209 lines
9.0 KiB
Plaintext
209 lines
9.0 KiB
Plaintext
from openssl.types import *
|
|
|
|
# ============================================================
|
|
# openssl/ssl.vp — SSL/TLS connection layer (handshake + SocketIO + certificate verification)
|
|
# Corresponding header: ssl.h
|
|
#
|
|
# Typical client flow:
|
|
# OPENSSL_init_ssl(...)
|
|
# ctx = SSL_CTX_new(TLS_client_method())
|
|
# SSL_CTX_set_verify(ctx, SslVerifyPeer, 0) # verify peer
|
|
# SSL_CTX_load_verify_locations(ctx, cafile, None)
|
|
# ssl = SSL_new(ctx)
|
|
# SSL_set_fd(ssl, fd) # underlying TCP socket already connected
|
|
# SSL_connect(ssl) # handshake
|
|
# SSL_write/SSL_read
|
|
# ============================================================
|
|
|
|
# ---- Certificate file format (type arg of SSL_CTX_use_*_file / use_certificate_file) ----
|
|
define X509FiletypePem = 1
|
|
define X509FiletypeAsn1 = 2
|
|
# SSL_FILETYPE_* shares the same value as X509_FILETYPE_*
|
|
define SslFiletypePem = 1
|
|
define SslFiletypeAsn1 = 2
|
|
|
|
# ---- Verify modes (SSL_CTX_set_verify mode) ----
|
|
define SslVerifyNone = 0x00
|
|
define SslVerifyPeer = 0x01
|
|
define SslVerifyFailIfNoPeerCert = 0x02
|
|
define SslVerifyClientOnce = 0x04
|
|
|
|
# ---- Protocol versions (arg of SSL_CTRL_SET_MIN/MAX_PROTO_VERSION) ----
|
|
define Tls1Version = 0x0301
|
|
define Tls1_1Version = 0x0302
|
|
define Tls1_2Version = 0x0303
|
|
define Tls1_3Version = 0x0304
|
|
|
|
# ---- ctrl commands ----
|
|
define SslCtrlSetTlsextHostname = 55# SSL_ctrl(ssl, ..., TLSEXT_NAMETYPE_host_name, (void*)name)
|
|
define SslCtrlSetMinProtoVersion = 123
|
|
define SslCtrlSetMaxProtoVersion = 124
|
|
define SslCtrlMode = 33
|
|
define SslCtrlClearMode = 34
|
|
define TlsextNametypeHostName = 0
|
|
|
|
# ---- shutdown states ----
|
|
define SslSentShutdown = 1
|
|
define SslReceivedShutdown = 2
|
|
|
|
# ---- SSL_get_error return codes ----
|
|
define SslErrorNone = 0
|
|
define SslErrorSsl = 1
|
|
define SslErrorWantRead = 2
|
|
define SslErrorWantWrite = 3
|
|
define SslErrorWantX509Lookup = 4
|
|
define SslErrorSyscall = 5
|
|
define SslErrorZeroReturn = 6
|
|
define SslErrorWantConnect = 7
|
|
define SslErrorWantAccept = 8
|
|
define SslErrorWantAsync = 9
|
|
define SslErrorWantAsyncJob = 10
|
|
define SslErrorWantClientHelloCb = 11
|
|
define SslErrorWantRetryVerify = 12
|
|
|
|
# ---- SSL_OP_* options ----
|
|
# SSL_CTX_set_options(ctx, uint64_t)
|
|
define SslOpNoSslv2 = 0x01000000
|
|
define SslOpNoSslv3 = 0x02000000
|
|
define SslOpNoTlsv1 = 0x04000000
|
|
define SslOpNoTlsv1_2 = 0x08000000
|
|
define SslOpNoTlsv1_1 = 0x10000000
|
|
define SslOpNoTlsv1_3 = 0x20000000
|
|
define SslOpAll = 0x00000fff
|
|
|
|
# ============================================================
|
|
# Init / methods
|
|
# ============================================================
|
|
# (see crypto.vp for OPENSSL_init_ssl)
|
|
# const SSL_METHOD *TLS_method(void) / *_client_method / *_server_method
|
|
extern def TLS_method() -> SslMethodPtr
|
|
extern def TLS_client_method() -> SslMethodPtr
|
|
extern def TLS_server_method() -> SslMethodPtr
|
|
|
|
# ============================================================
|
|
# SSL_CTX
|
|
# ============================================================
|
|
# SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
|
|
extern def SSL_CTX_new(meth: SslMethodPtr) -> SslCtxPtr
|
|
# void SSL_CTX_free(SSL_CTX *ctx)
|
|
extern def SSL_CTX_free(ctx: SslCtxPtr)
|
|
# int SSL_CTX_up_ref(SSL_CTX *ctx)
|
|
extern def SSL_CTX_up_ref(ctx: SslCtxPtr) -> int
|
|
# Certificate / private key
|
|
# int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
|
|
extern def SSL_CTX_use_certificate_file(ctx: SslCtxPtr, file: str, type: int) -> int
|
|
# int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
|
|
extern def SSL_CTX_use_PrivateKey_file(ctx: SslCtxPtr, file: str, type: int) -> int
|
|
# int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
|
|
extern def SSL_CTX_use_certificate_chain_file(ctx: SslCtxPtr, file: str) -> int
|
|
# int SSL_CTX_check_private_key(const SSL_CTX *ctx)
|
|
extern def SSL_CTX_check_private_key(ctx: SslCtxPtr) -> int
|
|
# Verify config
|
|
# void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, SSL_verify_cb callback)
|
|
extern def SSL_CTX_set_verify(ctx: SslCtxPtr, mode: int, callback: bytes)
|
|
# void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth)
|
|
extern def SSL_CTX_set_verify_depth(ctx: SslCtxPtr, depth: int)
|
|
# int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, const char *CApath)
|
|
extern def SSL_CTX_load_verify_locations(ctx: SslCtxPtr, CAfile: str, CApath: str) -> int
|
|
# int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
|
|
extern def SSL_CTX_set_default_verify_paths(ctx: SslCtxPtr) -> int
|
|
# int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
|
|
extern def SSL_CTX_set_cipher_list(ctx: SslCtxPtr, cipher_list: str) -> int
|
|
# int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str) (TLS1.3)
|
|
extern def SSL_CTX_set_ciphersuites(ctx: SslCtxPtr, suites: str) -> int
|
|
# int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, unsigned int protos_len)
|
|
extern def SSL_CTX_set_alpn_protos(ctx: SslCtxPtr, protos: bytes, protos_len: uint32) -> int
|
|
# uint64_t SSL_CTX_set_options(SSL_CTX *ctx, uint64_t op)
|
|
extern def SSL_CTX_set_options(ctx: SslCtxPtr, op: uint64) -> uint64
|
|
# long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
|
|
extern def SSL_CTX_ctrl(ctx: SslCtxPtr, cmd: int, larg: int32, parg: bytes) -> int32
|
|
# long SSL_CTX_set_timeout(SSL_CTX *ctx, long t)
|
|
# int SSL_CTX_set_session_cache_mode(SSL_CTX *ctx, int mode)
|
|
|
|
# ============================================================
|
|
# SSL object
|
|
# ============================================================
|
|
# SSL *SSL_new(SSL_CTX *ctx)
|
|
extern def SSL_new(ctx: SslCtxPtr) -> SslPtr
|
|
# void SSL_free(SSL *ssl)
|
|
extern def SSL_free(ssl: SslPtr)
|
|
# int SSL_up_ref(SSL *ssl)
|
|
extern def SSL_up_ref(ssl: SslPtr) -> int
|
|
# int SSL_set_fd(SSL *ssl, int fd) / int SSL_get_fd(const SSL *ssl)
|
|
extern def SSL_set_fd(ssl: SslPtr, fd: int) -> int
|
|
extern def SSL_get_fd(ssl: SslPtr) -> int
|
|
# void SSL_set_connect_state(SSL *ssl) / accept
|
|
extern def SSL_set_connect_state(ssl: SslPtr)
|
|
extern def SSL_set_accept_state(ssl: SslPtr)
|
|
# Handshake
|
|
extern def SSL_connect(ssl: SslPtr) -> int
|
|
extern def SSL_accept(ssl: SslPtr) -> int
|
|
# int SSL_do_handshake(SSL *ssl)
|
|
extern def SSL_do_handshake(ssl: SslPtr) -> int
|
|
# int SSL_shutdown(SSL *ssl)
|
|
extern def SSL_shutdown(ssl: SslPtr) -> int
|
|
# int SSL_get_shutdown(const SSL *ssl)
|
|
extern def SSL_get_shutdown(ssl: SslPtr) -> int
|
|
# IO
|
|
# int SSL_read(SSL *ssl, void *buf, int num)
|
|
extern def SSL_read(ssl: SslPtr, buf: bytes, num: int) -> int
|
|
# int SSL_write(SSL *ssl, const void *buf, int num)
|
|
extern def SSL_write(ssl: SslPtr, buf: bytes, num: int) -> int
|
|
# int SSL_pending(const SSL *ssl)
|
|
extern def SSL_pending(ssl: SslPtr) -> int
|
|
# int SSL_get_error(const SSL *s, int ret_code)
|
|
extern def SSL_get_error(s: SslPtr, ret_code: int) -> int
|
|
# const char *SSL_get_version(const SSL *s)
|
|
extern def SSL_get_version(s: SslPtr) -> str
|
|
# long SSL_get_verify_result(const SSL *ssl)
|
|
extern def SSL_get_verify_result(ssl: SslPtr) -> int32
|
|
# int SSL_get_verify_mode(const SSL *ssl)
|
|
extern def SSL_get_verify_mode(ssl: SslPtr) -> int
|
|
# X509 *SSL_get_peer_certificate(const SSL *s) / SSL_get1_peer_certificate
|
|
extern def SSL_get_peer_certificate(s: SslPtr) -> X509Ptr
|
|
extern def SSL_get1_peer_certificate(s: SslPtr) -> X509Ptr
|
|
# Current cipher
|
|
# SSL_get_cipher_name is a macro in ssl.h (SSL_CIPHER_get_name(SSL_get_current_cipher(s)));
|
|
# FFI calls the two real exported functions instead.
|
|
# const SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
|
|
extern def SSL_get_current_cipher(s: SslPtr) -> SslCipherPtr
|
|
# const char *SSL_CIPHER_get_name(const SSL_CIPHER *c)
|
|
extern def SSL_CIPHER_get_name(cipher: SslCipherPtr) -> str
|
|
# SNI: int SSL_set_tlsext_host_name(SSL *s, const char *name) (macro -> SSL_ctrl)
|
|
# const char *SSL_get_servername(const SSL *s, int type)
|
|
extern def SSL_get_servername(s: SslPtr, type: int) -> str
|
|
# ALPN
|
|
# void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, unsigned int *len)
|
|
extern def SSL_get0_alpn_selected(ssl: SslPtr, data: bytes, len: bytes)
|
|
# Control / options
|
|
# long SSL_ctrl(SSL *ssl, int cmd, long larg, void *parg)
|
|
extern def SSL_ctrl(ssl: SslPtr, cmd: int, larg: int32, parg: bytes) -> int32
|
|
# uint64_t SSL_set_options(SSL *ssl, uint64_t op)
|
|
extern def SSL_set_options(ssl: SslPtr, op: uint64) -> uint64
|
|
# int SSL_set1_host(SSL *s, const char *hostname) (hostname check)
|
|
extern def SSL_set1_host(s: SslPtr, hostname: str) -> int
|
|
# void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio)
|
|
extern def SSL_set_bio(s: SslPtr, rbio: BioPtr, wbio: BioPtr)
|
|
|
|
# ============================================================
|
|
# Convenience wrappers
|
|
# ============================================================
|
|
def ssl_set_tlsext_host_name(ssl: SslPtr, name: str) -> int:
|
|
return SSL_ctrl(ssl, SslCtrlSetTlsextHostname, TlsextNametypeHostName, name)
|
|
|
|
|
|
def ssl_ctx_set_min_proto_version(ctx: SslCtxPtr, version: int) -> int:
|
|
return SSL_CTX_ctrl(ctx, SslCtrlSetMinProtoVersion, version, None)
|
|
|
|
|
|
def ssl_ctx_set_max_proto_version(ctx: SslCtxPtr, version: int) -> int:
|
|
return SSL_CTX_ctrl(ctx, SslCtrlSetMaxProtoVersion, version, None)
|
|
|
|
|
|
def ssl_ctx_set_mode(ctx: SslCtxPtr, op: int) -> int:
|
|
return SSL_CTX_ctrl(ctx, SslCtrlMode, op, None)
|
|
|
|
|
|
def ssl_get_verify_result_ok(ssl: SslPtr) -> bool:
|
|
return SSL_get_verify_result(ssl) == 0
|