| 1622 | PySSL_RAND_add_doc}, |
| 1623 | {"RAND_egd", PySSL_RAND_egd, METH_O, |
| 1624 | PySSL_RAND_egd_doc}, |
| 1625 | {"RAND_status", (PyCFunction)PySSL_RAND_status, METH_NOARGS, |
| 1626 | PySSL_RAND_status_doc}, |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1627 | #endif |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1628 | {NULL, NULL} /* Sentinel */ |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1629 | }; |
| 1630 | |
| 1631 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1632 | #ifdef WITH_THREAD |
| 1633 | |
| 1634 | /* an implementation of OpenSSL threading operations in terms |
| 1635 | of the Python C thread library */ |
| 1636 | |
| 1637 | static PyThread_type_lock *_ssl_locks = NULL; |
| 1638 | |
| 1639 | static unsigned long _ssl_thread_id_function (void) { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1640 | return PyThread_get_thread_ident(); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1641 | } |
| 1642 | |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1643 | static void _ssl_thread_locking_function |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1644 | (int mode, int n, const char *file, int line) { |
| 1645 | /* this function is needed to perform locking on shared data |
| 1646 | structures. (Note that OpenSSL uses a number of global data |
| 1647 | structures that will be implicitly shared whenever multiple |
| 1648 | threads use OpenSSL.) Multi-threaded applications will |
| 1649 | crash at random if it is not set. |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1650 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1651 | locking_function() must be able to handle up to |
| 1652 | CRYPTO_num_locks() different mutex locks. It sets the n-th |
| 1653 | lock if mode & CRYPTO_LOCK, and releases it otherwise. |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1654 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1655 | file and line are the file number of the function setting the |
| 1656 | lock. They can be useful for debugging. |
| 1657 | */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1658 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1659 | if ((_ssl_locks == NULL) || |
| 1660 | (n < 0) || ((unsigned)n >= _ssl_locks_count)) |
| 1661 | return; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1662 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1663 | if (mode & CRYPTO_LOCK) { |
| 1664 | PyThread_acquire_lock(_ssl_locks[n], 1); |
| 1665 | } else { |
| 1666 | PyThread_release_lock(_ssl_locks[n]); |
| 1667 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1668 | } |
| 1669 | |
| 1670 | static int _setup_ssl_threads(void) { |
| 1671 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1672 | unsigned int i; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1673 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1674 | if (_ssl_locks == NULL) { |
| 1675 | _ssl_locks_count = CRYPTO_num_locks(); |
| 1676 | _ssl_locks = (PyThread_type_lock *) |
| 1677 | malloc(sizeof(PyThread_type_lock) * _ssl_locks_count); |
| 1678 | if (_ssl_locks == NULL) |
| 1679 | return 0; |
| 1680 | memset(_ssl_locks, 0, |
| 1681 | sizeof(PyThread_type_lock) * _ssl_locks_count); |
| 1682 | for (i = 0; i < _ssl_locks_count; i++) { |
| 1683 | _ssl_locks[i] = PyThread_allocate_lock(); |
| 1684 | if (_ssl_locks[i] == NULL) { |
| 1685 | unsigned int j; |
| 1686 | for (j = 0; j < i; j++) { |
| 1687 | PyThread_free_lock(_ssl_locks[j]); |
| 1688 | } |
| 1689 | free(_ssl_locks); |
| 1690 | return 0; |
| 1691 | } |
| 1692 | } |
| 1693 | CRYPTO_set_locking_callback(_ssl_thread_locking_function); |
| 1694 | CRYPTO_set_id_callback(_ssl_thread_id_function); |
| 1695 | } |
| 1696 | return 1; |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1697 | } |
| 1698 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1699 | #endif /* def HAVE_THREAD */ |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1700 | |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1701 | PyDoc_STRVAR(module_doc, |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1702 | "Implementation module for SSL socket operations. See the socket module\n\ |
Martin v. Löwis | 14f8b4c | 2002-06-13 20:33:02 +0000 | [diff] [blame] | 1703 | for documentation."); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1704 | |
Martin v. Löwis | 1a21451 | 2008-06-11 05:26:20 +0000 | [diff] [blame] | 1705 | |
| 1706 | static struct PyModuleDef _sslmodule = { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1707 | PyModuleDef_HEAD_INIT, |
| 1708 | "_ssl", |
| 1709 | module_doc, |
| 1710 | -1, |
| 1711 | PySSL_methods, |
| 1712 | NULL, |
| 1713 | NULL, |
| 1714 | NULL, |
| 1715 | NULL |
Martin v. Löwis | 1a21451 | 2008-06-11 05:26:20 +0000 | [diff] [blame] | 1716 | }; |
| 1717 | |
Mark Hammond | fe51c6d | 2002-08-02 02:27:13 +0000 | [diff] [blame] | 1718 | PyMODINIT_FUNC |
Martin v. Löwis | 1a21451 | 2008-06-11 05:26:20 +0000 | [diff] [blame] | 1719 | PyInit__ssl(void) |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1720 | { |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1721 | PyObject *m, *d; |
| 1722 | PySocketModule_APIObject *socket_api; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1723 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1724 | if (PyType_Ready(&PySSL_Type) < 0) |
| 1725 | return NULL; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1726 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1727 | m = PyModule_Create(&_sslmodule); |
| 1728 | if (m == NULL) |
| 1729 | return NULL; |
| 1730 | d = PyModule_GetDict(m); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1731 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1732 | /* Load _socket module and its C API */ |
| 1733 | socket_api = PySocketModule_ImportModuleAndAPI(); |
| 1734 | if (!socket_api) |
| 1735 | return NULL; |
| 1736 | PySocketModule = *socket_api; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1737 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1738 | /* Init OpenSSL */ |
| 1739 | SSL_load_error_strings(); |
| 1740 | SSL_library_init(); |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1741 | #ifdef WITH_THREAD |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1742 | /* note that this will start threading if not already started */ |
| 1743 | if (!_setup_ssl_threads()) { |
| 1744 | return NULL; |
| 1745 | } |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1746 | #endif |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1747 | OpenSSL_add_all_algorithms(); |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1748 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1749 | /* Add symbols to module dict */ |
| 1750 | PySSLErrorObject = PyErr_NewException("ssl.SSLError", |
| 1751 | PySocketModule.error, |
| 1752 | NULL); |
| 1753 | if (PySSLErrorObject == NULL) |
| 1754 | return NULL; |
| 1755 | if (PyDict_SetItemString(d, "SSLError", PySSLErrorObject) != 0) |
| 1756 | return NULL; |
| 1757 | if (PyDict_SetItemString(d, "SSLType", |
| 1758 | (PyObject *)&PySSL_Type) != 0) |
| 1759 | return NULL; |
| 1760 | PyModule_AddIntConstant(m, "SSL_ERROR_ZERO_RETURN", |
| 1761 | PY_SSL_ERROR_ZERO_RETURN); |
| 1762 | PyModule_AddIntConstant(m, "SSL_ERROR_WANT_READ", |
| 1763 | PY_SSL_ERROR_WANT_READ); |
| 1764 | PyModule_AddIntConstant(m, "SSL_ERROR_WANT_WRITE", |
| 1765 | PY_SSL_ERROR_WANT_WRITE); |
| 1766 | PyModule_AddIntConstant(m, "SSL_ERROR_WANT_X509_LOOKUP", |
| 1767 | PY_SSL_ERROR_WANT_X509_LOOKUP); |
| 1768 | PyModule_AddIntConstant(m, "SSL_ERROR_SYSCALL", |
| 1769 | PY_SSL_ERROR_SYSCALL); |
| 1770 | PyModule_AddIntConstant(m, "SSL_ERROR_SSL", |
| 1771 | PY_SSL_ERROR_SSL); |
| 1772 | PyModule_AddIntConstant(m, "SSL_ERROR_WANT_CONNECT", |
| 1773 | PY_SSL_ERROR_WANT_CONNECT); |
| 1774 | /* non ssl.h errorcodes */ |
| 1775 | PyModule_AddIntConstant(m, "SSL_ERROR_EOF", |
| 1776 | PY_SSL_ERROR_EOF); |
| 1777 | PyModule_AddIntConstant(m, "SSL_ERROR_INVALID_ERROR_CODE", |
| 1778 | PY_SSL_ERROR_INVALID_ERROR_CODE); |
| 1779 | /* cert requirements */ |
| 1780 | PyModule_AddIntConstant(m, "CERT_NONE", |
| 1781 | PY_SSL_CERT_NONE); |
| 1782 | PyModule_AddIntConstant(m, "CERT_OPTIONAL", |
| 1783 | PY_SSL_CERT_OPTIONAL); |
| 1784 | PyModule_AddIntConstant(m, "CERT_REQUIRED", |
| 1785 | PY_SSL_CERT_REQUIRED); |
Martin v. Löwis | 6af3e2d | 2002-04-20 07:47:40 +0000 | [diff] [blame] | 1786 | |
Antoine Pitrou | 30dc1a7 | 2010-05-05 16:01:14 +0000 | [diff] [blame] | 1787 | /* protocol versions */ |
| 1788 | PyModule_AddIntConstant(m, "PROTOCOL_SSLv2", |
| 1789 | PY_SSL_VERSION_SSL2); |
| 1790 | PyModule_AddIntConstant(m, "PROTOCOL_SSLv3", |
| 1791 | PY_SSL_VERSION_SSL3); |
| 1792 | PyModule_AddIntConstant(m, "PROTOCOL_SSLv23", |
| 1793 | PY_SSL_VERSION_SSL23); |
| 1794 | PyModule_AddIntConstant(m, "PROTOCOL_TLSv1", |
| 1795 | PY_SSL_VERSION_TLS1); |
| 1796 | return m; |
Marc-André Lemburg | a5d2b4c | 2002-02-16 18:23:30 +0000 | [diff] [blame] | 1797 | } |