def startTLS(self, ctx): """ Start SSL/TLS. If this is not called, this instance just passes data through untouched. """ # NOTE: This method signature must match the startTLS() method Twisted # expects transports to have. This will be called automatically # by Twisted in STARTTLS situations, for example with SMTP. if self.tlsStarted: raise Exception, 'TLS already started' if debug: print 'TwistedProtocolWrapper.startTLS' self.ctx = ctx self.internalBio = m2.bio_new(m2.bio_s_bio()) m2.bio_set_write_buf_size(self.internalBio, 0) self.networkBio = _BioProxy(m2.bio_new(m2.bio_s_bio())) m2.bio_set_write_buf_size(self.networkBio._ptr(), 0) m2.bio_make_bio_pair(self.internalBio, self.networkBio._ptr()) self.sslBio = _BioProxy(m2.bio_new(m2.bio_f_ssl())) self.ssl = _SSLProxy(m2.ssl_new(self.ctx.ctx)) if self.isClient: m2.ssl_set_connect_state(self.ssl._ptr()) else: m2.ssl_set_accept_state(self.ssl._ptr()) m2.ssl_set_bio(self.ssl._ptr(), self.internalBio, self.internalBio) m2.bio_set_ssl(self.sslBio._ptr(), self.ssl._ptr(), m2.bio_noclose) # Need this for writes that are larger than BIO pair buffers mode = m2.ssl_get_mode(self.ssl._ptr()) m2.ssl_set_mode(self.ssl._ptr(), mode | m2.SSL_MODE_ENABLE_PARTIAL_WRITE | m2.SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) self.tlsStarted = 1
def startTLS(self, ctx): """ Start SSL/TLS. If this is not called, this instance just passes data through untouched. """ # NOTE: This method signature must match the startTLS() method Twisted # expects transports to have. This will be called automatically # by Twisted in STARTTLS situations, for example with SMTP. if self.tlsStarted: raise Exception, 'TLS already started' if debug: print 'TwistedProtocolWrapper.startTLS' self.ctx = ctx self.internalBio = m2.bio_new(m2.bio_s_bio()) m2.bio_set_write_buf_size(self.internalBio, 0) self.networkBio = m2.bio_new(m2.bio_s_bio()) m2.bio_set_write_buf_size(self.networkBio, 0) m2.bio_make_bio_pair(self.internalBio, self.networkBio) self.sslBio = _SSLBioProxy(m2.bio_new(m2.bio_f_ssl())) self.ssl = _SSLProxy(m2.ssl_new(self.ctx.ctx)) if self.isClient: m2.ssl_set_connect_state(self.ssl._ptr()) else: m2.ssl_set_accept_state(self.ssl._ptr()) m2.ssl_set_bio(self.ssl._ptr(), self.internalBio, self.internalBio) m2.bio_set_ssl(self.sslBio._ptr(), self.ssl._ptr(), m2.bio_noclose) # Need this for writes that are larger than BIO pair buffers mode = m2.ssl_get_mode(self.ssl._ptr()) m2.ssl_set_mode( self.ssl._ptr(), mode | m2.SSL_MODE_ENABLE_PARTIAL_WRITE | m2.SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) self.tlsStarted = 1
def set_connect_state(self): # type: () -> None """Sets Connection to work in the client mode.""" m2.ssl_set_connect_state(self.ssl)
def set_connect_state(self): m2.ssl_set_connect_state(self.ssl)
# anything that can be done about it, so just eat it. # (There may be multiple such errors, so clear them all.) while True: err = m2.err_get_error() if not err: break # The magic number is X509_R_CERT_ALREADY_IN_HASH_TABLE, which # is a constant that m2crypto doesn't export. :/ if err != 185057381: raise TLSError(m2.err_reason_error_string(err)) # Create a lower level (SWIG) SSL object using this context. self._ssl = _SSLWrapper(m2.ssl_new(ctx.ctx)) if kwargs['client']: self._m2_check_err(m2.ssl_set_connect_state(self._ssl.obj)) else: self._m2_check_err(m2.ssl_set_accept_state(self._ssl.obj)) # Setup the BIO pair. This diagram is instructive: # # Application | TLS layer # | # Your Code | # /\ || | # || \/ | # Application buffer <===> TLS read/write/etc # | /\ || # | || \/ # | BIO pair (internal_bio) # | BIO pair (network_bio)
# CA bundle has duplicate certs?). It doesn't seem there's # anything that can be done about it, so just eat it. # (There may be multiple such errors, so clear them all.) while True: err = m2.err_get_error() if not err: break # The magic number is X509_R_CERT_ALREADY_IN_HASH_TABLE, which # is a constant that m2crypto doesn't export. :/ if err != 185057381: raise TLSError(m2.err_reason_error_string(err)) # Create a lower level (SWIG) SSL object using this context. self._ssl = _SSLWrapper(m2.ssl_new(ctx.ctx)) if kwargs['client']: self._m2_check_err(m2.ssl_set_connect_state(self._ssl.obj)) else: self._m2_check_err(m2.ssl_set_accept_state(self._ssl.obj)) # Setup the BIO pair. This diagram is instructive: # # Application | TLS layer # | # Your Code | # /\ || | # || \/ | # Application buffer <===> TLS read/write/etc # | /\ || # | || \/ # | BIO pair (internal_bio) # | BIO pair (network_bio)