TermiNexus
e80284a6d5
按根目录 新规范 迁移 R1/R2/R3/R4/R6/R7/R8/R9：指针 T* 后缀、内建类型短别名、c.Addr/c.Deref 单目化、c.Asm 改 __asm__、t.CDefine 改 define 软关键字、t.CEnum 改 enum。R4 对内建 cast 多参实参保留 c.Deref 原写法（单目化会致 TPC 类型退化）。验证：includes 52/52 编译通过，TransPyV 自举产物顺序回归 77/77 全通过。
210 lines
9.0 KiB
Plaintext
210 lines
9.0 KiB
Plaintext
import t, c
|
||
from openssl.types import *
|
||
|
||
# ============================================================
|
||
# openssl/ssl.vp — SSL/TLS 连接层（握手 + SocketIO + 校验证书）
|
||
# 对应头文件: ssl.h
|
||
#
|
||
# 典型客户端流程:
|
||
# OPENSSL_init_ssl(...)
|
||
# ctx = SSL_CTX_new(TLS_client_method())
|
||
# SSL_CTX_set_verify(ctx, SslVerifyPeer, 0) # 校验对端
|
||
# SSL_CTX_load_verify_locations(ctx, cafile, None)
|
||
# ssl = SSL_new(ctx)
|
||
# SSL_set_fd(ssl, fd) # 底层已连好的 TCP socket
|
||
# SSL_connect(ssl) # 握手
|
||
# SSL_write/SSL_read
|
||
# ============================================================
|
||
|
||
# ---- 证书文件格式（SSL_CTX_use_*_file / use_certificate_file 的 type）----
|
||
define X509FiletypePem = 1
|
||
define X509FiletypeAsn1 = 2
|
||
# SSL_FILETYPE_* 与 X509_FILETYPE_* 同值
|
||
define SslFiletypePem = 1
|
||
define SslFiletypeAsn1 = 2
|
||
|
||
# ---- 校验模式（SSL_CTX_set_verify mode）----
|
||
define SslVerifyNone = 0x00
|
||
define SslVerifyPeer = 0x01
|
||
define SslVerifyFailIfNoPeerCert = 0x02
|
||
define SslVerifyClientOnce = 0x04
|
||
|
||
# ---- 协议版本（SSL_CTX_ctrl SSL_CTRL_SET_MIN/MAX_PROTO_VERSION 的 arg）----
|
||
define Tls1Version = 0x0301
|
||
define Tls1_1Version = 0x0302
|
||
define Tls1_2Version = 0x0303
|
||
define Tls1_3Version = 0x0304
|
||
|
||
# ---- ctrl 命令 ----
|
||
define SslCtrlSetTlsextHostname = 55# SSL_ctrl(ssl, ..., TLSEXT_NAMETYPE_host_name, (void*)name)
|
||
define SslCtrlSetMinProtoVersion = 123
|
||
define SslCtrlSetMaxProtoVersion = 124
|
||
define SslCtrlMode = 33
|
||
define SslCtrlClearMode = 34
|
||
define TlsextNametypeHostName = 0
|
||
|
||
# ---- shutdown 状态 ----
|
||
define SslSentShutdown = 1
|
||
define SslReceivedShutdown = 2
|
||
|
||
# ---- SSL_get_error 返回码 ----
|
||
define SslErrorNone = 0
|
||
define SslErrorSsl = 1
|
||
define SslErrorWantRead = 2
|
||
define SslErrorWantWrite = 3
|
||
define SslErrorWantX509Lookup = 4
|
||
define SslErrorSyscall = 5
|
||
define SslErrorZeroReturn = 6
|
||
define SslErrorWantConnect = 7
|
||
define SslErrorWantAccept = 8
|
||
define SslErrorWantAsync = 9
|
||
define SslErrorWantAsyncJob = 10
|
||
define SslErrorWantClientHelloCb = 11
|
||
define SslErrorWantRetryVerify = 12
|
||
|
||
# ---- SSL_OP_* 选项 ----
|
||
# SSL_CTX_set_options(ctx, uint64_t)
|
||
define SslOpNoSslv2 = 0x01000000
|
||
define SslOpNoSslv3 = 0x02000000
|
||
define SslOpNoTlsv1 = 0x04000000
|
||
define SslOpNoTlsv1_2 = 0x08000000
|
||
define SslOpNoTlsv1_1 = 0x10000000
|
||
define SslOpNoTlsv1_3 = 0x20000000
|
||
define SslOpAll = 0x00000fff
|
||
|
||
# ============================================================
|
||
# 初始化 / 方法
|
||
# ============================================================
|
||
# (OPENSSL_init_ssl 见 crypto.vp)
|
||
# const SSL_METHOD *TLS_method(void) / *_client_method / *_server_method
|
||
extern def TLS_method() -> SslMethodPtr
|
||
extern def TLS_client_method() -> SslMethodPtr
|
||
extern def TLS_server_method() -> SslMethodPtr
|
||
|
||
# ============================================================
|
||
# SSL_CTX
|
||
# ============================================================
|
||
# SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
|
||
extern def SSL_CTX_new(meth: SslMethodPtr) -> SslCtxPtr
|
||
# void SSL_CTX_free(SSL_CTX *ctx)
|
||
extern def SSL_CTX_free(ctx: SslCtxPtr)
|
||
# int SSL_CTX_up_ref(SSL_CTX *ctx)
|
||
extern def SSL_CTX_up_ref(ctx: SslCtxPtr) -> int
|
||
# 证书 / 私钥
|
||
# int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
|
||
extern def SSL_CTX_use_certificate_file(ctx: SslCtxPtr, file: str, type: int) -> int
|
||
# int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
|
||
extern def SSL_CTX_use_PrivateKey_file(ctx: SslCtxPtr, file: str, type: int) -> int
|
||
# int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
|
||
extern def SSL_CTX_use_certificate_chain_file(ctx: SslCtxPtr, file: str) -> int
|
||
# int SSL_CTX_check_private_key(const SSL_CTX *ctx)
|
||
extern def SSL_CTX_check_private_key(ctx: SslCtxPtr) -> int
|
||
# 校验配置
|
||
# void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, SSL_verify_cb callback)
|
||
extern def SSL_CTX_set_verify(ctx: SslCtxPtr, mode: int, callback: bytes)
|
||
# void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth)
|
||
extern def SSL_CTX_set_verify_depth(ctx: SslCtxPtr, depth: int)
|
||
# int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, const char *CApath)
|
||
extern def SSL_CTX_load_verify_locations(ctx: SslCtxPtr, CAfile: str, CApath: str) -> int
|
||
# int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
|
||
extern def SSL_CTX_set_default_verify_paths(ctx: SslCtxPtr) -> int
|
||
# int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
|
||
extern def SSL_CTX_set_cipher_list(ctx: SslCtxPtr, cipher_list: str) -> int
|
||
# int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str) (TLS1.3)
|
||
extern def SSL_CTX_set_ciphersuites(ctx: SslCtxPtr, suites: str) -> int
|
||
# int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, unsigned int protos_len)
|
||
extern def SSL_CTX_set_alpn_protos(ctx: SslCtxPtr, protos: bytes, protos_len: uint32) -> int
|
||
# uint64_t SSL_CTX_set_options(SSL_CTX *ctx, uint64_t op)
|
||
extern def SSL_CTX_set_options(ctx: SslCtxPtr, op: uint64) -> uint64
|
||
# long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
|
||
extern def SSL_CTX_ctrl(ctx: SslCtxPtr, cmd: int, larg: int32, parg: bytes) -> int32
|
||
# long SSL_CTX_set_timeout(SSL_CTX *ctx, long t) -- 用 ctrl? 不是，是函数
|
||
# int SSL_CTX_set_session_cache_mode(SSL_CTX *ctx, int mode)
|
||
|
||
# ============================================================
|
||
# SSL 对象
|
||
# ============================================================
|
||
# SSL *SSL_new(SSL_CTX *ctx)
|
||
extern def SSL_new(ctx: SslCtxPtr) -> SslPtr
|
||
# void SSL_free(SSL *ssl)
|
||
extern def SSL_free(ssl: SslPtr)
|
||
# int SSL_up_ref(SSL *ssl)
|
||
extern def SSL_up_ref(ssl: SslPtr) -> int
|
||
# int SSL_set_fd(SSL *ssl, int fd) / int SSL_get_fd(const SSL *ssl)
|
||
extern def SSL_set_fd(ssl: SslPtr, fd: int) -> int
|
||
extern def SSL_get_fd(ssl: SslPtr) -> int
|
||
# void SSL_set_connect_state(SSL *ssl) / accept
|
||
extern def SSL_set_connect_state(ssl: SslPtr)
|
||
extern def SSL_set_accept_state(ssl: SslPtr)
|
||
# 握手
|
||
extern def SSL_connect(ssl: SslPtr) -> int
|
||
extern def SSL_accept(ssl: SslPtr) -> int
|
||
# int SSL_do_handshake(SSL *ssl)
|
||
extern def SSL_do_handshake(ssl: SslPtr) -> int
|
||
# int SSL_shutdown(SSL *ssl)
|
||
extern def SSL_shutdown(ssl: SslPtr) -> int
|
||
# int SSL_get_shutdown(const SSL *ssl)
|
||
extern def SSL_get_shutdown(ssl: SslPtr) -> int
|
||
# IO
|
||
# int SSL_read(SSL *ssl, void *buf, int num)
|
||
extern def SSL_read(ssl: SslPtr, buf: bytes, num: int) -> int
|
||
# int SSL_write(SSL *ssl, const void *buf, int num)
|
||
extern def SSL_write(ssl: SslPtr, buf: bytes, num: int) -> int
|
||
# int SSL_pending(const SSL *ssl)
|
||
extern def SSL_pending(ssl: SslPtr) -> int
|
||
# int SSL_get_error(const SSL *s, int ret_code)
|
||
extern def SSL_get_error(s: SslPtr, ret_code: int) -> int
|
||
# const char *SSL_get_version(const SSL *s)
|
||
extern def SSL_get_version(s: SslPtr) -> str
|
||
# long SSL_get_verify_result(const SSL *ssl)
|
||
extern def SSL_get_verify_result(ssl: SslPtr) -> int32
|
||
# int SSL_get_verify_mode(const SSL *ssl)
|
||
extern def SSL_get_verify_mode(ssl: SslPtr) -> int
|
||
# X509 *SSL_get_peer_certificate(const SSL *s) / SSL_get1_peer_certificate
|
||
extern def SSL_get_peer_certificate(s: SslPtr) -> X509Ptr
|
||
extern def SSL_get1_peer_certificate(s: SslPtr) -> X509Ptr
|
||
# 当前加密套件
|
||
# SSL_get_cipher_name 在 ssl.h 是宏（SSL_CIPHER_get_name(SSL_get_current_cipher(s))），
|
||
# FFI 拆成两个真实导出函数调用：
|
||
# const SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
|
||
extern def SSL_get_current_cipher(s: SslPtr) -> SslCipherPtr
|
||
# const char *SSL_CIPHER_get_name(const SSL_CIPHER *c)
|
||
extern def SSL_CIPHER_get_name(cipher: SslCipherPtr) -> str
|
||
# SNI: int SSL_set_tlsext_host_name(SSL *s, const char *name)（宏 → SSL_ctrl）
|
||
# const char *SSL_get_servername(const SSL *s, int type)
|
||
extern def SSL_get_servername(s: SslPtr, type: int) -> str
|
||
# ALPN
|
||
# void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, unsigned int *len)
|
||
extern def SSL_get0_alpn_selected(ssl: SslPtr, data: bytes, len: bytes)
|
||
# 控制 / 选项
|
||
# long SSL_ctrl(SSL *ssl, int cmd, long larg, void *parg)
|
||
extern def SSL_ctrl(ssl: SslPtr, cmd: int, larg: int32, parg: bytes) -> int32
|
||
# uint64_t SSL_set_options(SSL *ssl, uint64_t op)
|
||
extern def SSL_set_options(ssl: SslPtr, op: uint64) -> uint64
|
||
# int SSL_set1_host(SSL *s, const char *hostname) (主机名校验)
|
||
extern def SSL_set1_host(s: SslPtr, hostname: str) -> int
|
||
# void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio)
|
||
extern def SSL_set_bio(s: SslPtr, rbio: BioPtr, wbio: BioPtr)
|
||
|
||
# ============================================================
|
||
# 便捷封装
|
||
# ============================================================
|
||
def ssl_set_tlsext_host_name(ssl: SslPtr, name: str) -> int:
|
||
return SSL_ctrl(ssl, SslCtrlSetTlsextHostname, TlsextNametypeHostName, name)
|
||
|
||
|
||
def ssl_ctx_set_min_proto_version(ctx: SslCtxPtr, version: int) -> int:
|
||
return SSL_CTX_ctrl(ctx, SslCtrlSetMinProtoVersion, version, None)
|
||
|
||
|
||
def ssl_ctx_set_max_proto_version(ctx: SslCtxPtr, version: int) -> int:
|
||
return SSL_CTX_ctrl(ctx, SslCtrlSetMaxProtoVersion, version, None)
|
||
|
||
|
||
def ssl_ctx_set_mode(ctx: SslCtxPtr, op: int) -> int:
|
||
return SSL_CTX_ctrl(ctx, SslCtrlMode, op, None)
|
||
|
||
|
||
def ssl_get_verify_result_ok(ssl: SslPtr) -> bool:
|
||
return SSL_get_verify_result(ssl) == 0
|