Bug Summary

File:Modules/_ssl.c
Location:line 1193, column 17
Description:Both operands to '!=' always have the same value

Annotated Source Code

1/* SSL socket module
2
3 SSL support based on patches by Brian E Gallew and Laszlo Kovacs.
4 Re-worked a bit by Bill Janssen to add server-side support and
5 certificate decoding. Chris Stawarz contributed some non-blocking
6 patches.
7
8 This module is imported by ssl.py. It should *not* be used
9 directly.
10
11 XXX should partial writes be enabled, SSL_MODE_ENABLE_PARTIAL_WRITE?
12
13 XXX integrate several "shutdown modes" as suggested in
14 http://bugs.python.org/issue8108#msg102867 ?
15*/
16
17#include "Python.h"
18
19#ifdef WITH_THREAD1
20#include "pythread.h"
21#define PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
{ \
22 PyThreadState *_save = NULL((void*)0); \
23 if (_ssl_locks_count>0) {_save = PyEval_SaveThread();}
24#define PySSL_BLOCK_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save)}; if (_ssl_locks_count>0){PyEval_RestoreThread(_save)};
25#define PySSL_UNBLOCK_THREADSif (_ssl_locks_count>0){_save = PyEval_SaveThread()}; if (_ssl_locks_count>0){_save = PyEval_SaveThread()};
26#define PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} } if (_ssl_locks_count>0){PyEval_RestoreThread(_save);} \
27 }
28
29#else /* no WITH_THREAD */
30
31#define PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
32#define PySSL_BLOCK_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save)};
33#define PySSL_UNBLOCK_THREADSif (_ssl_locks_count>0){_save = PyEval_SaveThread()};
34#define PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
35
36#endif
37
38enum py_ssl_error {
39 /* these mirror ssl.h */
40 PY_SSL_ERROR_NONE,
41 PY_SSL_ERROR_SSL,
42 PY_SSL_ERROR_WANT_READ,
43 PY_SSL_ERROR_WANT_WRITE,
44 PY_SSL_ERROR_WANT_X509_LOOKUP,
45 PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */
46 PY_SSL_ERROR_ZERO_RETURN,
47 PY_SSL_ERROR_WANT_CONNECT,
48 /* start of non ssl.h errorcodes */
49 PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */
50 PY_SSL_ERROR_NO_SOCKET, /* socket has been GC'd */
51 PY_SSL_ERROR_INVALID_ERROR_CODE
52};
53
54enum py_ssl_server_or_client {
55 PY_SSL_CLIENT,
56 PY_SSL_SERVER
57};
58
59enum py_ssl_cert_requirements {
60 PY_SSL_CERT_NONE,
61 PY_SSL_CERT_OPTIONAL,
62 PY_SSL_CERT_REQUIRED
63};
64
65enum py_ssl_version {
66 PY_SSL_VERSION_SSL2,
67 PY_SSL_VERSION_SSL3,
68 PY_SSL_VERSION_SSL23,
69 PY_SSL_VERSION_TLS1
70};
71
72/* Include symbols from _socket module */
73#include "socketmodule.h"
74
75static PySocketModule_APIObject PySocketModule;
76
77#if defined(HAVE_POLL_H1)
78#include <poll.h>
79#elif defined(HAVE_SYS_POLL_H1)
80#include <sys/poll.h>
81#endif
82
83/* Include OpenSSL header files */
84#include "openssl/rsa.h"
85#include "openssl/crypto.h"
86#include "openssl/x509.h"
87#include "openssl/x509v3.h"
88#include "openssl/pem.h"
89#include "openssl/ssl.h"
90#include "openssl/err.h"
91#include "openssl/rand.h"
92
93/* SSL error object */
94static PyObject *PySSLErrorObject;
95
96#ifdef WITH_THREAD1
97
98/* serves as a flag to see whether we've initialized the SSL thread support. */
99/* 0 means no, greater than 0 means yes */
100
101static unsigned int _ssl_locks_count = 0;
102
103#endif /* def WITH_THREAD */
104
105/* SSL socket object */
106
107#define X509_NAME_MAXLEN256 256
108
109/* RAND_* APIs got added to OpenSSL in 0.9.5 */
110#if OPENSSL_VERSION_NUMBER0x009080cfL >= 0x0090500fL
111# define HAVE_OPENSSL_RAND1 1
112#else
113# undef HAVE_OPENSSL_RAND1
114#endif
115
116/* SSL_CTX_clear_options() and SSL_clear_options() were first added in
117 * OpenSSL 0.9.8m but do not appear in some 0.9.9-dev versions such the
118 * 0.9.9 from "May 2008" that NetBSD 5.0 uses. */
119#if OPENSSL_VERSION_NUMBER0x009080cfL >= 0x009080dfL && OPENSSL_VERSION_NUMBER0x009080cfL != 0x00909000L
120# define HAVE_SSL_CTX_CLEAR_OPTIONS
121#else
122# undef HAVE_SSL_CTX_CLEAR_OPTIONS
123#endif
124
125typedef struct {
126 PyObject_HEADPyObject ob_base;
127 SSL_CTX *ctx;
128} PySSLContext;
129
130typedef struct {
131 PyObject_HEADPyObject ob_base;
132 PyObject *Socket; /* weakref to socket on which we're layered */
133 SSL *ssl;
134 X509 *peer_cert;
135 int shutdown_seen_zero;
136} PySSLSocket;
137
138static PyTypeObject PySSLContext_Type;
139static PyTypeObject PySSLSocket_Type;
140
141static PyObject *PySSL_SSLwrite(PySSLSocket *self, PyObject *args);
142static PyObject *PySSL_SSLread(PySSLSocket *self, PyObject *args);
143static int check_socket_and_wait_for_timeout(PySocketSockObject *s,
144 int writing);
145static PyObject *PySSL_peercert(PySSLSocket *self, PyObject *args);
146static PyObject *PySSL_cipher(PySSLSocket *self);
147
148#define PySSLContext_Check(v)((((PyObject*)(v))->ob_type) == &PySSLContext_Type) (Py_TYPE(v)(((PyObject*)(v))->ob_type) == &PySSLContext_Type)
149#define PySSLSocket_Check(v)((((PyObject*)(v))->ob_type) == &PySSLSocket_Type) (Py_TYPE(v)(((PyObject*)(v))->ob_type) == &PySSLSocket_Type)
150
151typedef enum {
152 SOCKET_IS_NONBLOCKING,
153 SOCKET_IS_BLOCKING,
154 SOCKET_HAS_TIMED_OUT,
155 SOCKET_HAS_BEEN_CLOSED,
156 SOCKET_TOO_LARGE_FOR_SELECT,
157 SOCKET_OPERATION_OK
158} timeout_state;
159
160/* Wrap error strings with filename and line # */
161#define STRINGIFY1(x)"x" #x
162#define STRINGIFY2(x)"x" STRINGIFY1(x)"x"
163#define ERRSTR1(x,y,z)(x ":" y ": " z) (x ":" y ": " z)
164#define ERRSTR(x)("_ssl.c" ":" "164" ": " x) ERRSTR1("_ssl.c", STRINGIFY2(__LINE__), x)("_ssl.c" ":" "164" ": " x)
165
166/* XXX It might be helpful to augment the error message generated
167 below with the name of the SSL function that generated the error.
168 I expect it's obvious most of the time.
169*/
170
171static PyObject *
172PySSL_SetError(PySSLSocket *obj, int ret, char *filename, int lineno)
173{
174 PyObject *v;
175 char buf[2048];
176 char *errstr;
177 int err;
178 enum py_ssl_error p = PY_SSL_ERROR_NONE;
179
180 assert(ret <= 0)(__builtin_expect(!(ret <= 0), 0) ? __assert_rtn(__func__,
"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 180, "ret <= 0"
) : (void)0)
;
181
182 if (obj->ssl != NULL((void*)0)) {
183 err = SSL_get_error(obj->ssl, ret);
184
185 switch (err) {
186 case SSL_ERROR_ZERO_RETURN6:
187 errstr = "TLS/SSL connection has been closed";
188 p = PY_SSL_ERROR_ZERO_RETURN;
189 break;
190 case SSL_ERROR_WANT_READ2:
191 errstr = "The operation did not complete (read)";
192 p = PY_SSL_ERROR_WANT_READ;
193 break;
194 case SSL_ERROR_WANT_WRITE3:
195 p = PY_SSL_ERROR_WANT_WRITE;
196 errstr = "The operation did not complete (write)";
197 break;
198 case SSL_ERROR_WANT_X509_LOOKUP4:
199 p = PY_SSL_ERROR_WANT_X509_LOOKUP;
200 errstr = "The operation did not complete (X509 lookup)";
201 break;
202 case SSL_ERROR_WANT_CONNECT7:
203 p = PY_SSL_ERROR_WANT_CONNECT;
204 errstr = "The operation did not complete (connect)";
205 break;
206 case SSL_ERROR_SYSCALL5:
207 {
208 unsigned long e = ERR_get_error();
209 if (e == 0) {
210 PySocketSockObject *s
211 = (PySocketSockObject *) PyWeakref_GetObject(obj->Socket);
212 if (ret == 0 || (((PyObject *)s) == Py_None(&_Py_NoneStruct))) {
213 p = PY_SSL_ERROR_EOF;
214 errstr = "EOF occurred in violation of protocol";
215 } else if (ret == -1) {
216 /* underlying BIO reported an I/O error */
217 Py_INCREF(s)( _Py_RefTotal++ , ((PyObject*)(s))->ob_refcnt++);
218 ERR_clear_error();
219 v = s->errorhandler();
220 Py_DECREF(s)do { if (_Py_RefTotal-- , --((PyObject*)(s))->ob_refcnt !=
0) { if (((PyObject*)s)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 220, (PyObject
*)(s)); } else _Py_Dealloc((PyObject *)(s)); } while (0)
;
221 return v;
222 } else { /* possible? */
223 p = PY_SSL_ERROR_SYSCALL;
224 errstr = "Some I/O error occurred";
225 }
226 } else {
227 p = PY_SSL_ERROR_SYSCALL;
228 /* XXX Protected by global interpreter lock */
229 errstr = ERR_error_string(e, NULL((void*)0));
230 }
231 break;
232 }
233 case SSL_ERROR_SSL1:
234 {
235 unsigned long e = ERR_get_error();
236 p = PY_SSL_ERROR_SSL;
237 if (e != 0)
238 /* XXX Protected by global interpreter lock */
239 errstr = ERR_error_string(e, NULL((void*)0));
240 else { /* possible? */
241 errstr = "A failure in the SSL library occurred";
242 }
243 break;
244 }
245 default:
246 p = PY_SSL_ERROR_INVALID_ERROR_CODE;
247 errstr = "Invalid error code";
248 }
249 } else {
250 errstr = ERR_error_string(ERR_peek_last_error(), NULL((void*)0));
251 }
252 PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);
253 ERR_clear_error();
254 v = Py_BuildValue("(is)", p, buf);
255 if (v != NULL((void*)0)) {
256 PyErr_SetObject(PySSLErrorObject, v);
257 Py_DECREF(v)do { if (_Py_RefTotal-- , --((PyObject*)(v))->ob_refcnt !=
0) { if (((PyObject*)v)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 257, (PyObject
*)(v)); } else _Py_Dealloc((PyObject *)(v)); } while (0)
;
258 }
259 return NULL((void*)0);
260}
261
262static PyObject *
263_setSSLError (char *errstr, int errcode, char *filename, int lineno) {
264
265 char buf[2048];
266 PyObject *v;
267
268 if (errstr == NULL((void*)0)) {
269 errcode = ERR_peek_last_error();
270 errstr = ERR_error_string(errcode, NULL((void*)0));
271 }
272 PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);
273 ERR_clear_error();
274 v = Py_BuildValue("(is)", errcode, buf);
275 if (v != NULL((void*)0)) {
276 PyErr_SetObject(PySSLErrorObject, v);
277 Py_DECREF(v)do { if (_Py_RefTotal-- , --((PyObject*)(v))->ob_refcnt !=
0) { if (((PyObject*)v)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 277, (PyObject
*)(v)); } else _Py_Dealloc((PyObject *)(v)); } while (0)
;
278 }
279 return NULL((void*)0);
280}
281
282static PySSLSocket *
283newPySSLSocket(SSL_CTX *ctx, PySocketSockObject *sock,
284 enum py_ssl_server_or_client socket_type,
285 char *server_hostname)
286{
287 PySSLSocket *self;
288
289 self = PyObject_New(PySSLSocket, &PySSLSocket_Type)( (PySSLSocket *) _PyObject_New(&PySSLSocket_Type) );
290 if (self == NULL((void*)0))
291 return NULL((void*)0);
292
293 self->peer_cert = NULL((void*)0);
294 self->ssl = NULL((void*)0);
295 self->Socket = NULL((void*)0);
296
297 /* Make sure the SSL error state is initialized */
298 (void) ERR_get_state();
299 ERR_clear_error();
300
301 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
302 self->ssl = SSL_new(ctx);
303 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
304 SSL_set_fd(self->ssl, sock->sock_fd);
305#ifdef SSL_MODE_AUTO_RETRY0x00000004L
306 SSL_set_mode(self->ssl, SSL_MODE_AUTO_RETRY)SSL_ctrl((self->ssl),33,(0x00000004L),((void*)0));
307#endif
308
309#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME55
310 if (server_hostname != NULL((void*)0))
311 SSL_set_tlsext_host_name(self->ssl, server_hostname)SSL_ctrl(self->ssl,55,0,(char *)server_hostname);
312#endif
313
314 /* If the socket is in non-blocking mode or timeout mode, set the BIO
315 * to non-blocking mode (blocking is the default)
316 */
317 if (sock->sock_timeout >= 0.0) {
318 BIO_set_nbio(SSL_get_rbio(self->ssl), 1)BIO_ctrl(SSL_get_rbio(self->ssl),102,(1),((void*)0));
319 BIO_set_nbio(SSL_get_wbio(self->ssl), 1)BIO_ctrl(SSL_get_wbio(self->ssl),102,(1),((void*)0));
320 }
321
322 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
323 if (socket_type == PY_SSL_CLIENT)
324 SSL_set_connect_state(self->ssl);
325 else
326 SSL_set_accept_state(self->ssl);
327 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
328
329 self->Socket = PyWeakref_NewRef((PyObject *) sock, NULL((void*)0));
330 return self;
331}
332
333/* SSL object methods */
334
335static PyObject *PySSL_SSLdo_handshake(PySSLSocket *self)
336{
337 int ret;
338 int err;
339 int sockstate, nonblocking;
340 PySocketSockObject *sock
341 = (PySocketSockObject *) PyWeakref_GetObject(self->Socket);
342
343 if (((PyObject*)sock) == Py_None(&_Py_NoneStruct)) {
344 _setSSLError("Underlying socket connection gone",
345 PY_SSL_ERROR_NO_SOCKET, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__345);
346 return NULL((void*)0);
347 }
348 Py_INCREF(sock)( _Py_RefTotal++ , ((PyObject*)(sock))->ob_refcnt++);
349
350 /* just in case the blocking state of the socket has been changed */
351 nonblocking = (sock->sock_timeout >= 0.0);
352 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking)BIO_ctrl(SSL_get_rbio(self->ssl),102,(nonblocking),((void*
)0))
;
353 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking)BIO_ctrl(SSL_get_wbio(self->ssl),102,(nonblocking),((void*
)0))
;
354
355 /* Actually negotiate SSL connection */
356 /* XXX If SSL_do_handshake() returns 0, it's also a failure. */
357 do {
358 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
359 ret = SSL_do_handshake(self->ssl);
360 err = SSL_get_error(self->ssl, ret);
361 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
362 if (PyErr_CheckSignals())
363 goto error;
364 if (err == SSL_ERROR_WANT_READ2) {
365 sockstate = check_socket_and_wait_for_timeout(sock, 0);
366 } else if (err == SSL_ERROR_WANT_WRITE3) {
367 sockstate = check_socket_and_wait_for_timeout(sock, 1);
368 } else {
369 sockstate = SOCKET_OPERATION_OK;
370 }
371 if (sockstate == SOCKET_HAS_TIMED_OUT) {
372 PyErr_SetString(PySocketModule.timeout_error,
373 ERRSTR("The handshake operation timed out")("_ssl.c" ":" "373" ": " "The handshake operation timed out"));
374 goto error;
375 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
376 PyErr_SetString(PySSLErrorObject,
377 ERRSTR("Underlying socket has been closed.")("_ssl.c" ":" "377" ": " "Underlying socket has been closed."
)
);
378 goto error;
379 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
380 PyErr_SetString(PySSLErrorObject,
381 ERRSTR("Underlying socket too large for select().")("_ssl.c" ":" "381" ": " "Underlying socket too large for select()."
)
);
382 goto error;
383 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
384 break;
385 }
386 } while (err == SSL_ERROR_WANT_READ2 || err == SSL_ERROR_WANT_WRITE3);
387 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 387, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
388 if (ret < 1)
389 return PySSL_SetError(self, ret, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__389);
390
391 if (self->peer_cert)
392 X509_free (self->peer_cert);
393 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
394 self->peer_cert = SSL_get_peer_certificate(self->ssl);
395 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
396
397 Py_INCREF(Py_None)( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct)))->ob_refcnt
++)
;
398 return Py_None(&_Py_NoneStruct);
399
400error:
401 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 401, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
402 return NULL((void*)0);
403}
404
405static PyObject *
406_create_tuple_for_attribute (ASN1_OBJECT *name, ASN1_STRING *value) {
407
408 char namebuf[X509_NAME_MAXLEN256];
409 int buflen;
410 PyObject *name_obj;
411 PyObject *value_obj;
412 PyObject *attr;
413 unsigned char *valuebuf = NULL((void*)0);
414
415 buflen = OBJ_obj2txt(namebuf, sizeof(namebuf), name, 0);
416 if (buflen < 0) {
417 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__417);
418 goto fail;
419 }
420 name_obj = PyUnicode_FromStringAndSizePyUnicodeUCS2_FromStringAndSize(namebuf, buflen);
421 if (name_obj == NULL((void*)0))
422 goto fail;
423
424 buflen = ASN1_STRING_to_UTF8(&valuebuf, value);
425 if (buflen < 0) {
426 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__426);
427 Py_DECREF(name_obj)do { if (_Py_RefTotal-- , --((PyObject*)(name_obj))->ob_refcnt
!= 0) { if (((PyObject*)name_obj)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 427, (PyObject
*)(name_obj)); } else _Py_Dealloc((PyObject *)(name_obj)); }
while (0)
;
428 goto fail;
429 }
430 value_obj = PyUnicode_DecodeUTF8PyUnicodeUCS2_DecodeUTF8((char *) valuebuf,
431 buflen, "strict");
432 OPENSSL_free(valuebuf)CRYPTO_free(valuebuf);
433 if (value_obj == NULL((void*)0)) {
434 Py_DECREF(name_obj)do { if (_Py_RefTotal-- , --((PyObject*)(name_obj))->ob_refcnt
!= 0) { if (((PyObject*)name_obj)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 434, (PyObject
*)(name_obj)); } else _Py_Dealloc((PyObject *)(name_obj)); }
while (0)
;
435 goto fail;
436 }
437 attr = PyTuple_New(2);
438 if (attr == NULL((void*)0)) {
439 Py_DECREF(name_obj)do { if (_Py_RefTotal-- , --((PyObject*)(name_obj))->ob_refcnt
!= 0) { if (((PyObject*)name_obj)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 439, (PyObject
*)(name_obj)); } else _Py_Dealloc((PyObject *)(name_obj)); }
while (0)
;
440 Py_DECREF(value_obj)do { if (_Py_RefTotal-- , --((PyObject*)(value_obj))->ob_refcnt
!= 0) { if (((PyObject*)value_obj)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 440, (PyObject
*)(value_obj)); } else _Py_Dealloc((PyObject *)(value_obj));
} while (0)
;
441 goto fail;
442 }
443 PyTuple_SET_ITEM(attr, 0, name_obj)(((PyTupleObject *)(attr))->ob_item[0] = name_obj);
444 PyTuple_SET_ITEM(attr, 1, value_obj)(((PyTupleObject *)(attr))->ob_item[1] = value_obj);
445 return attr;
446
447 fail:
448 return NULL((void*)0);
449}
450
451static PyObject *
452_create_tuple_for_X509_NAME (X509_NAME *xname)
453{
454 PyObject *dn = NULL((void*)0); /* tuple which represents the "distinguished name" */
455 PyObject *rdn = NULL((void*)0); /* tuple to hold a "relative distinguished name" */
456 PyObject *rdnt;
457 PyObject *attr = NULL((void*)0); /* tuple to hold an attribute */
458 int entry_count = X509_NAME_entry_count(xname);
459 X509_NAME_ENTRY *entry;
460 ASN1_OBJECT *name;
461 ASN1_STRING *value;
462 int index_counter;
463 int rdn_level = -1;
464 int retcode;
465
466 dn = PyList_New(0);
467 if (dn == NULL((void*)0))
468 return NULL((void*)0);
469 /* now create another tuple to hold the top-level RDN */
470 rdn = PyList_New(0);
471 if (rdn == NULL((void*)0))
472 goto fail0;
473
474 for (index_counter = 0;
475 index_counter < entry_count;
476 index_counter++)
477 {
478 entry = X509_NAME_get_entry(xname, index_counter);
479
480 /* check to see if we've gotten to a new RDN */
481 if (rdn_level >= 0) {
482 if (rdn_level != entry->set) {
483 /* yes, new RDN */
484 /* add old RDN to DN */
485 rdnt = PyList_AsTuple(rdn);
486 Py_DECREF(rdn)do { if (_Py_RefTotal-- , --((PyObject*)(rdn))->ob_refcnt !=
0) { if (((PyObject*)rdn)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 486, (PyObject
*)(rdn)); } else _Py_Dealloc((PyObject *)(rdn)); } while (0)
;
487 if (rdnt == NULL((void*)0))
488 goto fail0;
489 retcode = PyList_Append(dn, rdnt);
490 Py_DECREF(rdnt)do { if (_Py_RefTotal-- , --((PyObject*)(rdnt))->ob_refcnt
!= 0) { if (((PyObject*)rdnt)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 490, (PyObject
*)(rdnt)); } else _Py_Dealloc((PyObject *)(rdnt)); } while (
0)
;
491 if (retcode < 0)
492 goto fail0;
493 /* create new RDN */
494 rdn = PyList_New(0);
495 if (rdn == NULL((void*)0))
496 goto fail0;
497 }
498 }
499 rdn_level = entry->set;
500
501 /* now add this attribute to the current RDN */
502 name = X509_NAME_ENTRY_get_object(entry);
503 value = X509_NAME_ENTRY_get_data(entry);
504 attr = _create_tuple_for_attribute(name, value);
505 /*
506 fprintf(stderr, "RDN level %d, attribute %s: %s\n",
507 entry->set,
508 PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 0)),
509 PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 1)));
510 */
511 if (attr == NULL((void*)0))
512 goto fail1;
513 retcode = PyList_Append(rdn, attr);
514 Py_DECREF(attr)do { if (_Py_RefTotal-- , --((PyObject*)(attr))->ob_refcnt
!= 0) { if (((PyObject*)attr)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 514, (PyObject
*)(attr)); } else _Py_Dealloc((PyObject *)(attr)); } while (
0)
;
515 if (retcode < 0)
516 goto fail1;
517 }
518 /* now, there's typically a dangling RDN */
519 if ((rdn != NULL((void*)0)) && (PyList_Size(rdn) > 0)) {
520 rdnt = PyList_AsTuple(rdn);
521 Py_DECREF(rdn)do { if (_Py_RefTotal-- , --((PyObject*)(rdn))->ob_refcnt !=
0) { if (((PyObject*)rdn)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 521, (PyObject
*)(rdn)); } else _Py_Dealloc((PyObject *)(rdn)); } while (0)
;
522 if (rdnt == NULL((void*)0))
523 goto fail0;
524 retcode = PyList_Append(dn, rdnt);
525 Py_DECREF(rdnt)do { if (_Py_RefTotal-- , --((PyObject*)(rdnt))->ob_refcnt
!= 0) { if (((PyObject*)rdnt)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 525, (PyObject
*)(rdnt)); } else _Py_Dealloc((PyObject *)(rdnt)); } while (
0)
;
526 if (retcode < 0)
527 goto fail0;
528 }
529
530 /* convert list to tuple */
531 rdnt = PyList_AsTuple(dn);
532 Py_DECREF(dn)do { if (_Py_RefTotal-- , --((PyObject*)(dn))->ob_refcnt !=
0) { if (((PyObject*)dn)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 532, (PyObject
*)(dn)); } else _Py_Dealloc((PyObject *)(dn)); } while (0)
;
533 if (rdnt == NULL((void*)0))
534 return NULL((void*)0);
535 return rdnt;
536
537 fail1:
538 Py_XDECREF(rdn)do { if ((rdn) == ((void*)0)) ; else do { if (_Py_RefTotal-- ,
--((PyObject*)(rdn))->ob_refcnt != 0) { if (((PyObject*)rdn
)->ob_refcnt < 0) _Py_NegativeRefcount("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 538, (PyObject *)(rdn)); } else _Py_Dealloc((PyObject *)(rdn
)); } while (0); } while (0)
;
539
540 fail0:
541 Py_XDECREF(dn)do { if ((dn) == ((void*)0)) ; else do { if (_Py_RefTotal-- ,
--((PyObject*)(dn))->ob_refcnt != 0) { if (((PyObject*)dn
)->ob_refcnt < 0) _Py_NegativeRefcount("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 541, (PyObject *)(dn)); } else _Py_Dealloc((PyObject *)(dn)
); } while (0); } while (0)
;
542 return NULL((void*)0);
543}
544
545static PyObject *
546_get_peer_alt_names (X509 *certificate) {
547
548 /* this code follows the procedure outlined in
549 OpenSSL's crypto/x509v3/v3_prn.c:X509v3_EXT_print()
550 function to extract the STACK_OF(GENERAL_NAME),
551 then iterates through the stack to add the
552 names. */
553
554 int i, j;
555 PyObject *peer_alt_names = Py_None(&_Py_NoneStruct);
556 PyObject *v, *t;
557 X509_EXTENSION *ext = NULL((void*)0);
558 GENERAL_NAMES *names = NULL((void*)0);
559 GENERAL_NAME *name;
560 const X509V3_EXT_METHOD *method;
561 BIO *biobuf = NULL((void*)0);
562 char buf[2048];
563 char *vptr;
564 int len;
565 /* Issue #2973: ASN1_item_d2i() API changed in OpenSSL 0.9.6m */
566#if OPENSSL_VERSION_NUMBER0x009080cfL >= 0x009060dfL
567 const unsigned char *p;
568#else
569 unsigned char *p;
570#endif
571
572 if (certificate == NULL((void*)0))
573 return peer_alt_names;
574
575 /* get a memory buffer */
576 biobuf = BIO_new(BIO_s_mem());
577
578 i = 0;
579 while ((i = X509_get_ext_by_NID(
580 certificate, NID_subject_alt_name85, i)) >= 0) {
581
582 if (peer_alt_names == Py_None(&_Py_NoneStruct)) {
583 peer_alt_names = PyList_New(0);
584 if (peer_alt_names == NULL((void*)0))
585 goto fail;
586 }
587
588 /* now decode the altName */
589 ext = X509_get_ext(certificate, i);
590 if(!(method = X509V3_EXT_get(ext))) {
591 PyErr_SetString
592 (PySSLErrorObject,
593 ERRSTR("No method for internalizing subjectAltName!")("_ssl.c" ":" "593" ": " "No method for internalizing subjectAltName!"
)
);
594 goto fail;
595 }
596
597 p = ext->value->data;
598 if (method->it)
599 names = (GENERAL_NAMES*)
600 (ASN1_item_d2i(NULL((void*)0),
601 &p,
602 ext->value->length,
603 ASN1_ITEM_ptr(method->it)(method->it)));
604 else
605 names = (GENERAL_NAMES*)
606 (method->d2i(NULL((void*)0),
607 &p,
608 ext->value->length));
609
610 for(j = 0; j < sk_GENERAL_NAME_num(names)sk_num((names)); j++) {
611
612 /* get a rendering of each name in the set of names */
613
614 name = sk_GENERAL_NAME_value(names, j)((GENERAL_NAME *)sk_value((names), (j)));
615 if (name->type == GEN_DIRNAME4) {
616
617 /* we special-case DirName as a tuple of
618 tuples of attributes */
619
620 t = PyTuple_New(2);
621 if (t == NULL((void*)0)) {
622 goto fail;
623 }
624
625 v = PyUnicode_FromStringPyUnicodeUCS2_FromString("DirName");
626 if (v == NULL((void*)0)) {
627 Py_DECREF(t)do { if (_Py_RefTotal-- , --((PyObject*)(t))->ob_refcnt !=
0) { if (((PyObject*)t)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 627, (PyObject
*)(t)); } else _Py_Dealloc((PyObject *)(t)); } while (0)
;
628 goto fail;
629 }
630 PyTuple_SET_ITEM(t, 0, v)(((PyTupleObject *)(t))->ob_item[0] = v);
631
632 v = _create_tuple_for_X509_NAME (name->d.dirn);
633 if (v == NULL((void*)0)) {
634 Py_DECREF(t)do { if (_Py_RefTotal-- , --((PyObject*)(t))->ob_refcnt !=
0) { if (((PyObject*)t)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 634, (PyObject
*)(t)); } else _Py_Dealloc((PyObject *)(t)); } while (0)
;
635 goto fail;
636 }
637 PyTuple_SET_ITEM(t, 1, v)(((PyTupleObject *)(t))->ob_item[1] = v);
638
639 } else {
640
641 /* for everything else, we use the OpenSSL print form */
642
643 (void) BIO_reset(biobuf)(int)BIO_ctrl(biobuf,1,0,((void*)0));
644 GENERAL_NAME_print(biobuf, name);
645 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
646 if (len < 0) {
647 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__647);
648 goto fail;
649 }
650 vptr = strchr(buf, ':');
651 if (vptr == NULL((void*)0))
652 goto fail;
653 t = PyTuple_New(2);
654 if (t == NULL((void*)0))
655 goto fail;
656 v = PyUnicode_FromStringAndSizePyUnicodeUCS2_FromStringAndSize(buf, (vptr - buf));
657 if (v == NULL((void*)0)) {
658 Py_DECREF(t)do { if (_Py_RefTotal-- , --((PyObject*)(t))->ob_refcnt !=
0) { if (((PyObject*)t)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 658, (PyObject
*)(t)); } else _Py_Dealloc((PyObject *)(t)); } while (0)
;
659 goto fail;
660 }
661 PyTuple_SET_ITEM(t, 0, v)(((PyTupleObject *)(t))->ob_item[0] = v);
662 v = PyUnicode_FromStringAndSizePyUnicodeUCS2_FromStringAndSize((vptr + 1),
663 (len - (vptr - buf + 1)));
664 if (v == NULL((void*)0)) {
665 Py_DECREF(t)do { if (_Py_RefTotal-- , --((PyObject*)(t))->ob_refcnt !=
0) { if (((PyObject*)t)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 665, (PyObject
*)(t)); } else _Py_Dealloc((PyObject *)(t)); } while (0)
;
666 goto fail;
667 }
668 PyTuple_SET_ITEM(t, 1, v)(((PyTupleObject *)(t))->ob_item[1] = v);
669 }
670
671 /* and add that rendering to the list */
672
673 if (PyList_Append(peer_alt_names, t) < 0) {
674 Py_DECREF(t)do { if (_Py_RefTotal-- , --((PyObject*)(t))->ob_refcnt !=
0) { if (((PyObject*)t)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 674, (PyObject
*)(t)); } else _Py_Dealloc((PyObject *)(t)); } while (0)
;
675 goto fail;
676 }
677 Py_DECREF(t)do { if (_Py_RefTotal-- , --((PyObject*)(t))->ob_refcnt !=
0) { if (((PyObject*)t)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 677, (PyObject
*)(t)); } else _Py_Dealloc((PyObject *)(t)); } while (0)
;
678 }
679 }
680 BIO_free(biobuf);
681 if (peer_alt_names != Py_None(&_Py_NoneStruct)) {
682 v = PyList_AsTuple(peer_alt_names);
683 Py_DECREF(peer_alt_names)do { if (_Py_RefTotal-- , --((PyObject*)(peer_alt_names))->
ob_refcnt != 0) { if (((PyObject*)peer_alt_names)->ob_refcnt
< 0) _Py_NegativeRefcount("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 683, (PyObject *)(peer_alt_names)); } else _Py_Dealloc((PyObject
*)(peer_alt_names)); } while (0)
;
684 return v;
685 } else {
686 return peer_alt_names;
687 }
688
689
690 fail:
691 if (biobuf != NULL((void*)0))
692 BIO_free(biobuf);
693
694 if (peer_alt_names != Py_None(&_Py_NoneStruct)) {
695 Py_XDECREF(peer_alt_names)do { if ((peer_alt_names) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(peer_alt_names))->ob_refcnt != 0) { if
(((PyObject*)peer_alt_names)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 695, (PyObject
*)(peer_alt_names)); } else _Py_Dealloc((PyObject *)(peer_alt_names
)); } while (0); } while (0)
;
696 }
697
698 return NULL((void*)0);
699}
700
701static PyObject *
702_decode_certificate(X509 *certificate) {
703
704 PyObject *retval = NULL((void*)0);
705 BIO *biobuf = NULL((void*)0);
706 PyObject *peer;
707 PyObject *peer_alt_names = NULL((void*)0);
708 PyObject *issuer;
709 PyObject *version;
710 PyObject *sn_obj;
711 ASN1_INTEGER *serialNumber;
712 char buf[2048];
713 int len;
714 ASN1_TIME *notBefore, *notAfter;
715 PyObject *pnotBefore, *pnotAfter;
716
717 retval = PyDict_New();
718 if (retval == NULL((void*)0))
719 return NULL((void*)0);
720
721 peer = _create_tuple_for_X509_NAME(
722 X509_get_subject_name(certificate));
723 if (peer == NULL((void*)0))
724 goto fail0;
725 if (PyDict_SetItemString(retval, (const char *) "subject", peer) < 0) {
726 Py_DECREF(peer)do { if (_Py_RefTotal-- , --((PyObject*)(peer))->ob_refcnt
!= 0) { if (((PyObject*)peer)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 726, (PyObject
*)(peer)); } else _Py_Dealloc((PyObject *)(peer)); } while (
0)
;
727 goto fail0;
728 }
729 Py_DECREF(peer)do { if (_Py_RefTotal-- , --((PyObject*)(peer))->ob_refcnt
!= 0) { if (((PyObject*)peer)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 729, (PyObject
*)(peer)); } else _Py_Dealloc((PyObject *)(peer)); } while (
0)
;
730
731 issuer = _create_tuple_for_X509_NAME(
732 X509_get_issuer_name(certificate));
733 if (issuer == NULL((void*)0))
734 goto fail0;
735 if (PyDict_SetItemString(retval, (const char *)"issuer", issuer) < 0) {
736 Py_DECREF(issuer)do { if (_Py_RefTotal-- , --((PyObject*)(issuer))->ob_refcnt
!= 0) { if (((PyObject*)issuer)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 736, (PyObject
*)(issuer)); } else _Py_Dealloc((PyObject *)(issuer)); } while
(0)
;
737 goto fail0;
738 }
739 Py_DECREF(issuer)do { if (_Py_RefTotal-- , --((PyObject*)(issuer))->ob_refcnt
!= 0) { if (((PyObject*)issuer)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 739, (PyObject
*)(issuer)); } else _Py_Dealloc((PyObject *)(issuer)); } while
(0)
;
740
741 version = PyLong_FromLong(X509_get_version(certificate)ASN1_INTEGER_get((certificate)->cert_info->version) + 1);
742 if (PyDict_SetItemString(retval, "version", version) < 0) {
743 Py_DECREF(version)do { if (_Py_RefTotal-- , --((PyObject*)(version))->ob_refcnt
!= 0) { if (((PyObject*)version)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 743, (PyObject
*)(version)); } else _Py_Dealloc((PyObject *)(version)); } while
(0)
;
744 goto fail0;
745 }
746 Py_DECREF(version)do { if (_Py_RefTotal-- , --((PyObject*)(version))->ob_refcnt
!= 0) { if (((PyObject*)version)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 746, (PyObject
*)(version)); } else _Py_Dealloc((PyObject *)(version)); } while
(0)
;
747
748 /* get a memory buffer */
749 biobuf = BIO_new(BIO_s_mem());
750
751 (void) BIO_reset(biobuf)(int)BIO_ctrl(biobuf,1,0,((void*)0));
752 serialNumber = X509_get_serialNumber(certificate);
753 /* should not exceed 20 octets, 160 bits, so buf is big enough */
754 i2a_ASN1_INTEGER(biobuf, serialNumber);
755 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
756 if (len < 0) {
757 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__757);
758 goto fail1;
759 }
760 sn_obj = PyUnicode_FromStringAndSizePyUnicodeUCS2_FromStringAndSize(buf, len);
761 if (sn_obj == NULL((void*)0))
762 goto fail1;
763 if (PyDict_SetItemString(retval, "serialNumber", sn_obj) < 0) {
764 Py_DECREF(sn_obj)do { if (_Py_RefTotal-- , --((PyObject*)(sn_obj))->ob_refcnt
!= 0) { if (((PyObject*)sn_obj)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 764, (PyObject
*)(sn_obj)); } else _Py_Dealloc((PyObject *)(sn_obj)); } while
(0)
;
765 goto fail1;
766 }
767 Py_DECREF(sn_obj)do { if (_Py_RefTotal-- , --((PyObject*)(sn_obj))->ob_refcnt
!= 0) { if (((PyObject*)sn_obj)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 767, (PyObject
*)(sn_obj)); } else _Py_Dealloc((PyObject *)(sn_obj)); } while
(0)
;
768
769 (void) BIO_reset(biobuf)(int)BIO_ctrl(biobuf,1,0,((void*)0));
770 notBefore = X509_get_notBefore(certificate)((certificate)->cert_info->validity->notBefore);
771 ASN1_TIME_print(biobuf, notBefore);
772 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
773 if (len < 0) {
774 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__774);
775 goto fail1;
776 }
777 pnotBefore = PyUnicode_FromStringAndSizePyUnicodeUCS2_FromStringAndSize(buf, len);
778 if (pnotBefore == NULL((void*)0))
779 goto fail1;
780 if (PyDict_SetItemString(retval, "notBefore", pnotBefore) < 0) {
781 Py_DECREF(pnotBefore)do { if (_Py_RefTotal-- , --((PyObject*)(pnotBefore))->ob_refcnt
!= 0) { if (((PyObject*)pnotBefore)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 781, (PyObject
*)(pnotBefore)); } else _Py_Dealloc((PyObject *)(pnotBefore)
); } while (0)
;
782 goto fail1;
783 }
784 Py_DECREF(pnotBefore)do { if (_Py_RefTotal-- , --((PyObject*)(pnotBefore))->ob_refcnt
!= 0) { if (((PyObject*)pnotBefore)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 784, (PyObject
*)(pnotBefore)); } else _Py_Dealloc((PyObject *)(pnotBefore)
); } while (0)
;
785
786 (void) BIO_reset(biobuf)(int)BIO_ctrl(biobuf,1,0,((void*)0));
787 notAfter = X509_get_notAfter(certificate)((certificate)->cert_info->validity->notAfter);
788 ASN1_TIME_print(biobuf, notAfter);
789 len = BIO_gets(biobuf, buf, sizeof(buf)-1);
790 if (len < 0) {
791 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__791);
792 goto fail1;
793 }
794 pnotAfter = PyUnicode_FromStringAndSizePyUnicodeUCS2_FromStringAndSize(buf, len);
795 if (pnotAfter == NULL((void*)0))
796 goto fail1;
797 if (PyDict_SetItemString(retval, "notAfter", pnotAfter) < 0) {
798 Py_DECREF(pnotAfter)do { if (_Py_RefTotal-- , --((PyObject*)(pnotAfter))->ob_refcnt
!= 0) { if (((PyObject*)pnotAfter)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 798, (PyObject
*)(pnotAfter)); } else _Py_Dealloc((PyObject *)(pnotAfter));
} while (0)
;
799 goto fail1;
800 }
801 Py_DECREF(pnotAfter)do { if (_Py_RefTotal-- , --((PyObject*)(pnotAfter))->ob_refcnt
!= 0) { if (((PyObject*)pnotAfter)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 801, (PyObject
*)(pnotAfter)); } else _Py_Dealloc((PyObject *)(pnotAfter));
} while (0)
;
802
803 /* Now look for subjectAltName */
804
805 peer_alt_names = _get_peer_alt_names(certificate);
806 if (peer_alt_names == NULL((void*)0))
807 goto fail1;
808 else if (peer_alt_names != Py_None(&_Py_NoneStruct)) {
809 if (PyDict_SetItemString(retval, "subjectAltName",
810 peer_alt_names) < 0) {
811 Py_DECREF(peer_alt_names)do { if (_Py_RefTotal-- , --((PyObject*)(peer_alt_names))->
ob_refcnt != 0) { if (((PyObject*)peer_alt_names)->ob_refcnt
< 0) _Py_NegativeRefcount("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 811, (PyObject *)(peer_alt_names)); } else _Py_Dealloc((PyObject
*)(peer_alt_names)); } while (0)
;
812 goto fail1;
813 }
814 Py_DECREF(peer_alt_names)do { if (_Py_RefTotal-- , --((PyObject*)(peer_alt_names))->
ob_refcnt != 0) { if (((PyObject*)peer_alt_names)->ob_refcnt
< 0) _Py_NegativeRefcount("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 814, (PyObject *)(peer_alt_names)); } else _Py_Dealloc((PyObject
*)(peer_alt_names)); } while (0)
;
815 }
816
817 BIO_free(biobuf);
818 return retval;
819
820 fail1:
821 if (biobuf != NULL((void*)0))
822 BIO_free(biobuf);
823 fail0:
824 Py_XDECREF(retval)do { if ((retval) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(retval))->ob_refcnt != 0) { if (((PyObject
*)retval)->ob_refcnt < 0) _Py_NegativeRefcount("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 824, (PyObject *)(retval)); } else _Py_Dealloc((PyObject *)
(retval)); } while (0); } while (0)
;
825 return NULL((void*)0);
826}
827
828
829static PyObject *
830PySSL_test_decode_certificate (PyObject *mod, PyObject *args) {
831
832 PyObject *retval = NULL((void*)0);
833 PyObject *filename;
834 X509 *x=NULL((void*)0);
835 BIO *cert;
836
837 if (!PyArg_ParseTuple(args, "O&:test_decode_certificate",
838 PyUnicode_FSConverterPyUnicodeUCS2_FSConverter, &filename))
839 return NULL((void*)0);
840
841 if ((cert=BIO_new(BIO_s_file())) == NULL((void*)0)) {
842 PyErr_SetString(PySSLErrorObject,
843 "Can't malloc memory to read file");
844 goto fail0;
845 }
846
847 if (BIO_read_filename(cert, PyBytes_AsString(filename))BIO_ctrl(cert,108, 0x01|0x02,(char *)PyBytes_AsString(filename
))
<= 0) {
848 PyErr_SetString(PySSLErrorObject,
849 "Can't open file");
850 goto fail0;
851 }
852
853 x = PEM_read_bio_X509_AUX(cert,NULL((void*)0), NULL((void*)0), NULL((void*)0));
854 if (x == NULL((void*)0)) {
855 PyErr_SetString(PySSLErrorObject,
856 "Error decoding PEM-encoded file");
857 goto fail0;
858 }
859
860 retval = _decode_certificate(x);
861 X509_free(x);
862
863 fail0:
864 Py_DECREF(filename)do { if (_Py_RefTotal-- , --((PyObject*)(filename))->ob_refcnt
!= 0) { if (((PyObject*)filename)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 864, (PyObject
*)(filename)); } else _Py_Dealloc((PyObject *)(filename)); }
while (0)
;
865 if (cert != NULL((void*)0)) BIO_free(cert);
866 return retval;
867}
868
869
870static PyObject *
871PySSL_peercert(PySSLSocket *self, PyObject *args)
872{
873 PyObject *retval = NULL((void*)0);
874 int len;
875 int verification;
876 PyObject *binary_mode = Py_None(&_Py_NoneStruct);
877
878 if (!PyArg_ParseTuple(args, "|O:peer_certificate", &binary_mode))
879 return NULL((void*)0);
880
881 if (!self->peer_cert)
882 Py_RETURN_NONEreturn ( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct))
)->ob_refcnt++), (&_Py_NoneStruct)
;
883
884 if (PyObject_IsTrue(binary_mode)) {
885 /* return cert in DER-encoded format */
886
887 unsigned char *bytes_buf = NULL((void*)0);
888
889 bytes_buf = NULL((void*)0);
890 len = i2d_X509(self->peer_cert, &bytes_buf);
891 if (len < 0) {
892 PySSL_SetError(self, len, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__892);
893 return NULL((void*)0);
894 }
895 /* this is actually an immutable bytes sequence */
896 retval = PyBytes_FromStringAndSize
897 ((const char *) bytes_buf, len);
898 OPENSSL_free(bytes_buf)CRYPTO_free(bytes_buf);
899 return retval;
900
901 } else {
902 verification = SSL_CTX_get_verify_mode(SSL_get_SSL_CTX(self->ssl));
903 if ((verification & SSL_VERIFY_PEER0x01) == 0)
904 return PyDict_New();
905 else
906 return _decode_certificate(self->peer_cert);
907 }
908}
909
910PyDoc_STRVAR(PySSL_peercert_doc,static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
911"peer_certificate([der=False]) -> certificate\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
912\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
913Returns the certificate for the peer. If no certificate was provided,\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
914returns None. If a certificate was provided, but not validated, returns\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
915an empty dictionary. Otherwise returns a dict containing information\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
916about the peer certificate.\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
917\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
918If the optional argument is True, returns a DER-encoded copy of the\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
919peer certificate, or None if no certificate was provided. This will\n\static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated."
920return the certificate even if it wasn't validated.")static char PySSL_peercert_doc[] = "peer_certificate([der=False]) -> certificate\n\nReturns the certificate for the peer. If no certificate was provided,\nreturns None. If a certificate was provided, but not validated, returns\nan empty dictionary. Otherwise returns a dict containing information\nabout the peer certificate.\n\nIf the optional argument is True, returns a DER-encoded copy of the\npeer certificate, or None if no certificate was provided. This will\nreturn the certificate even if it wasn't validated.";
921
922static PyObject *PySSL_cipher (PySSLSocket *self) {
923
924 PyObject *retval, *v;
925 const SSL_CIPHER *current;
926 char *cipher_name;
927 char *cipher_protocol;
928
929 if (self->ssl == NULL((void*)0))
930 Py_RETURN_NONEreturn ( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct))
)->ob_refcnt++), (&_Py_NoneStruct)
;
931 current = SSL_get_current_cipher(self->ssl);
932 if (current == NULL((void*)0))
933 Py_RETURN_NONEreturn ( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct))
)->ob_refcnt++), (&_Py_NoneStruct)
;
934
935 retval = PyTuple_New(3);
936 if (retval == NULL((void*)0))
937 return NULL((void*)0);
938
939 cipher_name = (char *) SSL_CIPHER_get_name(current);
940 if (cipher_name == NULL((void*)0)) {
941 Py_INCREF(Py_None)( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct)))->ob_refcnt
++)
;
942 PyTuple_SET_ITEM(retval, 0, Py_None)(((PyTupleObject *)(retval))->ob_item[0] = (&_Py_NoneStruct
))
;
943 } else {
944 v = PyUnicode_FromStringPyUnicodeUCS2_FromString(cipher_name);
945 if (v == NULL((void*)0))
946 goto fail0;
947 PyTuple_SET_ITEM(retval, 0, v)(((PyTupleObject *)(retval))->ob_item[0] = v);
948 }
949 cipher_protocol = SSL_CIPHER_get_version(current);
950 if (cipher_protocol == NULL((void*)0)) {
951 Py_INCREF(Py_None)( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct)))->ob_refcnt
++)
;
952 PyTuple_SET_ITEM(retval, 1, Py_None)(((PyTupleObject *)(retval))->ob_item[1] = (&_Py_NoneStruct
))
;
953 } else {
954 v = PyUnicode_FromStringPyUnicodeUCS2_FromString(cipher_protocol);
955 if (v == NULL((void*)0))
956 goto fail0;
957 PyTuple_SET_ITEM(retval, 1, v)(((PyTupleObject *)(retval))->ob_item[1] = v);
958 }
959 v = PyLong_FromLong(SSL_CIPHER_get_bits(current, NULL((void*)0)));
960 if (v == NULL((void*)0))
961 goto fail0;
962 PyTuple_SET_ITEM(retval, 2, v)(((PyTupleObject *)(retval))->ob_item[2] = v);
963 return retval;
964
965 fail0:
966 Py_DECREF(retval)do { if (_Py_RefTotal-- , --((PyObject*)(retval))->ob_refcnt
!= 0) { if (((PyObject*)retval)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 966, (PyObject
*)(retval)); } else _Py_Dealloc((PyObject *)(retval)); } while
(0)
;
967 return NULL((void*)0);
968}
969
970static void PySSL_dealloc(PySSLSocket *self)
971{
972 if (self->peer_cert) /* Possible not to have one? */
973 X509_free (self->peer_cert);
974 if (self->ssl)
975 SSL_free(self->ssl);
976 Py_XDECREF(self->Socket)do { if ((self->Socket) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(self->Socket))->ob_refcnt != 0) { if
(((PyObject*)self->Socket)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 976, (PyObject
*)(self->Socket)); } else _Py_Dealloc((PyObject *)(self->
Socket)); } while (0); } while (0)
;
977 PyObject_Del_PyObject_DebugFree(self);
978}
979
980/* If the socket has a timeout, do a select()/poll() on the socket.
981 The argument writing indicates the direction.
982 Returns one of the possibilities in the timeout_state enum (above).
983 */
984
985static int
986check_socket_and_wait_for_timeout(PySocketSockObject *s, int writing)
987{
988 fd_set fds;
989 struct timeval tv;
990 int rc;
991
992 /* Nothing to do unless we're in timeout mode (not non-blocking) */
993 if (s->sock_timeout < 0.0)
994 return SOCKET_IS_BLOCKING;
995 else if (s->sock_timeout == 0.0)
996 return SOCKET_IS_NONBLOCKING;
997
998 /* Guard against closed socket */
999 if (s->sock_fd < 0)
1000 return SOCKET_HAS_BEEN_CLOSED;
1001
1002 /* Prefer poll, if available, since you can poll() any fd
1003 * which can't be done with select(). */
1004#ifdef HAVE_POLL1
1005 {
1006 struct pollfd pollfd;
1007 int timeout;
1008
1009 pollfd.fd = s->sock_fd;
1010 pollfd.events = writing ? POLLOUT0x0004 : POLLIN0x0001;
1011
1012 /* s->sock_timeout is in seconds, timeout in ms */
1013 timeout = (int)(s->sock_timeout * 1000 + 0.5);
1014 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1015 rc = poll(&pollfd, 1, timeout);
1016 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1017
1018 goto normal_return;
1019 }
1020#endif
1021
1022 /* Guard against socket too large for select*/
1023#ifndef Py_SOCKET_FD_CAN_BE_GE_FD_SETSIZE
1024 if (s->sock_fd >= FD_SETSIZE1024)
1025 return SOCKET_TOO_LARGE_FOR_SELECT;
1026#endif
1027
1028 /* Construct the arguments to select */
1029 tv.tv_sec = (int)s->sock_timeout;
1030 tv.tv_usec = (int)((s->sock_timeout - tv.tv_sec) * 1e6);
1031 FD_ZERO(&fds)__builtin_bzero(&fds, sizeof(*(&fds)));
1032 FD_SET(s->sock_fd, &fds)do { int __fd = (s->sock_fd); ((&fds)->fds_bits[__fd
/(sizeof(__int32_t) * 8)] |= (1<<(__fd % (sizeof(__int32_t
) * 8)))); } while(0)
;
1033
1034 /* See if the socket is ready */
1035 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1036 if (writing)
1037 rc = select(s->sock_fd+1, NULL((void*)0), &fds, NULL((void*)0), &tv);
1038 else
1039 rc = select(s->sock_fd+1, &fds, NULL((void*)0), NULL((void*)0), &tv);
1040 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1041
1042#ifdef HAVE_POLL1
1043normal_return:
1044#endif
1045 /* Return SOCKET_TIMED_OUT on timeout, SOCKET_OPERATION_OK otherwise
1046 (when we are able to write or when there's something to read) */
1047 return rc == 0 ? SOCKET_HAS_TIMED_OUT : SOCKET_OPERATION_OK;
1048}
1049
1050static PyObject *PySSL_SSLwrite(PySSLSocket *self, PyObject *args)
1051{
1052 Py_buffer buf;
1053 int len;
1054 int sockstate;
1055 int err;
1056 int nonblocking;
1057 PySocketSockObject *sock
1058 = (PySocketSockObject *) PyWeakref_GetObject(self->Socket);
1059
1060 if (((PyObject*)sock) == Py_None(&_Py_NoneStruct)) {
1061 _setSSLError("Underlying socket connection gone",
1062 PY_SSL_ERROR_NO_SOCKET, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1062);
1063 return NULL((void*)0);
1064 }
1065 Py_INCREF(sock)( _Py_RefTotal++ , ((PyObject*)(sock))->ob_refcnt++);
1066
1067 if (!PyArg_ParseTuple(args, "y*:write", &buf)) {
1068 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1068, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
1069 return NULL((void*)0);
1070 }
1071
1072 /* just in case the blocking state of the socket has been changed */
1073 nonblocking = (sock->sock_timeout >= 0.0);
1074 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking)BIO_ctrl(SSL_get_rbio(self->ssl),102,(nonblocking),((void*
)0))
;
1075 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking)BIO_ctrl(SSL_get_wbio(self->ssl),102,(nonblocking),((void*
)0))
;
1076
1077 sockstate = check_socket_and_wait_for_timeout(sock, 1);
1078 if (sockstate == SOCKET_HAS_TIMED_OUT) {
1079 PyErr_SetString(PySocketModule.timeout_error,
1080 "The write operation timed out");
1081 goto error;
1082 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
1083 PyErr_SetString(PySSLErrorObject,
1084 "Underlying socket has been closed.");
1085 goto error;
1086 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
1087 PyErr_SetString(PySSLErrorObject,
1088 "Underlying socket too large for select().");
1089 goto error;
1090 }
1091 do {
1092 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1093 len = SSL_write(self->ssl, buf.buf, buf.len);
1094 err = SSL_get_error(self->ssl, len);
1095 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1096 if (PyErr_CheckSignals()) {
1097 goto error;
1098 }
1099 if (err == SSL_ERROR_WANT_READ2) {
1100 sockstate = check_socket_and_wait_for_timeout(sock, 0);
1101 } else if (err == SSL_ERROR_WANT_WRITE3) {
1102 sockstate = check_socket_and_wait_for_timeout(sock, 1);
1103 } else {
1104 sockstate = SOCKET_OPERATION_OK;
1105 }
1106 if (sockstate == SOCKET_HAS_TIMED_OUT) {
1107 PyErr_SetString(PySocketModule.timeout_error,
1108 "The write operation timed out");
1109 goto error;
1110 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
1111 PyErr_SetString(PySSLErrorObject,
1112 "Underlying socket has been closed.");
1113 goto error;
1114 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
1115 break;
1116 }
1117 } while (err == SSL_ERROR_WANT_READ2 || err == SSL_ERROR_WANT_WRITE3);
1118
1119 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1119, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
1120 PyBuffer_Release(&buf);
1121 if (len > 0)
1122 return PyLong_FromLong(len);
1123 else
1124 return PySSL_SetError(self, len, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1124);
1125
1126error:
1127 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1127, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
1128 PyBuffer_Release(&buf);
1129 return NULL((void*)0);
1130}
1131
1132PyDoc_STRVAR(PySSL_SSLwrite_doc,static char PySSL_SSLwrite_doc[] = "write(s) -> len\n\nWrites the string s into the SSL object. Returns the number\nof bytes written."
1133"write(s) -> len\n\static char PySSL_SSLwrite_doc[] = "write(s) -> len\n\nWrites the string s into the SSL object. Returns the number\nof bytes written."
1134\n\static char PySSL_SSLwrite_doc[] = "write(s) -> len\n\nWrites the string s into the SSL object. Returns the number\nof bytes written."
1135Writes the string s into the SSL object. Returns the number\n\static char PySSL_SSLwrite_doc[] = "write(s) -> len\n\nWrites the string s into the SSL object. Returns the number\nof bytes written."
1136of bytes written.")static char PySSL_SSLwrite_doc[] = "write(s) -> len\n\nWrites the string s into the SSL object. Returns the number\nof bytes written.";
1137
1138static PyObject *PySSL_SSLpending(PySSLSocket *self)
1139{
1140 int count = 0;
1141
1142 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1143 count = SSL_pending(self->ssl);
1144 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1145 if (count < 0)
1146 return PySSL_SetError(self, count, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1146);
1147 else
1148 return PyLong_FromLong(count);
1149}
1150
1151PyDoc_STRVAR(PySSL_SSLpending_doc,static char PySSL_SSLpending_doc[] = "pending() -> count\n\nReturns the number of already decrypted bytes available for read,\npending on the connection.\n"
1152"pending() -> count\n\static char PySSL_SSLpending_doc[] = "pending() -> count\n\nReturns the number of already decrypted bytes available for read,\npending on the connection.\n"
1153\n\static char PySSL_SSLpending_doc[] = "pending() -> count\n\nReturns the number of already decrypted bytes available for read,\npending on the connection.\n"
1154Returns the number of already decrypted bytes available for read,\n\static char PySSL_SSLpending_doc[] = "pending() -> count\n\nReturns the number of already decrypted bytes available for read,\npending on the connection.\n"
1155pending on the connection.\n")static char PySSL_SSLpending_doc[] = "pending() -> count\n\nReturns the number of already decrypted bytes available for read,\npending on the connection.\n";
1156
1157static PyObject *PySSL_SSLread(PySSLSocket *self, PyObject *args)
1158{
1159 PyObject *dest = NULL((void*)0);
1160 Py_buffer buf;
1161 char *mem;
1162 int len, count;
1163 int buf_passed = 0;
1164 int sockstate;
1165 int err;
1166 int nonblocking;
1167 PySocketSockObject *sock
1168 = (PySocketSockObject *) PyWeakref_GetObject(self->Socket);
1169
1170 if (((PyObject*)sock) == Py_None(&_Py_NoneStruct)) {
1
Taking false branch
1171 _setSSLError("Underlying socket connection gone",
1172 PY_SSL_ERROR_NO_SOCKET, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1172);
1173 return NULL((void*)0);
1174 }
1175 Py_INCREF(sock)( _Py_RefTotal++ , ((PyObject*)(sock))->ob_refcnt++);
1176
1177 buf.obj = NULL((void*)0);
1178 buf.buf = NULL((void*)0);
1179 if (!PyArg_ParseTuple(args, "i|w*:read", &len, &buf))
2
Taking false branch
1180 goto error;
1181
1182 if ((buf.buf == NULL((void*)0)) && (buf.obj == NULL((void*)0))) {
3
Taking false branch
1183 dest = PyBytes_FromStringAndSize(NULL((void*)0), len);
1184 if (dest == NULL((void*)0))
1185 goto error;
1186 mem = PyBytes_AS_STRING(dest)((__builtin_expect(!(((((((PyObject*)(dest))->ob_type))->
tp_flags & ((1L<<27))) != 0)), 0) ? __assert_rtn(__func__
, "/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1186, "PyBytes_Check(dest)"
) : (void)0), (((PyBytesObject *)(dest))->ob_sval))
;
1187 }
1188 else {
1189 buf_passed = 1;
1190 mem = buf.buf;
1191 if (len <= 0 || len > buf.len) {
4
Taking true branch
1192 len = (int) buf.len;
1193 if (buf.len != len) {
5
Both operands to '!=' always have the same value
1194 PyErr_SetString(PyExc_OverflowError,
1195 "maximum length can't fit in a C 'int'");
1196 goto error;
1197 }
1198 }
1199 }
1200
1201 /* just in case the blocking state of the socket has been changed */
1202 nonblocking = (sock->sock_timeout >= 0.0);
1203 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking)BIO_ctrl(SSL_get_rbio(self->ssl),102,(nonblocking),((void*
)0))
;
1204 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking)BIO_ctrl(SSL_get_wbio(self->ssl),102,(nonblocking),((void*
)0))
;
1205
1206 /* first check if there are bytes ready to be read */
1207 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1208 count = SSL_pending(self->ssl);
1209 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1210
1211 if (!count) {
1212 sockstate = check_socket_and_wait_for_timeout(sock, 0);
1213 if (sockstate == SOCKET_HAS_TIMED_OUT) {
1214 PyErr_SetString(PySocketModule.timeout_error,
1215 "The read operation timed out");
1216 goto error;
1217 } else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
1218 PyErr_SetString(PySSLErrorObject,
1219 "Underlying socket too large for select().");
1220 goto error;
1221 } else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {
1222 count = 0;
1223 goto done;
1224 }
1225 }
1226 do {
1227 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1228 count = SSL_read(self->ssl, mem, len);
1229 err = SSL_get_error(self->ssl, count);
1230 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1231 if (PyErr_CheckSignals())
1232 goto error;
1233 if (err == SSL_ERROR_WANT_READ2) {
1234 sockstate = check_socket_and_wait_for_timeout(sock, 0);
1235 } else if (err == SSL_ERROR_WANT_WRITE3) {
1236 sockstate = check_socket_and_wait_for_timeout(sock, 1);
1237 } else if ((err == SSL_ERROR_ZERO_RETURN6) &&
1238 (SSL_get_shutdown(self->ssl) ==
1239 SSL_RECEIVED_SHUTDOWN2))
1240 {
1241 count = 0;
1242 goto done;
1243 } else {
1244 sockstate = SOCKET_OPERATION_OK;
1245 }
1246 if (sockstate == SOCKET_HAS_TIMED_OUT) {
1247 PyErr_SetString(PySocketModule.timeout_error,
1248 "The read operation timed out");
1249 goto error;
1250 } else if (sockstate == SOCKET_IS_NONBLOCKING) {
1251 break;
1252 }
1253 } while (err == SSL_ERROR_WANT_READ2 || err == SSL_ERROR_WANT_WRITE3);
1254 if (count <= 0) {
1255 PySSL_SetError(self, count, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1255);
1256 goto error;
1257 }
1258
1259done:
1260 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1260, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
1261 if (!buf_passed) {
1262 _PyBytes_Resize(&dest, count);
1263 return dest;
1264 }
1265 else {
1266 PyBuffer_Release(&buf);
1267 return PyLong_FromLong(count);
1268 }
1269
1270error:
1271 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1271, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
1272 if (!buf_passed)
1273 Py_XDECREF(dest)do { if ((dest) == ((void*)0)) ; else do { if (_Py_RefTotal--
, --((PyObject*)(dest))->ob_refcnt != 0) { if (((PyObject
*)dest)->ob_refcnt < 0) _Py_NegativeRefcount("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 1273, (PyObject *)(dest)); } else _Py_Dealloc((PyObject *)(
dest)); } while (0); } while (0)
;
1274 else
1275 PyBuffer_Release(&buf);
1276 return NULL((void*)0);
1277}
1278
1279PyDoc_STRVAR(PySSL_SSLread_doc,static char PySSL_SSLread_doc[] = "read([len]) -> string\n\nRead up to len bytes from the SSL socket."
1280"read([len]) -> string\n\static char PySSL_SSLread_doc[] = "read([len]) -> string\n\nRead up to len bytes from the SSL socket."
1281\n\static char PySSL_SSLread_doc[] = "read([len]) -> string\n\nRead up to len bytes from the SSL socket."
1282Read up to len bytes from the SSL socket.")static char PySSL_SSLread_doc[] = "read([len]) -> string\n\nRead up to len bytes from the SSL socket.";
1283
1284static PyObject *PySSL_SSLshutdown(PySSLSocket *self)
1285{
1286 int err, ssl_err, sockstate, nonblocking;
1287 int zeros = 0;
1288 PySocketSockObject *sock
1289 = (PySocketSockObject *) PyWeakref_GetObject(self->Socket);
1290
1291 /* Guard against closed socket */
1292 if ((((PyObject*)sock) == Py_None(&_Py_NoneStruct)) || (sock->sock_fd < 0)) {
1293 _setSSLError("Underlying socket connection gone",
1294 PY_SSL_ERROR_NO_SOCKET, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1294);
1295 return NULL((void*)0);
1296 }
1297 Py_INCREF(sock)( _Py_RefTotal++ , ((PyObject*)(sock))->ob_refcnt++);
1298
1299 /* Just in case the blocking state of the socket has been changed */
1300 nonblocking = (sock->sock_timeout >= 0.0);
1301 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking)BIO_ctrl(SSL_get_rbio(self->ssl),102,(nonblocking),((void*
)0))
;
1302 BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking)BIO_ctrl(SSL_get_wbio(self->ssl),102,(nonblocking),((void*
)0))
;
1303
1304 while (1) {
1305 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1306 /* Disable read-ahead so that unwrap can work correctly.
1307 * Otherwise OpenSSL might read in too much data,
1308 * eating clear text data that happens to be
1309 * transmitted after the SSL shutdown.
1310 * Should be safe to call repeatedly everytime this
1311 * function is used and the shutdown_seen_zero != 0
1312 * condition is met.
1313 */
1314 if (self->shutdown_seen_zero)
1315 SSL_set_read_ahead(self->ssl, 0);
1316 err = SSL_shutdown(self->ssl);
1317 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1318 /* If err == 1, a secure shutdown with SSL_shutdown() is complete */
1319 if (err > 0)
1320 break;
1321 if (err == 0) {
1322 /* Don't loop endlessly; instead preserve legacy
1323 behaviour of trying SSL_shutdown() only twice.
1324 This looks necessary for OpenSSL < 0.9.8m */
1325 if (++zeros > 1)
1326 break;
1327 /* Shutdown was sent, now try receiving */
1328 self->shutdown_seen_zero = 1;
1329 continue;
1330 }
1331
1332 /* Possibly retry shutdown until timeout or failure */
1333 ssl_err = SSL_get_error(self->ssl, err);
1334 if (ssl_err == SSL_ERROR_WANT_READ2)
1335 sockstate = check_socket_and_wait_for_timeout(sock, 0);
1336 else if (ssl_err == SSL_ERROR_WANT_WRITE3)
1337 sockstate = check_socket_and_wait_for_timeout(sock, 1);
1338 else
1339 break;
1340 if (sockstate == SOCKET_HAS_TIMED_OUT) {
1341 if (ssl_err == SSL_ERROR_WANT_READ2)
1342 PyErr_SetString(PySocketModule.timeout_error,
1343 "The read operation timed out");
1344 else
1345 PyErr_SetString(PySocketModule.timeout_error,
1346 "The write operation timed out");
1347 goto error;
1348 }
1349 else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {
1350 PyErr_SetString(PySSLErrorObject,
1351 "Underlying socket too large for select().");
1352 goto error;
1353 }
1354 else if (sockstate != SOCKET_OPERATION_OK)
1355 /* Retain the SSL error code */
1356 break;
1357 }
1358
1359 if (err < 0) {
1360 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1360, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
1361 return PySSL_SetError(self, err, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1361);
1362 }
1363 else
1364 /* It's already INCREF'ed */
1365 return (PyObject *) sock;
1366
1367error:
1368 Py_DECREF(sock)do { if (_Py_RefTotal-- , --((PyObject*)(sock))->ob_refcnt
!= 0) { if (((PyObject*)sock)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1368, (PyObject
*)(sock)); } else _Py_Dealloc((PyObject *)(sock)); } while (
0)
;
1369 return NULL((void*)0);
1370}
1371
1372PyDoc_STRVAR(PySSL_SSLshutdown_doc,static char PySSL_SSLshutdown_doc[] = "shutdown(s) -> socket\n\nDoes the SSL shutdown handshake with the remote end, and returns\nthe underlying socket object."
1373"shutdown(s) -> socket\n\static char PySSL_SSLshutdown_doc[] = "shutdown(s) -> socket\n\nDoes the SSL shutdown handshake with the remote end, and returns\nthe underlying socket object."
1374\n\static char PySSL_SSLshutdown_doc[] = "shutdown(s) -> socket\n\nDoes the SSL shutdown handshake with the remote end, and returns\nthe underlying socket object."
1375Does the SSL shutdown handshake with the remote end, and returns\n\static char PySSL_SSLshutdown_doc[] = "shutdown(s) -> socket\n\nDoes the SSL shutdown handshake with the remote end, and returns\nthe underlying socket object."
1376the underlying socket object.")static char PySSL_SSLshutdown_doc[] = "shutdown(s) -> socket\n\nDoes the SSL shutdown handshake with the remote end, and returns\nthe underlying socket object.";
1377
1378
1379static PyMethodDef PySSLMethods[] = {
1380 {"do_handshake", (PyCFunction)PySSL_SSLdo_handshake, METH_NOARGS0x0004},
1381 {"write", (PyCFunction)PySSL_SSLwrite, METH_VARARGS0x0001,
1382 PySSL_SSLwrite_doc},
1383 {"read", (PyCFunction)PySSL_SSLread, METH_VARARGS0x0001,
1384 PySSL_SSLread_doc},
1385 {"pending", (PyCFunction)PySSL_SSLpending, METH_NOARGS0x0004,
1386 PySSL_SSLpending_doc},
1387 {"peer_certificate", (PyCFunction)PySSL_peercert, METH_VARARGS0x0001,
1388 PySSL_peercert_doc},
1389 {"cipher", (PyCFunction)PySSL_cipher, METH_NOARGS0x0004},
1390 {"shutdown", (PyCFunction)PySSL_SSLshutdown, METH_NOARGS0x0004,
1391 PySSL_SSLshutdown_doc},
1392 {NULL((void*)0), NULL((void*)0)}
1393};
1394
1395static PyTypeObject PySSLSocket_Type = {
1396 PyVarObject_HEAD_INIT(NULL, 0){ { 0, 0, 1, ((void*)0) }, 0 },
1397 "_ssl._SSLSocket", /*tp_name*/
1398 sizeof(PySSLSocket), /*tp_basicsize*/
1399 0, /*tp_itemsize*/
1400 /* methods */
1401 (destructor)PySSL_dealloc, /*tp_dealloc*/
1402 0, /*tp_print*/
1403 0, /*tp_getattr*/
1404 0, /*tp_setattr*/
1405 0, /*tp_reserved*/
1406 0, /*tp_repr*/
1407 0, /*tp_as_number*/
1408 0, /*tp_as_sequence*/
1409 0, /*tp_as_mapping*/
1410 0, /*tp_hash*/
1411 0, /*tp_call*/
1412 0, /*tp_str*/
1413 0, /*tp_getattro*/
1414 0, /*tp_setattro*/
1415 0, /*tp_as_buffer*/
1416 Py_TPFLAGS_DEFAULT( 0 | (1L<<18) | 0), /*tp_flags*/
1417 0, /*tp_doc*/
1418 0, /*tp_traverse*/
1419 0, /*tp_clear*/
1420 0, /*tp_richcompare*/
1421 0, /*tp_weaklistoffset*/
1422 0, /*tp_iter*/
1423 0, /*tp_iternext*/
1424 PySSLMethods, /*tp_methods*/
1425};
1426
1427
1428/*
1429 * _SSLContext objects
1430 */
1431
1432static PyObject *
1433context_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
1434{
1435 char *kwlist[] = {"protocol", NULL((void*)0)};
1436 PySSLContext *self;
1437 int proto_version = PY_SSL_VERSION_SSL23;
1438 SSL_CTX *ctx = NULL((void*)0);
1439
1440 if (!PyArg_ParseTupleAndKeywords(
1441 args, kwds, "i:_SSLContext", kwlist,
1442 &proto_version))
1443 return NULL((void*)0);
1444
1445 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1446 if (proto_version == PY_SSL_VERSION_TLS1)
1447 ctx = SSL_CTX_new(TLSv1_method());
1448 else if (proto_version == PY_SSL_VERSION_SSL3)
1449 ctx = SSL_CTX_new(SSLv3_method());
1450 else if (proto_version == PY_SSL_VERSION_SSL2)
1451 ctx = SSL_CTX_new(SSLv2_method());
1452 else if (proto_version == PY_SSL_VERSION_SSL23)
1453 ctx = SSL_CTX_new(SSLv23_method());
1454 else
1455 proto_version = -1;
1456 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1457
1458 if (proto_version == -1) {
1459 PyErr_SetString(PyExc_ValueError,
1460 "invalid protocol version");
1461 return NULL((void*)0);
1462 }
1463 if (ctx == NULL((void*)0)) {
1464 PyErr_SetString(PySSLErrorObject,
1465 "failed to allocate SSL context");
1466 return NULL((void*)0);
1467 }
1468
1469 assert(type != NULL && type->tp_alloc != NULL)(__builtin_expect(!(type != ((void*)0) && type->tp_alloc
!= ((void*)0)), 0) ? __assert_rtn(__func__, "/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 1469, "type != NULL && type->tp_alloc != NULL") :
(void)0)
;
1470 self = (PySSLContext *) type->tp_alloc(type, 0);
1471 if (self == NULL((void*)0)) {
1472 SSL_CTX_free(ctx);
1473 return NULL((void*)0);
1474 }
1475 self->ctx = ctx;
1476 /* Defaults */
1477 SSL_CTX_set_verify(self->ctx, SSL_VERIFY_NONE0x00, NULL((void*)0));
1478 SSL_CTX_set_options(self->ctx, SSL_OP_ALL)SSL_CTX_ctrl((self->ctx),32,(0x00000FFFL),((void*)0));
1479
1480#define SID_CTX "Python"
1481 SSL_CTX_set_session_id_context(self->ctx, (const unsigned char *) SID_CTX,
1482 sizeof(SID_CTX));
1483#undef SID_CTX
1484
1485 return (PyObject *)self;
1486}
1487
1488static void
1489context_dealloc(PySSLContext *self)
1490{
1491 SSL_CTX_free(self->ctx);
1492 Py_TYPE(self)(((PyObject*)(self))->ob_type)->tp_free(self);
1493}
1494
1495static PyObject *
1496set_ciphers(PySSLContext *self, PyObject *args)
1497{
1498 int ret;
1499 const char *cipherlist;
1500
1501 if (!PyArg_ParseTuple(args, "s:set_ciphers", &cipherlist))
1502 return NULL((void*)0);
1503 ret = SSL_CTX_set_cipher_list(self->ctx, cipherlist);
1504 if (ret == 0) {
1505 /* Clearing the error queue is necessary on some OpenSSL versions,
1506 otherwise the error will be reported again when another SSL call
1507 is done. */
1508 ERR_clear_error();
1509 PyErr_SetString(PySSLErrorObject,
1510 "No cipher can be selected.");
1511 return NULL((void*)0);
1512 }
1513 Py_RETURN_NONEreturn ( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct))
)->ob_refcnt++), (&_Py_NoneStruct)
;
1514}
1515
1516static PyObject *
1517get_verify_mode(PySSLContext *self, void *c)
1518{
1519 switch (SSL_CTX_get_verify_mode(self->ctx)) {
1520 case SSL_VERIFY_NONE0x00:
1521 return PyLong_FromLong(PY_SSL_CERT_NONE);
1522 case SSL_VERIFY_PEER0x01:
1523 return PyLong_FromLong(PY_SSL_CERT_OPTIONAL);
1524 case SSL_VERIFY_PEER0x01 | SSL_VERIFY_FAIL_IF_NO_PEER_CERT0x02:
1525 return PyLong_FromLong(PY_SSL_CERT_REQUIRED);
1526 }
1527 PyErr_SetString(PySSLErrorObject,
1528 "invalid return value from SSL_CTX_get_verify_mode");
1529 return NULL((void*)0);
1530}
1531
1532static int
1533set_verify_mode(PySSLContext *self, PyObject *arg, void *c)
1534{
1535 int n, mode;
1536 if (!PyArg_Parse(arg, "i", &n))
1537 return -1;
1538 if (n == PY_SSL_CERT_NONE)
1539 mode = SSL_VERIFY_NONE0x00;
1540 else if (n == PY_SSL_CERT_OPTIONAL)
1541 mode = SSL_VERIFY_PEER0x01;
1542 else if (n == PY_SSL_CERT_REQUIRED)
1543 mode = SSL_VERIFY_PEER0x01 | SSL_VERIFY_FAIL_IF_NO_PEER_CERT0x02;
1544 else {
1545 PyErr_SetString(PyExc_ValueError,
1546 "invalid value for verify_mode");
1547 return -1;
1548 }
1549 SSL_CTX_set_verify(self->ctx, mode, NULL((void*)0));
1550 return 0;
1551}
1552
1553static PyObject *
1554get_options(PySSLContext *self, void *c)
1555{
1556 return PyLong_FromLong(SSL_CTX_get_options(self->ctx)SSL_CTX_ctrl((self->ctx),32,0,((void*)0)));
1557}
1558
1559static int
1560set_options(PySSLContext *self, PyObject *arg, void *c)
1561{
1562 long new_opts, opts, set, clear;
1563 if (!PyArg_Parse(arg, "l", &new_opts))
1564 return -1;
1565 opts = SSL_CTX_get_options(self->ctx)SSL_CTX_ctrl((self->ctx),32,0,((void*)0));
1566 clear = opts & ~new_opts;
1567 set = ~opts & new_opts;
1568 if (clear) {
1569#ifdef HAVE_SSL_CTX_CLEAR_OPTIONS
1570 SSL_CTX_clear_options(self->ctx, clear);
1571#else
1572 PyErr_SetString(PyExc_ValueError,
1573 "can't clear options before OpenSSL 0.9.8m");
1574 return -1;
1575#endif
1576 }
1577 if (set)
1578 SSL_CTX_set_options(self->ctx, set)SSL_CTX_ctrl((self->ctx),32,(set),((void*)0));
1579 return 0;
1580}
1581
1582static PyObject *
1583load_cert_chain(PySSLContext *self, PyObject *args, PyObject *kwds)
1584{
1585 char *kwlist[] = {"certfile", "keyfile", NULL((void*)0)};
1586 PyObject *certfile, *keyfile = NULL((void*)0);
1587 PyObject *certfile_bytes = NULL((void*)0), *keyfile_bytes = NULL((void*)0);
1588 int r;
1589
1590 errno(*__error()) = 0;
1591 ERR_clear_error();
1592 if (!PyArg_ParseTupleAndKeywords(args, kwds,
1593 "O|O:load_cert_chain", kwlist,
1594 &certfile, &keyfile))
1595 return NULL((void*)0);
1596 if (keyfile == Py_None(&_Py_NoneStruct))
1597 keyfile = NULL((void*)0);
1598 if (!PyUnicode_FSConverterPyUnicodeUCS2_FSConverter(certfile, &certfile_bytes)) {
1599 PyErr_SetString(PyExc_TypeError,
1600 "certfile should be a valid filesystem path");
1601 return NULL((void*)0);
1602 }
1603 if (keyfile && !PyUnicode_FSConverterPyUnicodeUCS2_FSConverter(keyfile, &keyfile_bytes)) {
1604 PyErr_SetString(PyExc_TypeError,
1605 "keyfile should be a valid filesystem path");
1606 goto error;
1607 }
1608 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1609 r = SSL_CTX_use_certificate_chain_file(self->ctx,
1610 PyBytes_AS_STRING(certfile_bytes)((__builtin_expect(!(((((((PyObject*)(certfile_bytes))->ob_type
))->tp_flags & ((1L<<27))) != 0)), 0) ? __assert_rtn
(__func__, "/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c",
1610, "PyBytes_Check(certfile_bytes)") : (void)0), (((PyBytesObject
*)(certfile_bytes))->ob_sval))
);
1611 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1612 if (r != 1) {
1613 if (errno(*__error()) != 0) {
1614 ERR_clear_error();
1615 PyErr_SetFromErrno(PyExc_IOError);
1616 }
1617 else {
1618 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1618);
1619 }
1620 goto error;
1621 }
1622 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1623 r = SSL_CTX_use_RSAPrivateKey_file(self->ctx,
1624 PyBytes_AS_STRING(keyfile ? keyfile_bytes : certfile_bytes)((__builtin_expect(!(((((((PyObject*)(keyfile ? keyfile_bytes
: certfile_bytes))->ob_type))->tp_flags & ((1L<<
27))) != 0)), 0) ? __assert_rtn(__func__, "/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c"
, 1624, "PyBytes_Check(keyfile ? keyfile_bytes : certfile_bytes)"
) : (void)0), (((PyBytesObject *)(keyfile ? keyfile_bytes : certfile_bytes
))->ob_sval))
,
1625 SSL_FILETYPE_PEM1);
1626 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1627 Py_XDECREF(keyfile_bytes)do { if ((keyfile_bytes) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(keyfile_bytes))->ob_refcnt != 0) { if (
((PyObject*)keyfile_bytes)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1627, (PyObject
*)(keyfile_bytes)); } else _Py_Dealloc((PyObject *)(keyfile_bytes
)); } while (0); } while (0)
;
1628 Py_XDECREF(certfile_bytes)do { if ((certfile_bytes) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(certfile_bytes))->ob_refcnt != 0) { if
(((PyObject*)certfile_bytes)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1628, (PyObject
*)(certfile_bytes)); } else _Py_Dealloc((PyObject *)(certfile_bytes
)); } while (0); } while (0)
;
1629 if (r != 1) {
1630 if (errno(*__error()) != 0) {
1631 ERR_clear_error();
1632 PyErr_SetFromErrno(PyExc_IOError);
1633 }
1634 else {
1635 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1635);
1636 }
1637 return NULL((void*)0);
1638 }
1639 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1640 r = SSL_CTX_check_private_key(self->ctx);
1641 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1642 if (r != 1) {
1643 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1643);
1644 return NULL((void*)0);
1645 }
1646 Py_RETURN_NONEreturn ( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct))
)->ob_refcnt++), (&_Py_NoneStruct)
;
1647
1648error:
1649 Py_XDECREF(keyfile_bytes)do { if ((keyfile_bytes) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(keyfile_bytes))->ob_refcnt != 0) { if (
((PyObject*)keyfile_bytes)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1649, (PyObject
*)(keyfile_bytes)); } else _Py_Dealloc((PyObject *)(keyfile_bytes
)); } while (0); } while (0)
;
1650 Py_XDECREF(certfile_bytes)do { if ((certfile_bytes) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(certfile_bytes))->ob_refcnt != 0) { if
(((PyObject*)certfile_bytes)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1650, (PyObject
*)(certfile_bytes)); } else _Py_Dealloc((PyObject *)(certfile_bytes
)); } while (0); } while (0)
;
1651 return NULL((void*)0);
1652}
1653
1654static PyObject *
1655load_verify_locations(PySSLContext *self, PyObject *args, PyObject *kwds)
1656{
1657 char *kwlist[] = {"cafile", "capath", NULL((void*)0)};
1658 PyObject *cafile = NULL((void*)0), *capath = NULL((void*)0);
1659 PyObject *cafile_bytes = NULL((void*)0), *capath_bytes = NULL((void*)0);
1660 const char *cafile_buf = NULL((void*)0), *capath_buf = NULL((void*)0);
1661 int r;
1662
1663 errno(*__error()) = 0;
1664 if (!PyArg_ParseTupleAndKeywords(args, kwds,
1665 "|OO:load_verify_locations", kwlist,
1666 &cafile, &capath))
1667 return NULL((void*)0);
1668 if (cafile == Py_None(&_Py_NoneStruct))
1669 cafile = NULL((void*)0);
1670 if (capath == Py_None(&_Py_NoneStruct))
1671 capath = NULL((void*)0);
1672 if (cafile == NULL((void*)0) && capath == NULL((void*)0)) {
1673 PyErr_SetString(PyExc_TypeError,
1674 "cafile and capath cannot be both omitted");
1675 return NULL((void*)0);
1676 }
1677 if (cafile && !PyUnicode_FSConverterPyUnicodeUCS2_FSConverter(cafile, &cafile_bytes)) {
1678 PyErr_SetString(PyExc_TypeError,
1679 "cafile should be a valid filesystem path");
1680 return NULL((void*)0);
1681 }
1682 if (capath && !PyUnicode_FSConverterPyUnicodeUCS2_FSConverter(capath, &capath_bytes)) {
1683 Py_XDECREF(cafile_bytes)do { if ((cafile_bytes) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(cafile_bytes))->ob_refcnt != 0) { if (
((PyObject*)cafile_bytes)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1683, (PyObject
*)(cafile_bytes)); } else _Py_Dealloc((PyObject *)(cafile_bytes
)); } while (0); } while (0)
;
1684 PyErr_SetString(PyExc_TypeError,
1685 "capath should be a valid filesystem path");
1686 return NULL((void*)0);
1687 }
1688 if (cafile)
1689 cafile_buf = PyBytes_AS_STRING(cafile_bytes)((__builtin_expect(!(((((((PyObject*)(cafile_bytes))->ob_type
))->tp_flags & ((1L<<27))) != 0)), 0) ? __assert_rtn
(__func__, "/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c",
1689, "PyBytes_Check(cafile_bytes)") : (void)0), (((PyBytesObject
*)(cafile_bytes))->ob_sval))
;
1690 if (capath)
1691 capath_buf = PyBytes_AS_STRING(capath_bytes)((__builtin_expect(!(((((((PyObject*)(capath_bytes))->ob_type
))->tp_flags & ((1L<<27))) != 0)), 0) ? __assert_rtn
(__func__, "/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c",
1691, "PyBytes_Check(capath_bytes)") : (void)0), (((PyBytesObject
*)(capath_bytes))->ob_sval))
;
1692 PySSL_BEGIN_ALLOW_THREADS{ PyThreadState *_save = ((void*)0); if (_ssl_locks_count>
0) {_save = PyEval_SaveThread();}
1693 r = SSL_CTX_load_verify_locations(self->ctx, cafile_buf, capath_buf);
1694 PySSL_END_ALLOW_THREADSif (_ssl_locks_count>0){PyEval_RestoreThread(_save);} }
1695 Py_XDECREF(cafile_bytes)do { if ((cafile_bytes) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(cafile_bytes))->ob_refcnt != 0) { if (
((PyObject*)cafile_bytes)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1695, (PyObject
*)(cafile_bytes)); } else _Py_Dealloc((PyObject *)(cafile_bytes
)); } while (0); } while (0)
;
1696 Py_XDECREF(capath_bytes)do { if ((capath_bytes) == ((void*)0)) ; else do { if (_Py_RefTotal
-- , --((PyObject*)(capath_bytes))->ob_refcnt != 0) { if (
((PyObject*)capath_bytes)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1696, (PyObject
*)(capath_bytes)); } else _Py_Dealloc((PyObject *)(capath_bytes
)); } while (0); } while (0)
;
1697 if (r != 1) {
1698 if (errno(*__error()) != 0) {
1699 ERR_clear_error();
1700 PyErr_SetFromErrno(PyExc_IOError);
1701 }
1702 else {
1703 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1703);
1704 }
1705 return NULL((void*)0);
1706 }
1707 Py_RETURN_NONEreturn ( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct))
)->ob_refcnt++), (&_Py_NoneStruct)
;
1708}
1709
1710static PyObject *
1711context_wrap_socket(PySSLContext *self, PyObject *args, PyObject *kwds)
1712{
1713 char *kwlist[] = {"sock", "server_side", "server_hostname", NULL((void*)0)};
1714 PySocketSockObject *sock;
1715 int server_side = 0;
1716 char *hostname = NULL((void*)0);
1717 PyObject *hostname_obj, *res;
1718
1719 /* server_hostname is either None (or absent), or to be encoded
1720 using the idna encoding. */
1721 if (!PyArg_ParseTupleAndKeywords(args, kwds, "O!i|O!:_wrap_socket", kwlist,
1722 PySocketModule.Sock_Type,
1723 &sock, &server_side,
1724 Py_TYPE(Py_None)(((PyObject*)((&_Py_NoneStruct)))->ob_type), &hostname_obj)) {
1725 PyErr_Clear();
1726 if (!PyArg_ParseTupleAndKeywords(args, kwds, "O!iet:_wrap_socket", kwlist,
1727 PySocketModule.Sock_Type,
1728 &sock, &server_side,
1729 "idna", &hostname))
1730 return NULL((void*)0);
1731#ifndef SSL_CTRL_SET_TLSEXT_HOSTNAME55
1732 PyMem_Free(hostname);
1733 PyErr_SetString(PyExc_ValueError, "server_hostname is not supported "
1734 "by your OpenSSL library");
1735 return NULL((void*)0);
1736#endif
1737 }
1738
1739 res = (PyObject *) newPySSLSocket(self->ctx, sock, server_side,
1740 hostname);
1741 if (hostname != NULL((void*)0))
1742 PyMem_Free(hostname);
1743 return res;
1744}
1745
1746static PyObject *
1747session_stats(PySSLContext *self, PyObject *unused)
1748{
1749 int r;
1750 PyObject *value, *stats = PyDict_New();
1751 if (!stats)
1752 return NULL((void*)0);
1753
1754#define ADD_STATS(SSL_NAME, KEY_NAME) \
1755 value = PyLong_FromLong(SSL_CTX_sess_ ## SSL_NAME (self->ctx)); \
1756 if (value == NULL((void*)0)) \
1757 goto error; \
1758 r = PyDict_SetItemString(stats, KEY_NAME, value); \
1759 Py_DECREF(value)do { if (_Py_RefTotal-- , --((PyObject*)(value))->ob_refcnt
!= 0) { if (((PyObject*)value)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1759, (PyObject
*)(value)); } else _Py_Dealloc((PyObject *)(value)); } while
(0)
; \
1760 if (r < 0) \
1761 goto error;
1762
1763 ADD_STATS(number, "number");
1764 ADD_STATS(connect, "connect");
1765 ADD_STATS(connect_good, "connect_good");
1766 ADD_STATS(connect_renegotiate, "connect_renegotiate");
1767 ADD_STATS(accept, "accept");
1768 ADD_STATS(accept_good, "accept_good");
1769 ADD_STATS(accept_renegotiate, "accept_renegotiate");
1770 ADD_STATS(accept, "accept");
1771 ADD_STATS(hits, "hits");
1772 ADD_STATS(misses, "misses");
1773 ADD_STATS(timeouts, "timeouts");
1774 ADD_STATS(cache_full, "cache_full");
1775
1776#undef ADD_STATS
1777
1778 return stats;
1779
1780error:
1781 Py_DECREF(stats)do { if (_Py_RefTotal-- , --((PyObject*)(stats))->ob_refcnt
!= 0) { if (((PyObject*)stats)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1781, (PyObject
*)(stats)); } else _Py_Dealloc((PyObject *)(stats)); } while
(0)
;
1782 return NULL((void*)0);
1783}
1784
1785static PyObject *
1786set_default_verify_paths(PySSLContext *self, PyObject *unused)
1787{
1788 if (!SSL_CTX_set_default_verify_paths(self->ctx)) {
1789 _setSSLError(NULL((void*)0), 0, __FILE__"/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", __LINE__1789);
1790 return NULL((void*)0);
1791 }
1792 Py_RETURN_NONEreturn ( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct))
)->ob_refcnt++), (&_Py_NoneStruct)
;
1793}
1794
1795static PyGetSetDef context_getsetlist[] = {
1796 {"options", (getter) get_options,
1797 (setter) set_options, NULL((void*)0)},
1798 {"verify_mode", (getter) get_verify_mode,
1799 (setter) set_verify_mode, NULL((void*)0)},
1800 {NULL((void*)0)}, /* sentinel */
1801};
1802
1803static struct PyMethodDef context_methods[] = {
1804 {"_wrap_socket", (PyCFunction) context_wrap_socket,
1805 METH_VARARGS0x0001 | METH_KEYWORDS0x0002, NULL((void*)0)},
1806 {"set_ciphers", (PyCFunction) set_ciphers,
1807 METH_VARARGS0x0001, NULL((void*)0)},
1808 {"load_cert_chain", (PyCFunction) load_cert_chain,
1809 METH_VARARGS0x0001 | METH_KEYWORDS0x0002, NULL((void*)0)},
1810 {"load_verify_locations", (PyCFunction) load_verify_locations,
1811 METH_VARARGS0x0001 | METH_KEYWORDS0x0002, NULL((void*)0)},
1812 {"session_stats", (PyCFunction) session_stats,
1813 METH_NOARGS0x0004, NULL((void*)0)},
1814 {"set_default_verify_paths", (PyCFunction) set_default_verify_paths,
1815 METH_NOARGS0x0004, NULL((void*)0)},
1816 {NULL((void*)0), NULL((void*)0)} /* sentinel */
1817};
1818
1819static PyTypeObject PySSLContext_Type = {
1820 PyVarObject_HEAD_INIT(NULL, 0){ { 0, 0, 1, ((void*)0) }, 0 },
1821 "_ssl._SSLContext", /*tp_name*/
1822 sizeof(PySSLContext), /*tp_basicsize*/
1823 0, /*tp_itemsize*/
1824 (destructor)context_dealloc, /*tp_dealloc*/
1825 0, /*tp_print*/
1826 0, /*tp_getattr*/
1827 0, /*tp_setattr*/
1828 0, /*tp_reserved*/
1829 0, /*tp_repr*/
1830 0, /*tp_as_number*/
1831 0, /*tp_as_sequence*/
1832 0, /*tp_as_mapping*/
1833 0, /*tp_hash*/
1834 0, /*tp_call*/
1835 0, /*tp_str*/
1836 0, /*tp_getattro*/
1837 0, /*tp_setattro*/
1838 0, /*tp_as_buffer*/
1839 Py_TPFLAGS_DEFAULT( 0 | (1L<<18) | 0) | Py_TPFLAGS_BASETYPE(1L<<10), /*tp_flags*/
1840 0, /*tp_doc*/
1841 0, /*tp_traverse*/
1842 0, /*tp_clear*/
1843 0, /*tp_richcompare*/
1844 0, /*tp_weaklistoffset*/
1845 0, /*tp_iter*/
1846 0, /*tp_iternext*/
1847 context_methods, /*tp_methods*/
1848 0, /*tp_members*/
1849 context_getsetlist, /*tp_getset*/
1850 0, /*tp_base*/
1851 0, /*tp_dict*/
1852 0, /*tp_descr_get*/
1853 0, /*tp_descr_set*/
1854 0, /*tp_dictoffset*/
1855 0, /*tp_init*/
1856 0, /*tp_alloc*/
1857 context_new, /*tp_new*/
1858};
1859
1860
1861
1862#ifdef HAVE_OPENSSL_RAND1
1863
1864/* helper routines for seeding the SSL PRNG */
1865static PyObject *
1866PySSL_RAND_add(PyObject *self, PyObject *args)
1867{
1868 char *buf;
1869 int len;
1870 double entropy;
1871
1872 if (!PyArg_ParseTuple(args, "s#d:RAND_add", &buf, &len, &entropy))
1873 return NULL((void*)0);
1874 RAND_add(buf, len, entropy);
1875 Py_INCREF(Py_None)( _Py_RefTotal++ , ((PyObject*)((&_Py_NoneStruct)))->ob_refcnt
++)
;
1876 return Py_None(&_Py_NoneStruct);
1877}
1878
1879PyDoc_STRVAR(PySSL_RAND_add_doc,static char PySSL_RAND_add_doc[] = "RAND_add(string, entropy)\n\nMix string into the OpenSSL PRNG state. entropy (a float) is a lower\nbound on the entropy contained in string. See RFC 1750."
1880"RAND_add(string, entropy)\n\static char PySSL_RAND_add_doc[] = "RAND_add(string, entropy)\n\nMix string into the OpenSSL PRNG state. entropy (a float) is a lower\nbound on the entropy contained in string. See RFC 1750."
1881\n\static char PySSL_RAND_add_doc[] = "RAND_add(string, entropy)\n\nMix string into the OpenSSL PRNG state. entropy (a float) is a lower\nbound on the entropy contained in string. See RFC 1750."
1882Mix string into the OpenSSL PRNG state. entropy (a float) is a lower\n\static char PySSL_RAND_add_doc[] = "RAND_add(string, entropy)\n\nMix string into the OpenSSL PRNG state. entropy (a float) is a lower\nbound on the entropy contained in string. See RFC 1750."
1883bound on the entropy contained in string. See RFC 1750.")static char PySSL_RAND_add_doc[] = "RAND_add(string, entropy)\n\nMix string into the OpenSSL PRNG state. entropy (a float) is a lower\nbound on the entropy contained in string. See RFC 1750.";
1884
1885static PyObject *
1886PySSL_RAND_status(PyObject *self)
1887{
1888 return PyLong_FromLong(RAND_status());
1889}
1890
1891PyDoc_STRVAR(PySSL_RAND_status_doc,static char PySSL_RAND_status_doc[] = "RAND_status() -> 0 or 1\n\nReturns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\nIt is necessary to seed the PRNG with RAND_add() on some platforms before\nusing the ssl() function."
1892"RAND_status() -> 0 or 1\n\static char PySSL_RAND_status_doc[] = "RAND_status() -> 0 or 1\n\nReturns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\nIt is necessary to seed the PRNG with RAND_add() on some platforms before\nusing the ssl() function."
1893\n\static char PySSL_RAND_status_doc[] = "RAND_status() -> 0 or 1\n\nReturns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\nIt is necessary to seed the PRNG with RAND_add() on some platforms before\nusing the ssl() function."
1894Returns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\n\static char PySSL_RAND_status_doc[] = "RAND_status() -> 0 or 1\n\nReturns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\nIt is necessary to seed the PRNG with RAND_add() on some platforms before\nusing the ssl() function."
1895It is necessary to seed the PRNG with RAND_add() on some platforms before\n\static char PySSL_RAND_status_doc[] = "RAND_status() -> 0 or 1\n\nReturns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\nIt is necessary to seed the PRNG with RAND_add() on some platforms before\nusing the ssl() function."
1896using the ssl() function.")static char PySSL_RAND_status_doc[] = "RAND_status() -> 0 or 1\n\nReturns 1 if the OpenSSL PRNG has been seeded with enough data and 0 if not.\nIt is necessary to seed the PRNG with RAND_add() on some platforms before\nusing the ssl() function.";
1897
1898static PyObject *
1899PySSL_RAND_egd(PyObject *self, PyObject *args)
1900{
1901 PyObject *path;
1902 int bytes;
1903
1904 if (!PyArg_ParseTuple(args, "O&|i:RAND_egd",
1905 PyUnicode_FSConverterPyUnicodeUCS2_FSConverter, &path))
1906 return NULL((void*)0);
1907
1908 bytes = RAND_egd(PyBytes_AsString(path));
1909 Py_DECREF(path)do { if (_Py_RefTotal-- , --((PyObject*)(path))->ob_refcnt
!= 0) { if (((PyObject*)path)->ob_refcnt < 0) _Py_NegativeRefcount
("/Users/brett/Dev/python/3.x/py3k/Modules/_ssl.c", 1909, (PyObject
*)(path)); } else _Py_Dealloc((PyObject *)(path)); } while (
0)
;
1910 if (bytes == -1) {
1911 PyErr_SetString(PySSLErrorObject,
1912 "EGD connection failed or EGD did not return "
1913 "enough data to seed the PRNG");
1914 return NULL((void*)0);
1915 }
1916 return PyLong_FromLong(bytes);
1917}
1918
1919PyDoc_STRVAR(PySSL_RAND_egd_doc,static char PySSL_RAND_egd_doc[] = "RAND_egd(path) -> bytes\n\nQueries the entropy gather daemon (EGD) on the socket named by 'path'.\nReturns number of bytes read. Raises SSLError if connection to EGD\nfails or if it does provide enough data to seed PRNG."
1920"RAND_egd(path) -> bytes\n\static char PySSL_RAND_egd_doc[] = "RAND_egd(path) -> bytes\n\nQueries the entropy gather daemon (EGD) on the socket named by 'path'.\nReturns number of bytes read. Raises SSLError if connection to EGD\nfails or if it does provide enough data to seed PRNG."
1921\n\static char PySSL_RAND_egd_doc[] = "RAND_egd(path) -> bytes\n\nQueries the entropy gather daemon (EGD) on the socket named by 'path'.\nReturns number of bytes read. Raises SSLError if connection to EGD\nfails or if it does provide enough data to seed PRNG."
1922Queries the entropy gather daemon (EGD) on the socket named by 'path'.\n\static char PySSL_RAND_egd_doc[] = "RAND_egd(path) -> bytes\n\nQueries the entropy gather daemon (EGD) on the socket named by 'path'.\nReturns number of bytes read. Raises SSLError if connection to EGD\nfails or if it does provide enough data to seed PRNG."
1923Returns number of bytes read. Raises SSLError if connection to EGD\n\static char PySSL_RAND_egd_doc[] = "RAND_egd(path) -> bytes\n\nQueries the entropy gather daemon (EGD) on the socket named by 'path'.\nReturns number of bytes read. Raises SSLError if connection to EGD\nfails or if it does provide enough data to seed PRNG."
1924fails or if it does provide enough data to seed PRNG.")static char PySSL_RAND_egd_doc[] = "RAND_egd(path) -> bytes\n\nQueries the entropy gather daemon (EGD) on the socket named by 'path'.\nReturns number of bytes read. Raises SSLError if connection to EGD\nfails or if it does provide enough data to seed PRNG.";
1925
1926#endif
1927
1928
1929
1930/* List of functions exported by this module. */
1931
1932static PyMethodDef PySSL_methods[] = {
1933 {"_test_decode_cert", PySSL_test_decode_certificate,
1934 METH_VARARGS0x0001},
1935#ifdef HAVE_OPENSSL_RAND1
1936 {"RAND_add", PySSL_RAND_add, METH_VARARGS0x0001,
1937 PySSL_RAND_add_doc},
1938 {"RAND_egd", PySSL_RAND_egd, METH_VARARGS0x0001,
1939 PySSL_RAND_egd_doc},
1940 {"RAND_status", (PyCFunction)PySSL_RAND_status, METH_NOARGS0x0004,
1941 PySSL_RAND_status_doc},
1942#endif
1943 {NULL((void*)0), NULL((void*)0)} /* Sentinel */
1944};
1945
1946
1947#ifdef WITH_THREAD1
1948
1949/* an implementation of OpenSSL threading operations in terms
1950 of the Python C thread library */
1951
1952static PyThread_type_lock *_ssl_locks = NULL((void*)0);
1953
1954static unsigned long _ssl_thread_id_function (void) {
1955 return PyThread_get_thread_ident();
1956}
1957
1958static void _ssl_thread_locking_function
1959 (int mode, int n, const char *file, int line) {
1960 /* this function is needed to perform locking on shared data
1961 structures. (Note that OpenSSL uses a number of global data
1962 structures that will be implicitly shared whenever multiple
1963 threads use OpenSSL.) Multi-threaded applications will
1964 crash at random if it is not set.
1965
1966 locking_function() must be able to handle up to
1967 CRYPTO_num_locks() different mutex locks. It sets the n-th
1968 lock if mode & CRYPTO_LOCK, and releases it otherwise.
1969
1970 file and line are the file number of the function setting the
1971 lock. They can be useful for debugging.
1972 */
1973
1974 if ((_ssl_locks == NULL((void*)0)) ||
1975 (n < 0) || ((unsigned)n >= _ssl_locks_count))
1976 return;
1977
1978 if (mode & CRYPTO_LOCK1) {
1979 PyThread_acquire_lock(_ssl_locks[n], 1);
1980 } else {
1981 PyThread_release_lock(_ssl_locks[n]);
1982 }
1983}
1984
1985static int _setup_ssl_threads(void) {
1986
1987 unsigned int i;
1988
1989 if (_ssl_locks == NULL((void*)0)) {
1990 _ssl_locks_count = CRYPTO_num_locks();
1991 _ssl_locks = (PyThread_type_lock *)
1992 malloc(sizeof(PyThread_type_lock) * _ssl_locks_count);
1993 if (_ssl_locks == NULL((void*)0))
1994 return 0;
1995 memset(_ssl_locks, 0,((__builtin_object_size (_ssl_locks, 0) != (size_t) -1) ? __builtin___memset_chk
(_ssl_locks, 0, sizeof(PyThread_type_lock) * _ssl_locks_count
, __builtin_object_size (_ssl_locks, 0)) : __inline_memset_chk
(_ssl_locks, 0, sizeof(PyThread_type_lock) * _ssl_locks_count
))
1996 sizeof(PyThread_type_lock) * _ssl_locks_count)((__builtin_object_size (_ssl_locks, 0) != (size_t) -1) ? __builtin___memset_chk
(_ssl_locks, 0, sizeof(PyThread_type_lock) * _ssl_locks_count
, __builtin_object_size (_ssl_locks, 0)) : __inline_memset_chk
(_ssl_locks, 0, sizeof(PyThread_type_lock) * _ssl_locks_count
))
;
1997 for (i = 0; i < _ssl_locks_count; i++) {
1998 _ssl_locks[i] = PyThread_allocate_lock();
1999 if (_ssl_locks[i] == NULL((void*)0)) {
2000 unsigned int j;
2001 for (j = 0; j < i; j++) {
2002 PyThread_free_lock(_ssl_locks[j]);
2003 }
2004 free(_ssl_locks);
2005 return 0;
2006 }
2007 }
2008 CRYPTO_set_locking_callback(_ssl_thread_locking_function);
2009 CRYPTO_set_id_callback(_ssl_thread_id_function);
2010 }
2011 return 1;
2012}
2013
2014#endif /* def HAVE_THREAD */
2015
2016PyDoc_STRVAR(module_doc,static char module_doc[] = "Implementation module for SSL socket operations. See the socket module\nfor documentation."
2017"Implementation module for SSL socket operations. See the socket module\n\static char module_doc[] = "Implementation module for SSL socket operations. See the socket module\nfor documentation."
2018for documentation.")static char module_doc[] = "Implementation module for SSL socket operations. See the socket module\nfor documentation.";
2019
2020
2021static struct PyModuleDef _sslmodule = {
2022 PyModuleDef_HEAD_INIT{ { 0, 0, 1, ((void*)0) }, ((void*)0), 0, ((void*)0), },
2023 "_ssl",
2024 module_doc,
2025 -1,
2026 PySSL_methods,
2027 NULL((void*)0),
2028 NULL((void*)0),
2029 NULL((void*)0),
2030 NULL((void*)0)
2031};
2032
2033PyMODINIT_FUNCPyObject*
2034PyInit__ssl(void)
2035{
2036 PyObject *m, *d, *r;
2037 unsigned long libver;
2038 unsigned int major, minor, fix, patch, status;
2039 PySocketModule_APIObject *socket_api;
2040
2041 if (PyType_Ready(&PySSLContext_Type) < 0)
2042 return NULL((void*)0);
2043 if (PyType_Ready(&PySSLSocket_Type) < 0)
2044 return NULL((void*)0);
2045
2046 m = PyModule_Create(&_sslmodule)PyModule_Create2TraceRefs(&_sslmodule, 1013);
2047 if (m == NULL((void*)0))
2048 return NULL((void*)0);
2049 d = PyModule_GetDict(m);
2050
2051 /* Load _socket module and its C API */
2052 socket_api = PySocketModule_ImportModuleAndAPI()PyCapsule_Import("_socket" "." "CAPI", 1);
2053 if (!socket_api)
2054 return NULL((void*)0);
2055 PySocketModule = *socket_api;
2056
2057 /* Init OpenSSL */
2058 SSL_load_error_strings();
2059 SSL_library_init();
2060#ifdef WITH_THREAD1
2061 /* note that this will start threading if not already started */
2062 if (!_setup_ssl_threads()) {
2063 return NULL((void*)0);
2064 }
2065#endif
2066 OpenSSL_add_all_algorithms()OPENSSL_add_all_algorithms_noconf();
2067
2068 /* Add symbols to module dict */
2069 PySSLErrorObject = PyErr_NewException("ssl.SSLError",
2070 PySocketModule.error,
2071 NULL((void*)0));
2072 if (PySSLErrorObject == NULL((void*)0))
2073 return NULL((void*)0);
2074 if (PyDict_SetItemString(d, "SSLError", PySSLErrorObject) != 0)
2075 return NULL((void*)0);
2076 if (PyDict_SetItemString(d, "_SSLContext",
2077 (PyObject *)&PySSLContext_Type) != 0)
2078 return NULL((void*)0);
2079 if (PyDict_SetItemString(d, "_SSLSocket",
2080 (PyObject *)&PySSLSocket_Type) != 0)
2081 return NULL((void*)0);
2082 PyModule_AddIntConstant(m, "SSL_ERROR_ZERO_RETURN",
2083 PY_SSL_ERROR_ZERO_RETURN);
2084 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_READ",
2085 PY_SSL_ERROR_WANT_READ);
2086 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_WRITE",
2087 PY_SSL_ERROR_WANT_WRITE);
2088 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_X509_LOOKUP",
2089 PY_SSL_ERROR_WANT_X509_LOOKUP);
2090 PyModule_AddIntConstant(m, "SSL_ERROR_SYSCALL",
2091 PY_SSL_ERROR_SYSCALL);
2092 PyModule_AddIntConstant(m, "SSL_ERROR_SSL",
2093 PY_SSL_ERROR_SSL);
2094 PyModule_AddIntConstant(m, "SSL_ERROR_WANT_CONNECT",
2095 PY_SSL_ERROR_WANT_CONNECT);
2096 /* non ssl.h errorcodes */
2097 PyModule_AddIntConstant(m, "SSL_ERROR_EOF",
2098 PY_SSL_ERROR_EOF);
2099 PyModule_AddIntConstant(m, "SSL_ERROR_INVALID_ERROR_CODE",
2100 PY_SSL_ERROR_INVALID_ERROR_CODE);
2101 /* cert requirements */
2102 PyModule_AddIntConstant(m, "CERT_NONE",
2103 PY_SSL_CERT_NONE);
2104 PyModule_AddIntConstant(m, "CERT_OPTIONAL",
2105 PY_SSL_CERT_OPTIONAL);
2106 PyModule_AddIntConstant(m, "CERT_REQUIRED",
2107 PY_SSL_CERT_REQUIRED);
2108
2109 /* protocol versions */
2110 PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
2111 PY_SSL_VERSION_SSL2);
2112 PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
2113 PY_SSL_VERSION_SSL3);
2114 PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",
2115 PY_SSL_VERSION_SSL23);
2116 PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",
2117 PY_SSL_VERSION_TLS1);
2118
2119 /* protocol options */
2120 PyModule_AddIntConstant(m, "OP_ALL", SSL_OP_ALL0x00000FFFL);
2121 PyModule_AddIntConstant(m, "OP_NO_SSLv2", SSL_OP_NO_SSLv20x01000000L);
2122 PyModule_AddIntConstant(m, "OP_NO_SSLv3", SSL_OP_NO_SSLv30x02000000L);
2123 PyModule_AddIntConstant(m, "OP_NO_TLSv1", SSL_OP_NO_TLSv10x04000000L);
2124
2125#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME55
2126 r = Py_True((PyObject *) &_Py_TrueStruct);
2127#else
2128 r = Py_False((PyObject *) &_Py_FalseStruct);
2129#endif
2130 Py_INCREF(r)( _Py_RefTotal++ , ((PyObject*)(r))->ob_refcnt++);
2131 PyModule_AddObject(m, "HAS_SNI", r);
2132
2133 /* OpenSSL version */
2134 /* SSLeay() gives us the version of the library linked against,
2135 which could be different from the headers version.
2136 */
2137 libver = SSLeay();
2138 r = PyLong_FromUnsignedLong(libver);
2139 if (r == NULL((void*)0))
2140 return NULL((void*)0);
2141 if (PyModule_AddObject(m, "OPENSSL_VERSION_NUMBER", r))
2142 return NULL((void*)0);
2143 status = libver & 0xF;
2144 libver >>= 4;
2145 patch = libver & 0xFF;
2146 libver >>= 8;
2147 fix = libver & 0xFF;
2148 libver >>= 8;
2149 minor = libver & 0xFF;
2150 libver >>= 8;
2151 major = libver & 0xFF;
2152 r = Py_BuildValue("IIIII", major, minor, fix, patch, status);
2153 if (r == NULL((void*)0) || PyModule_AddObject(m, "OPENSSL_VERSION_INFO", r))
2154 return NULL((void*)0);
2155 r = PyUnicode_FromStringPyUnicodeUCS2_FromString(SSLeay_version(SSLEAY_VERSION0));
2156 if (r == NULL((void*)0) || PyModule_AddObject(m, "OPENSSL_VERSION", r))
2157 return NULL((void*)0);
2158
2159 return m;
2160}