/* SSL socket module

SSL support based on patches by Brian E Gallew and Laszlo Kovacs.

Re-worked a bit by Bill Janssen to add server-side support and

certificate decoding. Chris Stawarz contributed some non-blocking

patches.

This module is imported by ssl.py. It should *not* be used

directly.

XXX should partial writes be enabled, SSL_MODE_ENABLE_PARTIAL_WRITE?

XXX integrate several "shutdown modes" as suggested in

http://bugs.python.org/issue8108#msg102867 ?

*/

#define PY_SSIZE_T_CLEAN

#include "Python.h"

#ifdef WITH_THREAD

#include "pythread.h"

#define PySSL_BEGIN_ALLOW_THREADS_S(save) \

do { if (_ssl_locks_count>0) { (save) = PyEval_SaveThread(); } } while (0)

#define PySSL_END_ALLOW_THREADS_S(save) \

do { if (_ssl_locks_count>0) { PyEval_RestoreThread(save); } } while (0)

#define PySSL_BEGIN_ALLOW_THREADS { \

PyThreadState *_save = NULL; \

PySSL_BEGIN_ALLOW_THREADS_S(_save);

#define PySSL_BLOCK_THREADS PySSL_END_ALLOW_THREADS_S(_save);

#define PySSL_UNBLOCK_THREADS PySSL_BEGIN_ALLOW_THREADS_S(_save);

#define PySSL_END_ALLOW_THREADS PySSL_END_ALLOW_THREADS_S(_save); }

#else /* no WITH_THREAD */

#define PySSL_BEGIN_ALLOW_THREADS_S(save)

#define PySSL_END_ALLOW_THREADS_S(save)

#define PySSL_BEGIN_ALLOW_THREADS

#define PySSL_BLOCK_THREADS

#define PySSL_UNBLOCK_THREADS

#define PySSL_END_ALLOW_THREADS

#endif

/* Include symbols from _socket module */

#include "socketmodule.h"

#if defined(HAVE_POLL_H)

#include <poll.h>

#elif defined(HAVE_SYS_POLL_H)

#include <sys/poll.h>

#endif

#ifndef MS_WINDOWS

/* inet_pton */

#include <arpa/inet.h>

#endif

/* Don't warn about deprecated functions */

#ifdef __GNUC__

#pragma GCC diagnostic ignored "-Wdeprecated-declarations"

#endif

#ifdef __clang__

#pragma clang diagnostic ignored "-Wdeprecated-declarations"

#endif

/* Include OpenSSL header files */

#include "openssl/rsa.h"

#include "openssl/crypto.h"

#include "openssl/x509.h"

#include "openssl/x509v3.h"

#include "openssl/pem.h"

#include "openssl/ssl.h"

#include "openssl/err.h"

#include "openssl/rand.h"

#include "openssl/dh.h"

/* SSL error object */

static PyObject *PySSLErrorObject;

static PyObject *PySSLZeroReturnErrorObject;

static PyObject *PySSLWantReadErrorObject;

static PyObject *PySSLWantWriteErrorObject;

static PyObject *PySSLSyscallErrorObject;

static PyObject *PySSLEOFErrorObject;

/* Error mappings */

static PyObject *err_codes_to_names;

static PyObject *err_names_to_codes;

static PyObject *lib_codes_to_names;

struct py_ssl_error_code {

const char *mnemonic;

int library, reason;

};

struct py_ssl_library_code {

const char *library;

int code;

};

/* Include generated data (error codes) */

#include "_ssl_data.h"

#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)

# define OPENSSL_VERSION_1_1 1

# define PY_OPENSSL_1_1_API 1

#endif

/* LibreSSL 2.7.0 provides necessary OpenSSL 1.1.0 APIs */

#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER >= 0x2070000fL

# define PY_OPENSSL_1_1_API 1

#endif

/* Openssl comes with TLSv1.1 and TLSv1.2 between 1.0.0h and 1.0.1

http://www.openssl.org/news/changelog.html

*/

#if OPENSSL_VERSION_NUMBER >= 0x10001000L

# define HAVE_TLSv1_2 1

#else

# define HAVE_TLSv1_2 0

#endif

/* SNI support (client- and server-side) appeared in OpenSSL 1.0.0 and 0.9.8f

* This includes the SSL_set_SSL_CTX() function.

*/

#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME

# define HAVE_SNI 1

#else

# define HAVE_SNI 0

#endif

/* ALPN added in OpenSSL 1.0.2 */

#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation

# define HAVE_ALPN 1

#else

# define HAVE_ALPN 0

#endif

/* We cannot rely on OPENSSL_NO_NEXTPROTONEG because LibreSSL 2.6.1 dropped

* NPN support but did not set OPENSSL_NO_NEXTPROTONEG for compatibility

* reasons. The check for TLSEXT_TYPE_next_proto_neg works with

* OpenSSL 1.0.1+ and LibreSSL.

* OpenSSL 1.1.1-pre1 dropped NPN but still has TLSEXT_TYPE_next_proto_neg.

*/

#ifdef OPENSSL_NO_NEXTPROTONEG

# define HAVE_NPN 0

#elif (OPENSSL_VERSION_NUMBER >= 0x10101000L) && !defined(LIBRESSL_VERSION_NUMBER)

# define HAVE_NPN 0

#elif defined(TLSEXT_TYPE_next_proto_neg)

# define HAVE_NPN 1

#else

# define HAVE_NPN 0

#endif

#ifndef INVALID_SOCKET /* MS defines this */

#define INVALID_SOCKET (-1)

#endif

/* OpenSSL 1.0.2 and LibreSSL needs extra code for locking */

#if !defined(OPENSSL_VERSION_1_1) && defined(WITH_THREAD)

#define HAVE_OPENSSL_CRYPTO_LOCK

#endif

#if defined(OPENSSL_VERSION_1_1) && !defined(OPENSSL_NO_SSL2)

#define OPENSSL_NO_SSL2

#endif

#ifndef PY_OPENSSL_1_1_API

/* OpenSSL 1.1 API shims for OpenSSL < 1.1.0 and LibreSSL < 2.7.0 */

#define TLS_method SSLv23_method

static int X509_NAME_ENTRY_set(const X509_NAME_ENTRY *ne)

{

return ne->set;

}

#ifndef OPENSSL_NO_COMP

static int COMP_get_type(const COMP_METHOD *meth)

{

return meth->type;

}

#endif

static pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx)

{

return ctx->default_passwd_callback;

}

static void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx)

{

return ctx->default_passwd_callback_userdata;

}

static int X509_OBJECT_get_type(X509_OBJECT *x)

{

return x->type;

}

static X509 *X509_OBJECT_get0_X509(X509_OBJECT *x)

{

return x->data.x509;

}

static STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *store) {

return store->objs;

}

static X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *store)

{

return store->param;

}

#endif /* OpenSSL < 1.1.0 or LibreSSL < 2.7.0 */

enum py_ssl_error {

/* these mirror ssl.h */

PY_SSL_ERROR_NONE,

PY_SSL_ERROR_SSL,

PY_SSL_ERROR_WANT_READ,

PY_SSL_ERROR_WANT_WRITE,

PY_SSL_ERROR_WANT_X509_LOOKUP,

PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */

PY_SSL_ERROR_ZERO_RETURN,

PY_SSL_ERROR_WANT_CONNECT,

/* start of non ssl.h errorcodes */

PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */

PY_SSL_ERROR_NO_SOCKET, /* socket has been GC'd */

PY_SSL_ERROR_INVALID_ERROR_CODE

};

enum py_ssl_server_or_client {

PY_SSL_CLIENT,

PY_SSL_SERVER

};

enum py_ssl_cert_requirements {

PY_SSL_CERT_NONE,

PY_SSL_CERT_OPTIONAL,

PY_SSL_CERT_REQUIRED

};

enum py_ssl_version {

PY_SSL_VERSION_SSL2,

PY_SSL_VERSION_SSL3=1,

PY_SSL_VERSION_TLS,

#if HAVE_TLSv1_2

PY_SSL_VERSION_TLS1,

PY_SSL_VERSION_TLS1_1,

PY_SSL_VERSION_TLS1_2

#else

PY_SSL_VERSION_TLS1

#endif

};

#ifdef WITH_THREAD

/* serves as a flag to see whether we've initialized the SSL thread support. */

/* 0 means no, greater than 0 means yes */

static unsigned int _ssl_locks_count = 0;

#endif /* def WITH_THREAD */

/* SSL socket object */

#define X509_NAME_MAXLEN 256

/* RAND_* APIs got added to OpenSSL in 0.9.5 */

#if OPENSSL_VERSION_NUMBER >= 0x0090500fL

# define HAVE_OPENSSL_RAND 1

#else

# undef HAVE_OPENSSL_RAND

#endif

/* SSL_CTX_clear_options() and SSL_clear_options() were first added in

* OpenSSL 0.9.8m but do not appear in some 0.9.9-dev versions such the

* 0.9.9 from "May 2008" that NetBSD 5.0 uses. */

#if OPENSSL_VERSION_NUMBER >= 0x009080dfL && OPENSSL_VERSION_NUMBER != 0x00909000L

# define HAVE_SSL_CTX_CLEAR_OPTIONS

#else

# undef HAVE_SSL_CTX_CLEAR_OPTIONS

#endif

/* In case of 'tls-unique' it will be 12 bytes for TLS, 36 bytes for

* older SSL, but let's be safe */

#define PySSL_CB_MAXLEN 128

/* SSL_get_finished got added to OpenSSL in 0.9.5 */

#if OPENSSL_VERSION_NUMBER >= 0x0090500fL

# define HAVE_OPENSSL_FINISHED 1

#else

# define HAVE_OPENSSL_FINISHED 0

#endif

/* ECDH support got added to OpenSSL in 0.9.8 */

#if OPENSSL_VERSION_NUMBER < 0x0090800fL && !defined(OPENSSL_NO_ECDH)

# define OPENSSL_NO_ECDH

#endif

/* compression support got added to OpenSSL in 0.9.8 */

#if OPENSSL_VERSION_NUMBER < 0x0090800fL && !defined(OPENSSL_NO_COMP)

# define OPENSSL_NO_COMP

#endif

/* X509_VERIFY_PARAM got added to OpenSSL in 0.9.8 */

#if OPENSSL_VERSION_NUMBER >= 0x0090800fL

# define HAVE_OPENSSL_VERIFY_PARAM

#endif

typedef struct {

PyObject_HEAD

SSL_CTX *ctx;

#if HAVE_NPN

unsigned char *npn_protocols;

int npn_protocols_len;

#endif

#if HAVE_ALPN

unsigned char *alpn_protocols;

int alpn_protocols_len;

#endif

#ifndef OPENSSL_NO_TLSEXT

PyObject *set_hostname;

#endif

int check_hostname;

} PySSLContext;

typedef struct {

PyObject_HEAD

PySocketSockObject *Socket;

PyObject *ssl_sock;

SSL *ssl;

PySSLContext *ctx; /* weakref to SSL context */

X509 *peer_cert;

char shutdown_seen_zero;

char handshake_done;

enum py_ssl_server_or_client socket_type;

} PySSLSocket;

static PyTypeObject PySSLContext_Type;

static PyTypeObject PySSLSocket_Type;

static PyObject *PySSL_SSLwrite(PySSLSocket *self, PyObject *args);

static PyObject *PySSL_SSLread(PySSLSocket *self, PyObject *args);

static int check_socket_and_wait_for_timeout(PySocketSockObject *s,

int writing);

static PyObject *PySSL_peercert(PySSLSocket *self, PyObject *args);

static PyObject *PySSL_cipher(PySSLSocket *self);

#define PySSLContext_Check(v) (Py_TYPE(v) == &PySSLContext_Type)

#define PySSLSocket_Check(v) (Py_TYPE(v) == &PySSLSocket_Type)

typedef enum {

SOCKET_IS_NONBLOCKING,

SOCKET_IS_BLOCKING,

SOCKET_HAS_TIMED_OUT,

SOCKET_HAS_BEEN_CLOSED,

SOCKET_TOO_LARGE_FOR_SELECT,

SOCKET_OPERATION_OK

} timeout_state;

/* Wrap error strings with filename and line # */

#define STRINGIFY1(x) #x

#define STRINGIFY2(x) STRINGIFY1(x)

#define ERRSTR1(x,y,z) (x ":" y ": " z)

#define ERRSTR(x) ERRSTR1("_ssl.c", STRINGIFY2(__LINE__), x)

/*

* SSL errors.

*/

PyDoc_STRVAR(SSLError_doc,

"An error occurred in the SSL implementation.");

PyDoc_STRVAR(SSLZeroReturnError_doc,

"SSL/TLS session closed cleanly.");

PyDoc_STRVAR(SSLWantReadError_doc,

"Non-blocking SSL socket needs to read more data\n"

"before the requested operation can be completed.");

PyDoc_STRVAR(SSLWantWriteError_doc,

"Non-blocking SSL socket needs to write more data\n"

"before the requested operation can be completed.");

PyDoc_STRVAR(SSLSyscallError_doc,

"System error when attempting SSL operation.");

PyDoc_STRVAR(SSLEOFError_doc,

"SSL/TLS connection terminated abruptly.");

static PyObject *

SSLError_str(PyEnvironmentErrorObject *self)

{

if (self->strerror != NULL) {

Py_INCREF(self->strerror);

return self->strerror;

}

else

return PyObject_Str(self->args);

}

static void

fill_and_set_sslerror(PyObject *type, int ssl_errno, const char *errstr,

int lineno, unsigned long errcode)

{

PyObject *err_value = NULL, *reason_obj = NULL, *lib_obj = NULL;

PyObject *init_value, *msg, *key;

if (errcode != 0) {

int lib, reason;

lib = ERR_GET_LIB(errcode);

reason = ERR_GET_REASON(errcode);

key = Py_BuildValue("ii", lib, reason);

if (key == NULL)

goto fail;

reason_obj = PyDict_GetItem(err_codes_to_names, key);

Py_DECREF(key);

if (reason_obj == NULL) {

/* XXX if reason < 100, it might reflect a library number (!!) */

PyErr_Clear();

}

key = PyLong_FromLong(lib);

if (key == NULL)

goto fail;

lib_obj = PyDict_GetItem(lib_codes_to_names, key);

Py_DECREF(key);

if (lib_obj == NULL) {

PyErr_Clear();

}

if (errstr == NULL)

errstr = ERR_reason_error_string(errcode);

}

if (errstr == NULL)

errstr = "unknown error";

if (reason_obj && lib_obj)

msg = PyUnicode_FromFormat("[%S: %S] %s (_ssl.c:%d)",

lib_obj, reason_obj, errstr, lineno);

else if (lib_obj)

msg = PyUnicode_FromFormat("[%S] %s (_ssl.c:%d)",

lib_obj, errstr, lineno);

else

msg = PyUnicode_FromFormat("%s (_ssl.c:%d)", errstr, lineno);

if (msg == NULL)

goto fail;

init_value = Py_BuildValue("iN", ssl_errno, msg);

if (init_value == NULL)

goto fail;

err_value = PyObject_CallObject(type, init_value);

Py_DECREF(init_value);

if (err_value == NULL)

goto fail;

if (reason_obj == NULL)

reason_obj = Py_None;

if (PyObject_SetAttrString(err_value, "reason", reason_obj))

goto fail;

if (lib_obj == NULL)

lib_obj = Py_None;

if (PyObject_SetAttrString(err_value, "library", lib_obj))

goto fail;

PyErr_SetObject(type, err_value);

fail:

Py_XDECREF(err_value);

}

static PyObject *

PySSL_SetError(PySSLSocket *obj, int ret, char *filename, int lineno)

{

PyObject *type = PySSLErrorObject;

char *errstr = NULL;

int err;

enum py_ssl_error p = PY_SSL_ERROR_NONE;

unsigned long e = 0;

assert(ret <= 0);

e = ERR_peek_last_error();

if (obj->ssl != NULL) {

err = SSL_get_error(obj->ssl, ret);

switch (err) {

case SSL_ERROR_ZERO_RETURN:

errstr = "TLS/SSL connection has been closed (EOF)";

type = PySSLZeroReturnErrorObject;

p = PY_SSL_ERROR_ZERO_RETURN;

break;

case SSL_ERROR_WANT_READ:

errstr = "The operation did not complete (read)";

type = PySSLWantReadErrorObject;

p = PY_SSL_ERROR_WANT_READ;

break;

case SSL_ERROR_WANT_WRITE:

p = PY_SSL_ERROR_WANT_WRITE;

type = PySSLWantWriteErrorObject;

errstr = "The operation did not complete (write)";

break;

case SSL_ERROR_WANT_X509_LOOKUP:

p = PY_SSL_ERROR_WANT_X509_LOOKUP;

errstr = "The operation did not complete (X509 lookup)";

break;

case SSL_ERROR_WANT_CONNECT:

p = PY_SSL_ERROR_WANT_CONNECT;

errstr = "The operation did not complete (connect)";

break;

case SSL_ERROR_SYSCALL:

{

if (e == 0) {

PySocketSockObject *s = obj->Socket;

if (ret == 0) {

p = PY_SSL_ERROR_EOF;

type = PySSLEOFErrorObject;

errstr = "EOF occurred in violation of protocol";

} else if (ret == -1) {

/* underlying BIO reported an I/O error */

Py_INCREF(s);

ERR_clear_error();

s->errorhandler();

Py_DECREF(s);

return NULL;

} else { /* possible? */

p = PY_SSL_ERROR_SYSCALL;

type = PySSLSyscallErrorObject;

errstr = "Some I/O error occurred";

}

} else {

p = PY_SSL_ERROR_SYSCALL;

}

break;

}

case SSL_ERROR_SSL:

{

p = PY_SSL_ERROR_SSL;

if (e == 0)

/* possible? */

errstr = "A failure in the SSL library occurred";

break;

}

default:

p = PY_SSL_ERROR_INVALID_ERROR_CODE;

errstr = "Invalid error code";

}

}

fill_and_set_sslerror(type, p, errstr, lineno, e);

ERR_clear_error();

return NULL;

}

static PyObject *

_setSSLError (char *errstr, int errcode, char *filename, int lineno) {

if (errstr == NULL)

errcode = ERR_peek_last_error();

else

errcode = 0;

fill_and_set_sslerror(PySSLErrorObject, errcode, errstr, lineno, errcode);

ERR_clear_error();

return NULL;

}

/*

* SSL objects

*/

static PySSLSocket *

newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,

enum py_ssl_server_or_client socket_type,

char *server_hostname, PyObject *ssl_sock)

{

PySSLSocket *self;

SSL_CTX *ctx = sslctx->ctx;

long mode;

self = PyObject_New(PySSLSocket, &PySSLSocket_Type);

if (self == NULL)

return NULL;

self->peer_cert = NULL;

self->ssl = NULL;

self->Socket = NULL;

self->ssl_sock = NULL;

self->ctx = sslctx;

self->shutdown_seen_zero = 0;

self->handshake_done = 0;

Py_INCREF(sslctx);

/* Make sure the SSL error state is initialized */

(void) ERR_get_state();

ERR_clear_error();

PySSL_BEGIN_ALLOW_THREADS

self->ssl = SSL_new(ctx);

PySSL_END_ALLOW_THREADS

SSL_set_app_data(self->ssl,self);

SSL_set_fd(self->ssl, Py_SAFE_DOWNCAST(sock->sock_fd, SOCKET_T, int));

mode = SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER;

#ifdef SSL_MODE_AUTO_RETRY

mode |= SSL_MODE_AUTO_RETRY;

#endif

SSL_set_mode(self->ssl, mode);

#if HAVE_SNI

if (server_hostname != NULL) {

/* Don't send SNI for IP addresses. We cannot simply use inet_aton() and

* inet_pton() here. inet_aton() may be linked weakly and inet_pton() isn't

* available on all platforms. Use OpenSSL's IP address parser. It's

* available since 1.0.2 and LibreSSL since at least 2.3.0. */

int send_sni = 1;

#if OPENSSL_VERSION_NUMBER >= 0x10200000L

ASN1_OCTET_STRING *ip = a2i_IPADDRESS(server_hostname);

if (ip == NULL) {

send_sni = 1;

ERR_clear_error();

} else {

send_sni = 0;

ASN1_OCTET_STRING_free(ip);

}

#elif defined(HAVE_INET_PTON)

#ifdef ENABLE_IPV6

#define PySSL_MAX(x, y) (((x) > (y)) ? (x) : (y))

char packed[PySSL_MAX(sizeof(struct in_addr), sizeof(struct in6_addr))];

#else

char packed[sizeof(struct in_addr)];

#endif /* ENABLE_IPV6 */

if (inet_pton(AF_INET, server_hostname, packed)) {

send_sni = 0;

#ifdef ENABLE_IPV6

} else if(inet_pton(AF_INET6, server_hostname, packed)) {

send_sni = 0;

#endif /* ENABLE_IPV6 */

} else {

send_sni = 1;

}

#endif /* HAVE_INET_PTON */

if (send_sni) {

SSL_set_tlsext_host_name(self->ssl, server_hostname);

}

}

#endif

/* If the socket is in non-blocking mode or timeout mode, set the BIO

* to non-blocking mode (blocking is the default)

*/

if (sock->sock_timeout >= 0.0) {

BIO_set_nbio(SSL_get_rbio(self->ssl), 1);

BIO_set_nbio(SSL_get_wbio(self->ssl), 1);

}

PySSL_BEGIN_ALLOW_THREADS

if (socket_type == PY_SSL_CLIENT)

SSL_set_connect_state(self->ssl);

else

SSL_set_accept_state(self->ssl);

PySSL_END_ALLOW_THREADS

self->socket_type = socket_type;

self->Socket = sock;

Py_INCREF(self->Socket);

if (ssl_sock != Py_None) {

self->ssl_sock = PyWeakref_NewRef(ssl_sock, NULL);

if (self->ssl_sock == NULL) {

Py_DECREF(self);

return NULL;

}

}

return self;

}

/* SSL object methods */

static PyObject *PySSL_SSLdo_handshake(PySSLSocket *self)

{

int ret;

int err;

int sockstate, nonblocking;

PySocketSockObject *sock = self->Socket;

Py_INCREF(sock);

/* just in case the blocking state of the socket has been changed */

nonblocking = (sock->sock_timeout >= 0.0);

BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);

BIO_set_nbio(SSL_get_wbio(self->ssl), nonblocking);

/* Actually negotiate SSL connection */

/* XXX If SSL_do_handshake() returns 0, it's also a failure. */

do {

PySSL_BEGIN_ALLOW_THREADS

ret = SSL_do_handshake(self->ssl);

err = SSL_get_error(self->ssl, ret);

PySSL_END_ALLOW_THREADS

if (PyErr_CheckSignals())

goto error;

if (err == SSL_ERROR_WANT_READ) {

sockstate = check_socket_and_wait_for_timeout(sock, 0);

} else if (err == SSL_ERROR_WANT_WRITE) {

sockstate = check_socket_and_wait_for_timeout(sock, 1);

} else {

sockstate = SOCKET_OPERATION_OK;

}

if (sockstate == SOCKET_HAS_TIMED_OUT) {

PyErr_SetString(PySSLErrorObject,

ERRSTR("The handshake operation timed out"));

goto error;

} else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {

PyErr_SetString(PySSLErrorObject,

ERRSTR("Underlying socket has been closed."));

goto error;

} else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {

PyErr_SetString(PySSLErrorObject,

ERRSTR("Underlying socket too large for select()."));

goto error;

} else if (sockstate == SOCKET_IS_NONBLOCKING) {

break;

}

} while (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE);

Py_DECREF(sock);

if (ret < 1)

return PySSL_SetError(self, ret, __FILE__, __LINE__);

if (self->peer_cert)

X509_free (self->peer_cert);

PySSL_BEGIN_ALLOW_THREADS

self->peer_cert = SSL_get_peer_certificate(self->ssl);

PySSL_END_ALLOW_THREADS

self->handshake_done = 1;

Py_INCREF(Py_None);

return Py_None;

error:

Py_DECREF(sock);

return NULL;

}

static PyObject *

_asn1obj2py(const ASN1_OBJECT *name, int no_name)

{

char buf[X509_NAME_MAXLEN];

char *namebuf = buf;

int buflen;

PyObject *name_obj = NULL;

buflen = OBJ_obj2txt(namebuf, X509_NAME_MAXLEN, name, no_name);

if (buflen < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

return NULL;

}

/* initial buffer is too small for oid + terminating null byte */

if (buflen > X509_NAME_MAXLEN - 1) {

/* make OBJ_obj2txt() calculate the required buflen */

buflen = OBJ_obj2txt(NULL, 0, name, no_name);

/* allocate len + 1 for terminating NULL byte */

namebuf = PyMem_Malloc(buflen + 1);

if (namebuf == NULL) {

PyErr_NoMemory();

return NULL;

}

buflen = OBJ_obj2txt(namebuf, buflen + 1, name, no_name);

if (buflen < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto done;

}

}

if (!buflen && no_name) {

Py_INCREF(Py_None);

name_obj = Py_None;

}

else {

name_obj = PyString_FromStringAndSize(namebuf, buflen);

}

done:

if (buf != namebuf) {

PyMem_Free(namebuf);

}

return name_obj;

}

static PyObject *

_create_tuple_for_attribute(ASN1_OBJECT *name, ASN1_STRING *value)

{

Py_ssize_t buflen;

unsigned char *valuebuf = NULL;

PyObject *attr, *value_obj;

buflen = ASN1_STRING_to_UTF8(&valuebuf, value);

if (buflen < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

return NULL;

}

value_obj = PyUnicode_DecodeUTF8((char *) valuebuf,

buflen, "strict");

attr = Py_BuildValue("NN", _asn1obj2py(name, 0), value_obj);

OPENSSL_free(valuebuf);

return attr;

}

static PyObject *

_create_tuple_for_X509_NAME (X509_NAME *xname)

{

PyObject *dn = NULL; /* tuple which represents the "distinguished name" */

PyObject *rdn = NULL; /* tuple to hold a "relative distinguished name" */

PyObject *rdnt;

PyObject *attr = NULL; /* tuple to hold an attribute */

int entry_count = X509_NAME_entry_count(xname);

X509_NAME_ENTRY *entry;

ASN1_OBJECT *name;

ASN1_STRING *value;

int index_counter;

int rdn_level = -1;

int retcode;

dn = PyList_New(0);

if (dn == NULL)

return NULL;

/* now create another tuple to hold the top-level RDN */

rdn = PyList_New(0);

if (rdn == NULL)

goto fail0;

for (index_counter = 0;

index_counter < entry_count;

index_counter++)

{

entry = X509_NAME_get_entry(xname, index_counter);

/* check to see if we've gotten to a new RDN */

if (rdn_level >= 0) {

if (rdn_level != X509_NAME_ENTRY_set(entry)) {

/* yes, new RDN */

/* add old RDN to DN */

rdnt = PyList_AsTuple(rdn);

Py_DECREF(rdn);

if (rdnt == NULL)

goto fail0;

retcode = PyList_Append(dn, rdnt);

Py_DECREF(rdnt);

if (retcode < 0)

goto fail0;

/* create new RDN */

rdn = PyList_New(0);

if (rdn == NULL)

goto fail0;

}

}

rdn_level = X509_NAME_ENTRY_set(entry);

/* now add this attribute to the current RDN */

name = X509_NAME_ENTRY_get_object(entry);

value = X509_NAME_ENTRY_get_data(entry);

attr = _create_tuple_for_attribute(name, value);

/*

fprintf(stderr, "RDN level %d, attribute %s: %s\n",

entry->set,

PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 0)),

PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 1)));

*/

if (attr == NULL)

goto fail1;

retcode = PyList_Append(rdn, attr);

Py_DECREF(attr);

if (retcode < 0)

goto fail1;

}

/* now, there's typically a dangling RDN */

if (rdn != NULL) {

if (PyList_GET_SIZE(rdn) > 0) {

rdnt = PyList_AsTuple(rdn);

Py_DECREF(rdn);

if (rdnt == NULL)

goto fail0;

retcode = PyList_Append(dn, rdnt);

Py_DECREF(rdnt);

if (retcode < 0)

goto fail0;

}

else {

Py_DECREF(rdn);

}

}

/* convert list to tuple */

rdnt = PyList_AsTuple(dn);

Py_DECREF(dn);

if (rdnt == NULL)

return NULL;

return rdnt;

fail1:

Py_XDECREF(rdn);

fail0:

Py_XDECREF(dn);

return NULL;

}

static PyObject *

_get_peer_alt_names (X509 *certificate) {

/* this code follows the procedure outlined in

OpenSSL's crypto/x509v3/v3_prn.c:X509v3_EXT_print()

function to extract the STACK_OF(GENERAL_NAME),

then iterates through the stack to add the

names. */

int i, j;

PyObject *peer_alt_names = Py_None;

PyObject *v = NULL, *t;

X509_EXTENSION *ext = NULL;

GENERAL_NAMES *names = NULL;

GENERAL_NAME *name;

const X509V3_EXT_METHOD *method;

BIO *biobuf = NULL;

char buf[2048];

char *vptr;

int len;

/* Issue #2973: ASN1_item_d2i() API changed in OpenSSL 0.9.6m */

#if OPENSSL_VERSION_NUMBER >= 0x009060dfL

const unsigned char *p;

#else

unsigned char *p;

#endif

if (certificate == NULL)

return peer_alt_names;

/* get a memory buffer */

biobuf = BIO_new(BIO_s_mem());

i = -1;

while ((i = X509_get_ext_by_NID(

certificate, NID_subject_alt_name, i)) >= 0) {

if (peer_alt_names == Py_None) {

peer_alt_names = PyList_New(0);

if (peer_alt_names == NULL)

goto fail;

}

/* now decode the altName */

ext = X509_get_ext(certificate, i);

if(!(method = X509V3_EXT_get(ext))) {

PyErr_SetString

(PySSLErrorObject,

ERRSTR("No method for internalizing subjectAltName!"));

goto fail;

}

p = X509_EXTENSION_get_data(ext)->data;

if (method->it)

names = (GENERAL_NAMES*)

(ASN1_item_d2i(NULL,

&p,

X509_EXTENSION_get_data(ext)->length,

ASN1_ITEM_ptr(method->it)));

else

names = (GENERAL_NAMES*)

(method->d2i(NULL,

&p,

X509_EXTENSION_get_data(ext)->length));

for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {

/* get a rendering of each name in the set of names */

int gntype;

ASN1_STRING *as = NULL;

name = sk_GENERAL_NAME_value(names, j);

gntype = name->type;

switch (gntype) {

case GEN_DIRNAME:

/* we special-case DirName as a tuple of

tuples of attributes */

t = PyTuple_New(2);

if (t == NULL) {

goto fail;

}

v = PyString_FromString("DirName");

if (v == NULL) {

Py_DECREF(t);

goto fail;

}

PyTuple_SET_ITEM(t, 0, v);

v = _create_tuple_for_X509_NAME (name->d.dirn);

if (v == NULL) {

Py_DECREF(t);

goto fail;

}