/* SSL socket module

SSL support based on patches by Brian E Gallew and Laszlo Kovacs.

Re-worked a bit by Bill Janssen to add server-side support and

certificate decoding. Chris Stawarz contributed some non-blocking

patches.

This module is imported by ssl.py. It should *not* be used

directly.

XXX should partial writes be enabled, SSL_MODE_ENABLE_PARTIAL_WRITE?

*/

#include "Python.h"

#ifdef WITH_THREAD

#include "pythread.h"

#define PySSL_BEGIN_ALLOW_THREADS { \

PyThreadState *_save = NULL; \

if (_ssl_locks_count>0) {_save = PyEval_SaveThread();}

#define PySSL_BLOCK_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save)};

#define PySSL_UNBLOCK_THREADS if (_ssl_locks_count>0){_save = PyEval_SaveThread()};

#define PySSL_END_ALLOW_THREADS if (_ssl_locks_count>0){PyEval_RestoreThread(_save);} \

}

#else /* no WITH_THREAD */

#define PySSL_BEGIN_ALLOW_THREADS

#define PySSL_BLOCK_THREADS

#define PySSL_UNBLOCK_THREADS

#define PySSL_END_ALLOW_THREADS

#endif

enum py_ssl_error {

/* these mirror ssl.h */

PY_SSL_ERROR_NONE,

PY_SSL_ERROR_SSL,

PY_SSL_ERROR_WANT_READ,

PY_SSL_ERROR_WANT_WRITE,

PY_SSL_ERROR_WANT_X509_LOOKUP,

PY_SSL_ERROR_SYSCALL, /* look at error stack/return value/errno */

PY_SSL_ERROR_ZERO_RETURN,

PY_SSL_ERROR_WANT_CONNECT,

/* start of non ssl.h errorcodes */

PY_SSL_ERROR_EOF, /* special case of SSL_ERROR_SYSCALL */

PY_SSL_ERROR_NO_SOCKET, /* socket has been GC'd */

PY_SSL_ERROR_INVALID_ERROR_CODE

};

enum py_ssl_server_or_client {

PY_SSL_CLIENT,

PY_SSL_SERVER

};

enum py_ssl_cert_requirements {

PY_SSL_CERT_NONE,

PY_SSL_CERT_OPTIONAL,

PY_SSL_CERT_REQUIRED

};

enum py_ssl_version {

PY_SSL_VERSION_SSL2,

PY_SSL_VERSION_SSL3,

PY_SSL_VERSION_SSL23,

PY_SSL_VERSION_TLS1,

};

/* Include symbols from _socket module */

#include "socketmodule.h"

static PySocketModule_APIObject PySocketModule;

#if defined(HAVE_POLL_H)

#include <poll.h>

#elif defined(HAVE_SYS_POLL_H)

#include <sys/poll.h>

#endif

/* Include OpenSSL header files */

#include "openssl/rsa.h"

#include "openssl/crypto.h"

#include "openssl/x509.h"

#include "openssl/x509v3.h"

#include "openssl/pem.h"

#include "openssl/ssl.h"

#include "openssl/err.h"

#include "openssl/rand.h"

/* SSL error object */

static PyObject *PySSLErrorObject;

#ifdef WITH_THREAD

/* serves as a flag to see whether we've initialized the SSL thread support. */

/* 0 means no, greater than 0 means yes */

static unsigned int _ssl_locks_count = 0;

#endif /* def WITH_THREAD */

/* SSL socket object */

#define X509_NAME_MAXLEN 256

/* RAND_* APIs got added to OpenSSL in 0.9.5 */

#if OPENSSL_VERSION_NUMBER >= 0x0090500fL

# define HAVE_OPENSSL_RAND 1

#else

# undef HAVE_OPENSSL_RAND

#endif

typedef struct {

PyObject_HEAD

PyObject *Socket; /* weakref to socket on which we're layered */

SSL_CTX* ctx;

SSL* ssl;

X509* peer_cert;

} PySSLObject;

static PyTypeObject PySSL_Type;

static PyObject *PySSL_SSLwrite(PySSLObject *self, PyObject *args);

static PyObject *PySSL_SSLread(PySSLObject *self, PyObject *args);

static int check_socket_and_wait_for_timeout(PySocketSockObject *s,

int writing);

static PyObject *PySSL_peercert(PySSLObject *self, PyObject *args);

static PyObject *PySSL_cipher(PySSLObject *self);

#define PySSLObject_Check(v) (Py_TYPE(v) == &PySSL_Type)

typedef enum {

SOCKET_IS_NONBLOCKING,

SOCKET_IS_BLOCKING,

SOCKET_HAS_TIMED_OUT,

SOCKET_HAS_BEEN_CLOSED,

SOCKET_TOO_LARGE_FOR_SELECT,

SOCKET_OPERATION_OK

} timeout_state;

/* Wrap error strings with filename and line # */

#define STRINGIFY1(x) #x

#define STRINGIFY2(x) STRINGIFY1(x)

#define ERRSTR1(x,y,z) (x ":" y ": " z)

#define ERRSTR(x) ERRSTR1("_ssl.c", STRINGIFY2(__LINE__), x)

/* XXX It might be helpful to augment the error message generated

below with the name of the SSL function that generated the error.

I expect it's obvious most of the time.

*/

static PyObject *

PySSL_SetError(PySSLObject *obj, int ret, char *filename, int lineno)

{

PyObject *v;

char buf[2048];

char *errstr;

int err;

enum py_ssl_error p = PY_SSL_ERROR_NONE;

assert(ret <= 0);

if (obj->ssl != NULL) {

err = SSL_get_error(obj->ssl, ret);

switch (err) {

case SSL_ERROR_ZERO_RETURN:

errstr = "TLS/SSL connection has been closed";

p = PY_SSL_ERROR_ZERO_RETURN;

break;

case SSL_ERROR_WANT_READ:

errstr = "The operation did not complete (read)";

p = PY_SSL_ERROR_WANT_READ;

break;

case SSL_ERROR_WANT_WRITE:

p = PY_SSL_ERROR_WANT_WRITE;

errstr = "The operation did not complete (write)";

break;

case SSL_ERROR_WANT_X509_LOOKUP:

p = PY_SSL_ERROR_WANT_X509_LOOKUP;

errstr =

"The operation did not complete (X509 lookup)";

break;

case SSL_ERROR_WANT_CONNECT:

p = PY_SSL_ERROR_WANT_CONNECT;

errstr = "The operation did not complete (connect)";

break;

case SSL_ERROR_SYSCALL:

{

unsigned long e = ERR_get_error();

if (e == 0) {

PySocketSockObject *s

= (PySocketSockObject *) PyWeakref_GetObject(obj->Socket);

if (ret == 0 || (((PyObject *)s) == Py_None)) {

p = PY_SSL_ERROR_EOF;

errstr =

"EOF occurred in violation of protocol";

} else if (ret == -1) {

/* underlying BIO reported an I/O error */

return s->errorhandler();

} else { /* possible? */

p = PY_SSL_ERROR_SYSCALL;

errstr = "Some I/O error occurred";

}

} else {

p = PY_SSL_ERROR_SYSCALL;

/* XXX Protected by global interpreter lock */

errstr = ERR_error_string(e, NULL);

}

break;

}

case SSL_ERROR_SSL:

{

unsigned long e = ERR_get_error();

p = PY_SSL_ERROR_SSL;

if (e != 0)

/* XXX Protected by global interpreter lock */

errstr = ERR_error_string(e, NULL);

else { /* possible? */

errstr =

"A failure in the SSL library occurred";

}

break;

}

default:

p = PY_SSL_ERROR_INVALID_ERROR_CODE;

errstr = "Invalid error code";

}

} else {

errstr = ERR_error_string(ERR_peek_last_error(), NULL);

}

PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);

v = Py_BuildValue("(is)", p, buf);

if (v != NULL) {

PyErr_SetObject(PySSLErrorObject, v);

Py_DECREF(v);

}

return NULL;

}

static PyObject *

_setSSLError (char *errstr, int errcode, char *filename, int lineno) {

char buf[2048];

PyObject *v;

if (errstr == NULL) {

errcode = ERR_peek_last_error();

errstr = ERR_error_string(errcode, NULL);

}

PyOS_snprintf(buf, sizeof(buf), "_ssl.c:%d: %s", lineno, errstr);

v = Py_BuildValue("(is)", errcode, buf);

if (v != NULL) {

PyErr_SetObject(PySSLErrorObject, v);

Py_DECREF(v);

}

return NULL;

}

static PySSLObject *

newPySSLObject(PySocketSockObject *Sock, char *key_file, char *cert_file,

enum py_ssl_server_or_client socket_type,

enum py_ssl_cert_requirements certreq,

enum py_ssl_version proto_version,

char *cacerts_file)

{

PySSLObject *self;

char *errstr = NULL;

int ret;

int verification_mode;

self = PyObject_New(PySSLObject, &PySSL_Type); /* Create new object */

if (self == NULL)

return NULL;

self->peer_cert = NULL;

self->ssl = NULL;

self->ctx = NULL;

self->Socket = NULL;

/* Make sure the SSL error state is initialized */

(void) ERR_get_state();

ERR_clear_error();

if ((key_file && !cert_file) || (!key_file && cert_file)) {

errstr = ERRSTR("Both the key & certificate files "

"must be specified");

goto fail;

}

if ((socket_type == PY_SSL_SERVER) &&

((key_file == NULL) || (cert_file == NULL))) {

errstr = ERRSTR("Both the key & certificate files "

"must be specified for server-side operation");

goto fail;

}

PySSL_BEGIN_ALLOW_THREADS

if (proto_version == PY_SSL_VERSION_TLS1)

self->ctx = SSL_CTX_new(TLSv1_method()); /* Set up context */

else if (proto_version == PY_SSL_VERSION_SSL3)

self->ctx = SSL_CTX_new(SSLv3_method()); /* Set up context */

else if (proto_version == PY_SSL_VERSION_SSL2)

self->ctx = SSL_CTX_new(SSLv2_method()); /* Set up context */

else if (proto_version == PY_SSL_VERSION_SSL23)

self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */

PySSL_END_ALLOW_THREADS

if (self->ctx == NULL) {

errstr = ERRSTR("Invalid SSL protocol variant specified.");

goto fail;

}

if (certreq != PY_SSL_CERT_NONE) {

if (cacerts_file == NULL) {

errstr = ERRSTR("No root certificates specified for "

"verification of other-side certificates.");

goto fail;

} else {

PySSL_BEGIN_ALLOW_THREADS

ret = SSL_CTX_load_verify_locations(self->ctx,

cacerts_file,

NULL);

PySSL_END_ALLOW_THREADS

if (ret != 1) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto fail;

}

}

}

if (key_file) {

PySSL_BEGIN_ALLOW_THREADS

ret = SSL_CTX_use_PrivateKey_file(self->ctx, key_file,

SSL_FILETYPE_PEM);

PySSL_END_ALLOW_THREADS

if (ret != 1) {

_setSSLError(NULL, ret, __FILE__, __LINE__);

goto fail;

}

PySSL_BEGIN_ALLOW_THREADS

ret = SSL_CTX_use_certificate_chain_file(self->ctx,

cert_file);

PySSL_END_ALLOW_THREADS

if (ret != 1) {

/*

fprintf(stderr, "ret is %d, errcode is %lu, %lu, with file \"%s\"\n",

ret, ERR_peek_error(), ERR_peek_last_error(), cert_file);

*/

if (ERR_peek_last_error() != 0) {

_setSSLError(NULL, ret, __FILE__, __LINE__);

goto fail;

}

}

}

/* ssl compatibility */

SSL_CTX_set_options(self->ctx, SSL_OP_ALL);

verification_mode = SSL_VERIFY_NONE;

if (certreq == PY_SSL_CERT_OPTIONAL)

verification_mode = SSL_VERIFY_PEER;

else if (certreq == PY_SSL_CERT_REQUIRED)

verification_mode = (SSL_VERIFY_PEER |

SSL_VERIFY_FAIL_IF_NO_PEER_CERT);

SSL_CTX_set_verify(self->ctx, verification_mode,

NULL); /* set verify lvl */

PySSL_BEGIN_ALLOW_THREADS

self->ssl = SSL_new(self->ctx); /* New ssl struct */

PySSL_END_ALLOW_THREADS

SSL_set_fd(self->ssl, Sock->sock_fd); /* Set the socket for SSL */

SSL_set_mode(self->ssl, SSL_MODE_AUTO_RETRY);

/* If the socket is in non-blocking mode or timeout mode, set the BIO

* to non-blocking mode (blocking is the default)

*/

if (Sock->sock_timeout >= 0.0) {

/* Set both the read and write BIO's to non-blocking mode */

BIO_set_nbio(SSL_get_rbio(self->ssl), 1);

BIO_set_nbio(SSL_get_wbio(self->ssl), 1);

}

PySSL_BEGIN_ALLOW_THREADS

if (socket_type == PY_SSL_CLIENT)

SSL_set_connect_state(self->ssl);

else

SSL_set_accept_state(self->ssl);

PySSL_END_ALLOW_THREADS

self->Socket = PyWeakref_NewRef((PyObject *) Sock, Py_None);

return self;

fail:

if (errstr)

PyErr_SetString(PySSLErrorObject, errstr);

Py_DECREF(self);

return NULL;

}

static PyObject *

PySSL_sslwrap(PyObject *self, PyObject *args)

{

PySocketSockObject *Sock;

int server_side = 0;

int verification_mode = PY_SSL_CERT_NONE;

int protocol = PY_SSL_VERSION_SSL23;

char *key_file = NULL;

char *cert_file = NULL;

char *cacerts_file = NULL;

if (!PyArg_ParseTuple(args, "O!i|zziiz:sslwrap",

PySocketModule.Sock_Type,

&Sock,

&server_side,

&key_file, &cert_file,

&verification_mode, &protocol,

&cacerts_file))

return NULL;

/*

fprintf(stderr,

"server_side is %d, keyfile %p, certfile %p, verify_mode %d, "

"protocol %d, certs %p\n",

server_side, key_file, cert_file, verification_mode,

protocol, cacerts_file);

*/

return (PyObject *) newPySSLObject(Sock, key_file, cert_file,

server_side, verification_mode,

protocol, cacerts_file);

}

PyDoc_STRVAR(ssl_doc,

"sslwrap(socket, server_side, [keyfile, certfile, certs_mode, protocol,\n"

" cacertsfile]) -> sslobject");

/* SSL object methods */

static PyObject *PySSL_SSLdo_handshake(PySSLObject *self)

{

int ret;

int err;

int sockstate;

/* Actually negotiate SSL connection */

/* XXX If SSL_do_handshake() returns 0, it's also a failure. */

sockstate = 0;

do {

PySocketSockObject *sock

= (PySocketSockObject *) PyWeakref_GetObject(self->Socket);

if (((PyObject*)sock) == Py_None) {

_setSSLError("Underlying socket connection gone",

PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__);

return NULL;

}

PySSL_BEGIN_ALLOW_THREADS

ret = SSL_do_handshake(self->ssl);

err = SSL_get_error(self->ssl, ret);

PySSL_END_ALLOW_THREADS

if(PyErr_CheckSignals()) {

return NULL;

}

if (err == SSL_ERROR_WANT_READ) {

sockstate = check_socket_and_wait_for_timeout(sock, 0);

} else if (err == SSL_ERROR_WANT_WRITE) {

sockstate = check_socket_and_wait_for_timeout(sock, 1);

} else {

sockstate = SOCKET_OPERATION_OK;

}

if (sockstate == SOCKET_HAS_TIMED_OUT) {

PyErr_SetString(PySSLErrorObject,

ERRSTR("The handshake operation timed out"));

return NULL;

} else if (sockstate == SOCKET_HAS_BEEN_CLOSED) {

PyErr_SetString(PySSLErrorObject,

ERRSTR("Underlying socket has been closed."));

return NULL;

} else if (sockstate == SOCKET_TOO_LARGE_FOR_SELECT) {

PyErr_SetString(PySSLErrorObject,

ERRSTR("Underlying socket too large for select()."));

return NULL;

} else if (sockstate == SOCKET_IS_NONBLOCKING) {

break;

}

} while (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE);

if (ret < 1)

return PySSL_SetError(self, ret, __FILE__, __LINE__);

self->ssl->debug = 1;

if (self->peer_cert)

X509_free (self->peer_cert);

PySSL_BEGIN_ALLOW_THREADS

self->peer_cert = SSL_get_peer_certificate(self->ssl);

PySSL_END_ALLOW_THREADS

Py_INCREF(Py_None);

return Py_None;

}

static PyObject *

_create_tuple_for_attribute (ASN1_OBJECT *name, ASN1_STRING *value) {

char namebuf[X509_NAME_MAXLEN];

int buflen;

PyObject *name_obj;

PyObject *value_obj;

PyObject *attr;

unsigned char *valuebuf = NULL;

buflen = OBJ_obj2txt(namebuf, sizeof(namebuf), name, 0);

if (buflen < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto fail;

}

name_obj = PyUnicode_FromStringAndSize(namebuf, buflen);

if (name_obj == NULL)

goto fail;

buflen = ASN1_STRING_to_UTF8(&valuebuf, value);

if (buflen < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

Py_DECREF(name_obj);

goto fail;

}

value_obj = PyUnicode_DecodeUTF8((char *) valuebuf,

buflen, "strict");

OPENSSL_free(valuebuf);

if (value_obj == NULL) {

Py_DECREF(name_obj);

goto fail;

}

attr = PyTuple_New(2);

if (attr == NULL) {

Py_DECREF(name_obj);

Py_DECREF(value_obj);

goto fail;

}

PyTuple_SET_ITEM(attr, 0, name_obj);

PyTuple_SET_ITEM(attr, 1, value_obj);

return attr;

fail:

return NULL;

}

static PyObject *

_create_tuple_for_X509_NAME (X509_NAME *xname)

{

PyObject *dn = NULL; /* tuple which represents the "distinguished name" */

PyObject *rdn = NULL; /* tuple to hold a "relative distinguished name" */

PyObject *rdnt;

PyObject *attr = NULL; /* tuple to hold an attribute */

int entry_count = X509_NAME_entry_count(xname);

X509_NAME_ENTRY *entry;

ASN1_OBJECT *name;

ASN1_STRING *value;

int index_counter;

int rdn_level = -1;

int retcode;

dn = PyList_New(0);

if (dn == NULL)

return NULL;

/* now create another tuple to hold the top-level RDN */

rdn = PyList_New(0);

if (rdn == NULL)

goto fail0;

for (index_counter = 0;

index_counter < entry_count;

index_counter++)

{

entry = X509_NAME_get_entry(xname, index_counter);

/* check to see if we've gotten to a new RDN */

if (rdn_level >= 0) {

if (rdn_level != entry->set) {

/* yes, new RDN */

/* add old RDN to DN */

rdnt = PyList_AsTuple(rdn);

Py_DECREF(rdn);

if (rdnt == NULL)

goto fail0;

retcode = PyList_Append(dn, rdnt);

Py_DECREF(rdnt);

if (retcode < 0)

goto fail0;

/* create new RDN */

rdn = PyList_New(0);

if (rdn == NULL)

goto fail0;

}

}

rdn_level = entry->set;

/* now add this attribute to the current RDN */

name = X509_NAME_ENTRY_get_object(entry);

value = X509_NAME_ENTRY_get_data(entry);

attr = _create_tuple_for_attribute(name, value);

/*

fprintf(stderr, "RDN level %d, attribute %s: %s\n",

entry->set,

PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 0)),

PyBytes_AS_STRING(PyTuple_GET_ITEM(attr, 1)));

*/

if (attr == NULL)

goto fail1;

retcode = PyList_Append(rdn, attr);

Py_DECREF(attr);

if (retcode < 0)

goto fail1;

}

/* now, there's typically a dangling RDN */

if ((rdn != NULL) && (PyList_Size(rdn) > 0)) {

rdnt = PyList_AsTuple(rdn);

Py_DECREF(rdn);

if (rdnt == NULL)

goto fail0;

retcode = PyList_Append(dn, rdnt);

Py_DECREF(rdnt);

if (retcode < 0)

goto fail0;

}

/* convert list to tuple */

rdnt = PyList_AsTuple(dn);

Py_DECREF(dn);

if (rdnt == NULL)

return NULL;

return rdnt;

fail1:

Py_XDECREF(rdn);

fail0:

Py_XDECREF(dn);

return NULL;

}

static PyObject *

_get_peer_alt_names (X509 *certificate) {

/* this code follows the procedure outlined in

OpenSSL's crypto/x509v3/v3_prn.c:X509v3_EXT_print()

function to extract the STACK_OF(GENERAL_NAME),

then iterates through the stack to add the

names. */

int i, j;

PyObject *peer_alt_names = Py_None;

PyObject *v, *t;

X509_EXTENSION *ext = NULL;

GENERAL_NAMES *names = NULL;

GENERAL_NAME *name;

X509V3_EXT_METHOD *method;

BIO *biobuf = NULL;

char buf[2048];

char *vptr;

int len;

/* Issue #2973: ASN1_item_d2i() API changed in OpenSSL 0.9.6m */

#if OPENSSL_VERSION_NUMBER >= 0x009060dfL

const unsigned char *p;

#else

unsigned char *p;

#endif

if (certificate == NULL)

return peer_alt_names;

/* get a memory buffer */

biobuf = BIO_new(BIO_s_mem());

i = 0;

while ((i = X509_get_ext_by_NID(

certificate, NID_subject_alt_name, i)) >= 0) {

if (peer_alt_names == Py_None) {

peer_alt_names = PyList_New(0);

if (peer_alt_names == NULL)

goto fail;

}

/* now decode the altName */

ext = X509_get_ext(certificate, i);

if(!(method = X509V3_EXT_get(ext))) {

PyErr_SetString

(PySSLErrorObject,

ERRSTR("No method for internalizing subjectAltName!"));

goto fail;

}

p = ext->value->data;

if (method->it)

names = (GENERAL_NAMES*)

(ASN1_item_d2i(NULL,

&p,

ext->value->length,

ASN1_ITEM_ptr(method->it)));

else

names = (GENERAL_NAMES*)

(method->d2i(NULL,

&p,

ext->value->length));

for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {

/* get a rendering of each name in the set of names */

name = sk_GENERAL_NAME_value(names, j);

if (name->type == GEN_DIRNAME) {

/* we special-case DirName as a tuple of

tuples of attributes */

t = PyTuple_New(2);

if (t == NULL) {

goto fail;

}

v = PyUnicode_FromString("DirName");

if (v == NULL) {

Py_DECREF(t);

goto fail;

}

PyTuple_SET_ITEM(t, 0, v);

v = _create_tuple_for_X509_NAME (name->d.dirn);

if (v == NULL) {

Py_DECREF(t);

goto fail;

}

PyTuple_SET_ITEM(t, 1, v);

} else {

/* for everything else, we use the OpenSSL print form */

(void) BIO_reset(biobuf);

GENERAL_NAME_print(biobuf, name);

len = BIO_gets(biobuf, buf, sizeof(buf)-1);

if (len < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto fail;

}

vptr = strchr(buf, ':');

if (vptr == NULL)

goto fail;

t = PyTuple_New(2);

if (t == NULL)

goto fail;

v = PyUnicode_FromStringAndSize(buf, (vptr - buf));

if (v == NULL) {

Py_DECREF(t);

goto fail;

}

PyTuple_SET_ITEM(t, 0, v);

v = PyUnicode_FromStringAndSize((vptr + 1),

(len - (vptr - buf + 1)));

if (v == NULL) {

Py_DECREF(t);

goto fail;

}

PyTuple_SET_ITEM(t, 1, v);

}

/* and add that rendering to the list */

if (PyList_Append(peer_alt_names, t) < 0) {

Py_DECREF(t);

goto fail;

}

Py_DECREF(t);

}

}

BIO_free(biobuf);

if (peer_alt_names != Py_None) {

v = PyList_AsTuple(peer_alt_names);

Py_DECREF(peer_alt_names);

return v;

} else {

return peer_alt_names;

}

fail:

if (biobuf != NULL)

BIO_free(biobuf);

if (peer_alt_names != Py_None) {

Py_XDECREF(peer_alt_names);

}

return NULL;

}

static PyObject *

_decode_certificate (X509 *certificate, int verbose) {

PyObject *retval = NULL;

BIO *biobuf = NULL;

PyObject *peer;

PyObject *peer_alt_names = NULL;

PyObject *issuer;

PyObject *version;

PyObject *sn_obj;

ASN1_INTEGER *serialNumber;

char buf[2048];

int len;

ASN1_TIME *notBefore, *notAfter;

PyObject *pnotBefore, *pnotAfter;

retval = PyDict_New();

if (retval == NULL)

return NULL;

peer = _create_tuple_for_X509_NAME(

X509_get_subject_name(certificate));

if (peer == NULL)

goto fail0;

if (PyDict_SetItemString(retval, (const char *) "subject", peer) < 0) {

Py_DECREF(peer);

goto fail0;

}

Py_DECREF(peer);

if (verbose) {

issuer = _create_tuple_for_X509_NAME(

X509_get_issuer_name(certificate));

if (issuer == NULL)

goto fail0;

if (PyDict_SetItemString(retval, (const char *)"issuer", issuer) < 0) {

Py_DECREF(issuer);

goto fail0;

}

Py_DECREF(issuer);

version = PyLong_FromLong(X509_get_version(certificate) + 1);

if (PyDict_SetItemString(retval, "version", version) < 0) {

Py_DECREF(version);

goto fail0;

}

Py_DECREF(version);

}

/* get a memory buffer */

biobuf = BIO_new(BIO_s_mem());

if (verbose) {

(void) BIO_reset(biobuf);

serialNumber = X509_get_serialNumber(certificate);

/* should not exceed 20 octets, 160 bits, so buf is big enough */

i2a_ASN1_INTEGER(biobuf, serialNumber);

len = BIO_gets(biobuf, buf, sizeof(buf)-1);

if (len < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto fail1;

}

sn_obj = PyUnicode_FromStringAndSize(buf, len);

if (sn_obj == NULL)

goto fail1;

if (PyDict_SetItemString(retval, "serialNumber", sn_obj) < 0) {

Py_DECREF(sn_obj);

goto fail1;

}

Py_DECREF(sn_obj);

(void) BIO_reset(biobuf);

notBefore = X509_get_notBefore(certificate);

ASN1_TIME_print(biobuf, notBefore);

len = BIO_gets(biobuf, buf, sizeof(buf)-1);

if (len < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto fail1;

}

pnotBefore = PyUnicode_FromStringAndSize(buf, len);

if (pnotBefore == NULL)

goto fail1;

if (PyDict_SetItemString(retval, "notBefore", pnotBefore) < 0) {

Py_DECREF(pnotBefore);

goto fail1;

}

Py_DECREF(pnotBefore);

}

(void) BIO_reset(biobuf);

notAfter = X509_get_notAfter(certificate);

ASN1_TIME_print(biobuf, notAfter);

len = BIO_gets(biobuf, buf, sizeof(buf)-1);

if (len < 0) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto fail1;

}

pnotAfter = PyUnicode_FromStringAndSize(buf, len);

if (pnotAfter == NULL)

goto fail1;

if (PyDict_SetItemString(retval, "notAfter", pnotAfter) < 0) {

Py_DECREF(pnotAfter);

goto fail1;

}

Py_DECREF(pnotAfter);

/* Now look for subjectAltName */

peer_alt_names = _get_peer_alt_names(certificate);

if (peer_alt_names == NULL)

goto fail1;

else if (peer_alt_names != Py_None) {

if (PyDict_SetItemString(retval, "subjectAltName",

peer_alt_names) < 0) {

Py_DECREF(peer_alt_names);

goto fail1;

}

Py_DECREF(peer_alt_names);

}

BIO_free(biobuf);

return retval;

fail1:

if (biobuf != NULL)

BIO_free(biobuf);

fail0:

Py_XDECREF(retval);

return NULL;

}

static PyObject *

PySSL_test_decode_certificate (PyObject *mod, PyObject *args) {

PyObject *retval = NULL;

char *filename = NULL;

X509 *x=NULL;

BIO *cert;

int verbose = 1;

if (!PyArg_ParseTuple(args, "s|i:test_decode_certificate",

&filename, &verbose))

return NULL;

if ((cert=BIO_new(BIO_s_file())) == NULL) {

PyErr_SetString(PySSLErrorObject,

"Can't malloc memory to read file");

goto fail0;

}

if (BIO_read_filename(cert,filename) <= 0) {

PyErr_SetString(PySSLErrorObject,

"Can't open file");

goto fail0;

}

x = PEM_read_bio_X509_AUX(cert,NULL, NULL, NULL);

if (x == NULL) {

PyErr_SetString(PySSLErrorObject,

"Error decoding PEM-encoded file");

goto fail0;

}

retval = _decode_certificate(x, verbose);

fail0:

if (cert != NULL) BIO_free(cert);

return retval;

}

static PyObject *

PySSL_peercert(PySSLObject *self, PyObject *args)

{

PyObject *retval = NULL;

int len;

int verification;

PyObject *binary_mode = Py_None;

if (!PyArg_ParseTuple(args, "|O:peer_certificate", &binary_mode))

return NULL;

if (!self->peer_cert)

Py_RETURN_NONE;

if (PyObject_IsTrue(binary_mode)) {

/* return cert in DER-encoded format */

unsigned char *bytes_buf = NULL;

bytes_buf = NULL;

len = i2d_X509(self->peer_cert, &bytes_buf);

if (len < 0) {

PySSL_SetError(self, len, __FILE__, __LINE__);

return NULL;

}

/* this is actually an immutable bytes sequence */

retval = PyBytes_FromStringAndSize

((const char *) bytes_buf, len);

OPENSSL_free(bytes_buf);

return retval;