Skip to content

Commit 6b5750b

Browse files
felixdoerrefelixdoerre
committed
extmod/tls Move the native ssl module to tls.
The current ssl module has quite a few differences to the cpython implementation. This change moves the micropython variant to tls and provides a wrapper module for ssl. Users who only rely on implemented comparible behavior can continue to use "ssl", while users that rely on non-compatible behavior should switch to "tls". Then we can make the facade in "ssl" more strictly adhere to cpython. Signed-off-by: Felix Dörre <felix@dogcraft.de>
1 parent dc1a85f commit 6b5750b

File tree

20 files changed

+65
-180
lines changed

20 files changed

+65
-180
lines changed

‎docs/library/ssl.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ facilities for network sockets, both client-side and server-side.
1313
Functions
1414
---------
1515

16-
.. function:: ssl.wrap_socket(sock, server_side=False, keyfile=None, certfile=None, cert_reqs=CERT_NONE, cadata=None, server_hostname=None, do_handshake=True)
16+
.. function:: ssl.wrap_socket(sock, server_side=False, key=None, cert=None, cert_reqs=CERT_NONE, cadata=None, server_hostname=None, do_handshake=True)
1717

1818
Wrap the given *sock* and return a new wrapped-socket object. The implementation
1919
of this function is to first create an `SSLContext` and then call the `SSLContext.wrap_socket`

‎extmod/extmod.cmake

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ set(MICROPY_SOURCE_EXTMOD
3939
${MICROPY_EXTMOD_DIR}/modre.c
4040
${MICROPY_EXTMOD_DIR}/modselect.c
4141
${MICROPY_EXTMOD_DIR}/modsocket.c
42-
${MICROPY_EXTMOD_DIR}/modssl_axtls.c
43-
${MICROPY_EXTMOD_DIR}/modssl_mbedtls.c
42+
${MICROPY_EXTMOD_DIR}/modtls_axtls.c
43+
${MICROPY_EXTMOD_DIR}/modtls_mbedtls.c
4444
${MICROPY_EXTMOD_DIR}/modtime.c
4545
${MICROPY_EXTMOD_DIR}/modwebsocket.c
4646
${MICROPY_EXTMOD_DIR}/modwebrepl.c

‎extmod/extmod.mk

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ SRC_EXTMOD_C += \
3636
extmod/modre.c \
3737
extmod/modselect.c \
3838
extmod/modsocket.c \
39-
extmod/modssl_axtls.c \
40-
extmod/modssl_mbedtls.c \
39+
extmod/modtls_axtls.c \
40+
extmod/modtls_mbedtls.c \
4141
extmod/modtime.c \
4242
extmod/moductypes.c \
4343
extmod/modwebrepl.c \

‎extmod/modssl_axtls.c renamed to ‎extmod/modtls_axtls.c

Lines changed: 15 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,14 @@ STATIC void ssl_context_load_key(mp_obj_ssl_context_t *self, mp_obj_t key_obj, m
160160
self->key = key_obj;
161161
self->cert = cert_obj;
162162
}
163+
// SSLContext.load_cert_chain(certfile, keyfile)
164+
STATIC mp_obj_t ssl_context_load_cert_chain(mp_obj_t self_in, mp_obj_t cert, mp_obj_t pkey) {
165+
mp_obj_ssl_context_t *self = MP_OBJ_TO_PTR(self_in);
166+
ssl_context_load_key(self, pkey, cert);
167+
return mp_const_none;
168+
}
169+
STATIC MP_DEFINE_CONST_FUN_OBJ_3(ssl_context_load_cert_chain_obj, ssl_context_load_cert_chain);
170+
163171

164172
STATIC mp_obj_t ssl_context_wrap_socket(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
165173
enum { ARG_server_side, ARG_do_handshake_on_connect, ARG_server_hostname };
@@ -182,6 +190,7 @@ STATIC mp_obj_t ssl_context_wrap_socket(size_t n_args, const mp_obj_t *pos_args,
182190
STATIC MP_DEFINE_CONST_FUN_OBJ_KW(ssl_context_wrap_socket_obj, 2, ssl_context_wrap_socket);
183191

184192
STATIC const mp_rom_map_elem_t ssl_context_locals_dict_table[] = {
193+
{ MP_ROM_QSTR(MP_QSTR_load_cert_chain), MP_ROM_PTR(&ssl_context_load_cert_chain_obj)},
185194
{ MP_ROM_QSTR(MP_QSTR_wrap_socket), MP_ROM_PTR(&ssl_context_wrap_socket_obj) },
186195
};
187196
STATIC MP_DEFINE_CONST_DICT(ssl_context_locals_dict, ssl_context_locals_dict_table);
@@ -413,48 +422,8 @@ STATIC MP_DEFINE_CONST_OBJ_TYPE(
413422
/******************************************************************************/
414423
// ssl module.
415424

416-
STATIC mp_obj_t mod_ssl_wrap_socket(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
417-
enum {
418-
ARG_key,
419-
ARG_cert,
420-
ARG_server_side,
421-
ARG_server_hostname,
422-
ARG_do_handshake,
423-
};
424-
static const mp_arg_t allowed_args[] = {
425-
{ MP_QSTR_key, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
426-
{ MP_QSTR_cert, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
427-
{ MP_QSTR_server_side, MP_ARG_KW_ONLY | MP_ARG_BOOL, {.u_bool = false} },
428-
{ MP_QSTR_server_hostname, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
429-
{ MP_QSTR_do_handshake, MP_ARG_KW_ONLY | MP_ARG_BOOL, {.u_bool = true} },
430-
};
431-
432-
// Parse arguments.
433-
mp_obj_t sock = pos_args[0];
434-
mp_arg_val_t args[MP_ARRAY_SIZE(allowed_args)];
435-
mp_arg_parse_all(n_args - 1, pos_args + 1, kw_args, MP_ARRAY_SIZE(allowed_args), allowed_args, args);
436-
437-
// Create SSLContext.
438-
mp_int_t protocol = args[ARG_server_side].u_bool ? PROTOCOL_TLS_SERVER : PROTOCOL_TLS_CLIENT;
439-
mp_obj_t ssl_context_args[1] = { MP_OBJ_NEW_SMALL_INT(protocol) };
440-
mp_obj_ssl_context_t *ssl_context = MP_OBJ_TO_PTR(ssl_context_make_new(&ssl_context_type, 1, 0, ssl_context_args));
441-
442-
// Load key and cert if given.
443-
if (args[ARG_key].u_obj != mp_const_none) {
444-
ssl_context_load_key(ssl_context, args[ARG_key].u_obj, args[ARG_cert].u_obj);
445-
}
446-
447-
// Create and return the new SSLSocket object.
448-
return ssl_socket_make_new(ssl_context, sock, args[ARG_server_side].u_bool,
449-
args[ARG_do_handshake].u_bool, args[ARG_server_hostname].u_obj);
450-
}
451-
STATIC MP_DEFINE_CONST_FUN_OBJ_KW(mod_ssl_wrap_socket_obj, 1, mod_ssl_wrap_socket);
452-
453-
STATIC const mp_rom_map_elem_t mp_module_ssl_globals_table[] = {
454-
{ MP_ROM_QSTR(MP_QSTR___name__), MP_ROM_QSTR(MP_QSTR_ssl) },
455-
456-
// Functions.
457-
{ MP_ROM_QSTR(MP_QSTR_wrap_socket), MP_ROM_PTR(&mod_ssl_wrap_socket_obj) },
425+
STATIC const mp_rom_map_elem_t mp_module_tls_globals_table[] = {
426+
{ MP_ROM_QSTR(MP_QSTR___name__), MP_ROM_QSTR(MP_QSTR_tls) },
458427

459428
// Classes.
460429
{ MP_ROM_QSTR(MP_QSTR_SSLContext), MP_ROM_PTR(&ssl_context_type) },
@@ -463,13 +432,13 @@ STATIC const mp_rom_map_elem_t mp_module_ssl_globals_table[] = {
463432
{ MP_ROM_QSTR(MP_QSTR_PROTOCOL_TLS_CLIENT), MP_ROM_INT(PROTOCOL_TLS_CLIENT) },
464433
{ MP_ROM_QSTR(MP_QSTR_PROTOCOL_TLS_SERVER), MP_ROM_INT(PROTOCOL_TLS_SERVER) },
465434
};
466-
STATIC MP_DEFINE_CONST_DICT(mp_module_ssl_globals, mp_module_ssl_globals_table);
435+
STATIC MP_DEFINE_CONST_DICT(mp_module_tls_globals, mp_module_tls_globals_table);
467436

468-
const mp_obj_module_t mp_module_ssl = {
437+
const mp_obj_module_t mp_module_tls = {
469438
.base = { &mp_type_module },
470-
.globals = (mp_obj_dict_t *)&mp_module_ssl_globals,
439+
.globals = (mp_obj_dict_t *)&mp_module_tls_globals,
471440
};
472441

473-
MP_REGISTER_EXTENSIBLE_MODULE(MP_QSTR_ssl, mp_module_ssl);
442+
MP_REGISTER_MODULE(MP_QSTR_tls, mp_module_tls);
474443

475444
#endif // MICROPY_PY_SSL && MICROPY_SSL_AXTLS

‎extmod/modssl_mbedtls.c renamed to ‎extmod/modtls_mbedtls.c

Lines changed: 12 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -92,24 +92,6 @@ STATIC mp_obj_t ssl_socket_make_new(mp_obj_ssl_context_t *ssl_context, mp_obj_t
9292
/******************************************************************************/
9393
// Helper functions.
9494

95-
STATIC mp_obj_t read_file(mp_obj_t self_in) {
96-
// file = open(args[0], "rb")
97-
mp_obj_t f_args[2] = {
98-
self_in,
99-
MP_OBJ_NEW_QSTR(MP_QSTR_rb),
100-
};
101-
mp_obj_t file = mp_vfs_open(2, &f_args[0], (mp_map_t *)&mp_const_empty_map);
102-
103-
// data = file.read()
104-
mp_obj_t dest[2];
105-
mp_load_method(file, MP_QSTR_read, dest);
106-
mp_obj_t data = mp_call_method_n_kw(0, 0, dest);
107-
108-
// file.close()
109-
mp_stream_close(file);
110-
return data;
111-
}
112-
11395
#ifdef MBEDTLS_DEBUG_C
11496
STATIC void mbedtls_debug(void *ctx, int level, const char *file, int line, const char *str) {
11597
(void)ctx;
@@ -258,9 +240,7 @@ STATIC mp_obj_t ssl_context_make_new(const mp_obj_type_t *type_in, size_t n_args
258240
}
259241

260242
if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
261-
// The CPython default is MBEDTLS_SSL_VERIFY_REQUIRED, but to maintain
262-
// backwards compatibility we use MBEDTLS_SSL_VERIFY_NONE for now.
263-
self->authmode = MBEDTLS_SSL_VERIFY_NONE;
243+
self->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
264244
} else {
265245
self->authmode = MBEDTLS_SSL_VERIFY_NONE;
266246
}
@@ -398,25 +378,9 @@ STATIC void ssl_context_load_key(mp_obj_ssl_context_t *self, mp_obj_t key_obj, m
398378
}
399379

400380
// SSLContext.load_cert_chain(certfile, keyfile)
401-
STATIC mp_obj_t ssl_context_load_cert_chain(mp_obj_t self_in, mp_obj_t certfile, mp_obj_t keyfile) {
381+
STATIC mp_obj_t ssl_context_load_cert_chain(mp_obj_t self_in, mp_obj_t cert, mp_obj_t pkey) {
402382
mp_obj_ssl_context_t *self = MP_OBJ_TO_PTR(self_in);
403-
mp_obj_t pkey;
404-
mp_obj_t cert;
405-
if (certfile != mp_const_none) {
406-
// check if key is a string/path
407-
if (!(mp_obj_is_type(keyfile, &mp_type_bytes))) {
408-
pkey = read_file(keyfile);
409-
} else {
410-
pkey = keyfile;
411-
}
412-
// check if cert is a string/path
413-
if (!(mp_obj_is_type(certfile, &mp_type_bytes))) {
414-
cert = read_file(certfile);
415-
} else {
416-
cert = certfile;
417-
}
418-
ssl_context_load_key(self, pkey, cert);
419-
}
383+
ssl_context_load_key(self, pkey, cert);
420384
return mp_const_none;
421385
}
422386
STATIC MP_DEFINE_CONST_FUN_OBJ_3(ssl_context_load_cert_chain_obj, ssl_context_load_cert_chain);
@@ -433,25 +397,20 @@ STATIC void ssl_context_load_cadata(mp_obj_ssl_context_t *self, mp_obj_t cadata_
433397
mbedtls_ssl_conf_ca_chain(&self->conf, &self->cacert, NULL);
434398
}
435399

436-
// SSLContext.load_verify_locations(cafile=None, *, cadata=None)
400+
// SSLContext.load_verify_locations(*, cadata=None)
437401
STATIC mp_obj_t ssl_context_load_verify_locations(size_t n_args, const mp_obj_t *pos_args,
438402
mp_map_t *kw_args) {
439403

440404
static const mp_arg_t allowed_args[] = {
441-
{ MP_QSTR_cafile, MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
442405
{ MP_QSTR_cadata, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
443406
};
444407

445408
mp_obj_ssl_context_t *self = MP_OBJ_TO_PTR(pos_args[0]);
446409
mp_arg_val_t args[MP_ARRAY_SIZE(allowed_args)];
447410
mp_arg_parse_all(n_args - 1, pos_args + 1, kw_args, MP_ARRAY_SIZE(allowed_args), allowed_args, args);
448-
// cafile
449-
if (args[0].u_obj != mp_const_none) {
450-
ssl_context_load_cadata(self, read_file(args[0].u_obj));
451-
}
452411
// cadata
453-
if (args[1].u_obj != mp_const_none) {
454-
ssl_context_load_cadata(self, args[1].u_obj);
412+
if (args[0].u_obj != mp_const_none) {
413+
ssl_context_load_cadata(self, args[0].u_obj);
455414
}
456415
return mp_const_none;
457416
}
@@ -810,65 +769,8 @@ STATIC MP_DEFINE_CONST_OBJ_TYPE(
810769
/******************************************************************************/
811770
// ssl module.
812771

813-
STATIC mp_obj_t mod_ssl_wrap_socket(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
814-
enum {
815-
ARG_key,
816-
ARG_cert,
817-
ARG_server_side,
818-
ARG_server_hostname,
819-
ARG_cert_reqs,
820-
ARG_cadata,
821-
ARG_do_handshake,
822-
ARG_cert_callback,
823-
};
824-
static const mp_arg_t allowed_args[] = {
825-
{ MP_QSTR_key, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
826-
{ MP_QSTR_cert, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
827-
{ MP_QSTR_server_side, MP_ARG_KW_ONLY | MP_ARG_BOOL, {.u_bool = false} },
828-
{ MP_QSTR_server_hostname, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
829-
{ MP_QSTR_cert_reqs, MP_ARG_KW_ONLY | MP_ARG_INT, {.u_int = MBEDTLS_SSL_VERIFY_NONE}},
830-
{ MP_QSTR_cadata, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
831-
{ MP_QSTR_do_handshake, MP_ARG_KW_ONLY | MP_ARG_BOOL, {.u_bool = true} },
832-
{ MP_QSTR_cert_callback, MP_ARG_KW_ONLY | MP_ARG_OBJ, {.u_rom_obj = MP_ROM_NONE} },
833-
};
834-
835-
// Parse arguments.
836-
mp_obj_t sock = pos_args[0];
837-
mp_arg_val_t args[MP_ARRAY_SIZE(allowed_args)];
838-
mp_arg_parse_all(n_args - 1, pos_args + 1, kw_args, MP_ARRAY_SIZE(allowed_args), allowed_args, args);
839-
840-
// Create SSLContext.
841-
mp_int_t protocol = args[ARG_server_side].u_bool ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT;
842-
mp_obj_t ssl_context_args[1] = { MP_OBJ_NEW_SMALL_INT(protocol) };
843-
mp_obj_ssl_context_t *ssl_context = MP_OBJ_TO_PTR(ssl_context_make_new(&ssl_context_type, 1, 0, ssl_context_args));
844-
845-
// Load key and cert if given.
846-
if (args[ARG_key].u_obj != mp_const_none) {
847-
ssl_context_load_key(ssl_context, args[ARG_key].u_obj, args[ARG_cert].u_obj);
848-
}
849-
850-
// Set the verify_mode.
851-
mp_obj_t dest[2] = { MP_OBJ_SENTINEL, MP_OBJ_NEW_SMALL_INT(args[ARG_cert_reqs].u_int) };
852-
ssl_context_attr(MP_OBJ_FROM_PTR(ssl_context), MP_QSTR_verify_mode, dest);
853-
mp_obj_t dest2[2] = { MP_OBJ_SENTINEL, args[ARG_cert_callback].u_obj };
854-
ssl_context_attr(MP_OBJ_FROM_PTR(ssl_context), MP_QSTR_cert_callback, dest2);
855-
856-
// Load cadata if given.
857-
if (args[ARG_cadata].u_obj != mp_const_none) {
858-
ssl_context_load_cadata(ssl_context, args[ARG_cadata].u_obj);
859-
}
860-
861-
// Create and return the new SSLSocket object.
862-
return ssl_socket_make_new(ssl_context, sock, args[ARG_server_side].u_bool,
863-
args[ARG_do_handshake].u_bool, args[ARG_server_hostname].u_obj);
864-
}
865-
STATIC MP_DEFINE_CONST_FUN_OBJ_KW(mod_ssl_wrap_socket_obj, 1, mod_ssl_wrap_socket);
866-
867-
STATIC const mp_rom_map_elem_t mp_module_ssl_globals_table[] = {
868-
{ MP_ROM_QSTR(MP_QSTR___name__), MP_ROM_QSTR(MP_QSTR_ssl) },
869-
870-
// Functions.
871-
{ MP_ROM_QSTR(MP_QSTR_wrap_socket), MP_ROM_PTR(&mod_ssl_wrap_socket_obj) },
772+
STATIC const mp_rom_map_elem_t mp_module_tls_globals_table[] = {
773+
{ MP_ROM_QSTR(MP_QSTR___name__), MP_ROM_QSTR(MP_QSTR_tls) },
872774

873775
// Classes.
874776
{ MP_ROM_QSTR(MP_QSTR_SSLContext), MP_ROM_PTR(&ssl_context_type) },
@@ -881,13 +783,13 @@ STATIC const mp_rom_map_elem_t mp_module_ssl_globals_table[] = {
881783
{ MP_ROM_QSTR(MP_QSTR_CERT_OPTIONAL), MP_ROM_INT(MBEDTLS_SSL_VERIFY_OPTIONAL) },
882784
{ MP_ROM_QSTR(MP_QSTR_CERT_REQUIRED), MP_ROM_INT(MBEDTLS_SSL_VERIFY_REQUIRED) },
883785
};
884-
STATIC MP_DEFINE_CONST_DICT(mp_module_ssl_globals, mp_module_ssl_globals_table);
786+
STATIC MP_DEFINE_CONST_DICT(mp_module_tls_globals, mp_module_tls_globals_table);
885787

886-
const mp_obj_module_t mp_module_ssl = {
788+
const mp_obj_module_t mp_module_tls = {
887789
.base = { &mp_type_module },
888-
.globals = (mp_obj_dict_t *)&mp_module_ssl_globals,
790+
.globals = (mp_obj_dict_t *)&mp_module_tls_globals,
889791
};
890792

891-
MP_REGISTER_EXTENSIBLE_MODULE(MP_QSTR_ssl, mp_module_ssl);
793+
MP_REGISTER_MODULE(MP_QSTR_tls, mp_module_tls);
892794

893795
#endif // MICROPY_PY_SSL && MICROPY_SSL_MBEDTLS

‎lib/micropython-lib

‎ports/rp2/boards/manifest.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
freeze("$(PORT_DIR)/modules")
22
include("$(MPY_DIR)/extmod/asyncio")
3+
require("ssl")
34
require("onewire")
45
require("ds18x20")
56
require("dht")

‎ports/unix/variants/coverage/manifest.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
freeze_as_str("frzstr")
22
freeze_as_mpy("frzmpy")
33
freeze_mpy("$(MPY_DIR)/tests/frozen")
4+
require("ssl")

‎ports/unix/variants/manifest.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
require("mip-cmdline")
2+
require("ssl")

‎ports/unix/variants/nanbox/manifest.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
reqiure("ssl")

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy