Skip to content

Honor scalar conversion protocols across SSL backends #9653

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 2 commits into from
Nov 6, 2026
Merged

Honor scalar conversion protocols across SSL backends #9653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3795e64
Honor scalar conversion protocols across SSL backends
youknowdot Nov 3, 2026
42a9891
Require certificate verification for WASM hostname checks
youknowdot Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 28 additions & 17 deletions crates/stdlib/src/openssl.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,8 +79,8 @@ mod _ssl {
convert::ToPyException,
exceptions,
function::{
ArgBytesLike, ArgMemoryBuffer, ArgStrOrBytesLike, Either, FsPath, OptionalArg,
PyComparisonValue,
ArgBytesLike, ArgIntoBool, ArgIntoFloat, ArgMemoryBuffer, ArgStrOrBytesLike,
Either, FsPath, OptionalArg, PyComparisonValue,
},
object::{Traverse, TraverseFn},
stdlib::_warnings,
Expand Down Expand Up @@ -466,7 +466,8 @@ mod _ssl {
}

#[pyfunction(name = "RAND_add")]
fn rand_add(string: ArgStrOrBytesLike, entropy: f64) {
fn rand_add(string: ArgStrOrBytesLike, entropy: ArgIntoFloat) {
let entropy = entropy.into_float();
let f = |b: &[u8]| {
for buf in b.chunks(core::ffi::c_int::MAX as usize) {
unsafe { sys::RAND_add(buf.as_ptr() as *const _, buf.len() as _, entropy) }
Expand Down Expand Up @@ -1111,6 +1112,7 @@ mod _ssl {
args: GetGroupsArgs,
vm: &VirtualMachine,
) -> PyResult<PyListRef> {
let include_aliases = args.include_aliases.into_bool();
#[cfg(ossl350)]
unsafe {
const SSL_CTRL_GET0_IMPLEMENTED_GROUPS: core::ffi::c_int = 139;
Expand All @@ -1121,7 +1123,7 @@ mod _ssl {
let result = sys::SSL_CTX_ctrl(
zelf.ctx().as_ptr(),
SSL_CTRL_GET0_IMPLEMENTED_GROUPS,
core::ffi::c_long::from(args.include_aliases),
core::ffi::c_long::from(include_aliases),
groups.cast(),
);
if result == 0 {
Expand All @@ -1146,7 +1148,7 @@ mod _ssl {
}
#[cfg(not(ossl350))]
{
let _ = (zelf, args.include_aliases);
let _ = (zelf, include_aliases);
Err(vm.new_not_implemented_error("Getting groups requires OpenSSL 3.5 or later."))
}
}
Expand Down Expand Up @@ -1343,7 +1345,8 @@ mod _ssl {
zelf.check_hostname.load()
}
#[pygetset(setter)]
fn set_check_hostname(zelf: &Py<Self>, ch: bool) {
fn set_check_hostname(zelf: &Py<Self>, ch: ArgIntoBool) {
let ch = ch.into_bool();
let mut ctx = zelf.builder();
if ch && builder_as_ctx(&ctx).verify_mode() == SslVerifyMode::NONE {
ctx.set_verify(SslVerifyMode::PEER | SslVerifyMode::FAIL_IF_NO_PEER_CERT);
Expand Down Expand Up @@ -1664,7 +1667,7 @@ mod _ssl {
args: GetCertArgs,
vm: &VirtualMachine,
) -> PyResult<Vec<PyObjectRef>> {
let binary_form = args.binary_form.unwrap_or(false);
let binary_form = args.binary_form.map_or(false, ArgIntoBool::into_bool);
let ctx = zelf.ctx();
let certs = cfg_select! {
ossl300 => ctx.cert_store().all_certificates(),
Expand Down Expand Up @@ -2207,8 +2210,12 @@ mod _ssl {
vm: &VirtualMachine,
) -> PyResult<PyObjectRef> {
// Use common helper function
let (ssl, socket_type, server_hostname) =
Self::new_py_ssl_socket(zelf.clone(), args.server_side, args.server_hostname, vm)?;
let (ssl, socket_type, server_hostname) = Self::new_py_ssl_socket(
zelf.clone(),
args.server_side.into_bool(),
args.server_hostname,
vm,
)?;

// Create SslStream with socket
let stream = ssl::SslStream::new(
Expand Down Expand Up @@ -2272,8 +2279,12 @@ mod _ssl {
vm: &VirtualMachine,
) -> PyResult<PyObjectRef> {
// Use common helper function
let (ssl, socket_type, server_hostname) =
Self::new_py_ssl_socket(zelf.clone(), args.server_side, args.server_hostname, vm)?;
let (ssl, socket_type, server_hostname) = Self::new_py_ssl_socket(
zelf.clone(),
args.server_side.into_bool(),
args.server_hostname,
vm,
)?;

// Create BioStream wrapper
let bio_stream = BioStream {
Expand Down Expand Up @@ -2337,7 +2348,7 @@ mod _ssl {
struct WrapBioArgs {
incoming: PyRef<PySslMemoryBio>,
outgoing: PyRef<PySslMemoryBio>,
server_side: bool,
server_side: ArgIntoBool,
#[pyarg(any, default)]
server_hostname: Option<PyStrRef>,
#[pyarg(named, default)]
Expand All @@ -2349,7 +2360,7 @@ mod _ssl {
#[derive(FromArgs)]
struct WrapSocketArgs {
sock: PyRef<PySocket>,
server_side: bool,
server_side: ArgIntoBool,
#[pyarg(any, default)]
server_hostname: Option<PyStrRef>,
#[pyarg(named, default)]
Expand Down Expand Up @@ -2380,13 +2391,13 @@ mod _ssl {
#[derive(FromArgs)]
struct GetCertArgs {
#[pyarg(any, optional)]
binary_form: OptionalArg<bool>,
binary_form: OptionalArg<ArgIntoBool>,
}

#[derive(FromArgs)]
struct GetGroupsArgs {
#[pyarg(named, default)]
include_aliases: bool,
#[pyarg(named, default = ArgIntoBool::FALSE)]
include_aliases: ArgIntoBool,
}

// Err is true if the socket is blocking
Expand Down Expand Up @@ -3557,7 +3568,7 @@ mod _ssl {
args: GetCertArgs,
vm: &VirtualMachine,
) -> PyResult<Option<PyObjectRef>> {
let binary = args.binary_form.unwrap_or(false);
let binary = args.binary_form.map_or(false, ArgIntoBool::into_bool);
with_ssl_pointer(&zelf.connection, |ssl_ptr| {
let ssl = unsafe { ssl::SslRef::from_ptr(ssl_ptr) };
if !ssl.is_init_finished() {
Expand Down
40 changes: 21 additions & 19 deletions crates/stdlib/src/ssl.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,8 @@ mod _ssl {
},
convert::IntoPyException,
function::{
ArgBytesLike, ArgMemoryBuffer, Either, FsPath, FuncArgs, OptionalArg,
PyComparisonValue, PySetterValue,
ArgBytesLike, ArgIntoBool, ArgIntoFloat, ArgMemoryBuffer, ArgStrOrBytesLike,
Either, FsPath, FuncArgs, OptionalArg, PyComparisonValue, PySetterValue,
},
stdlib::_warnings,
types::{Comparable, Constructor, Hashable, PyComparisonOp, Representable},
Expand Down Expand Up @@ -420,7 +420,7 @@ mod _ssl {
#[derive(FromArgs)]
struct WrapSocketArgs {
sock: PyObjectRef,
server_side: bool,
server_side: ArgIntoBool,
#[pyarg(any, optional)]
server_hostname: Option<PyUtf8StrRef>,
#[pyarg(named, optional)]
Expand All @@ -433,7 +433,7 @@ mod _ssl {
struct WrapBioArgs {
incoming: PyRef<PyMemoryBIO>,
outgoing: PyRef<PyMemoryBIO>,
server_side: bool,
server_side: ArgIntoBool,
#[pyarg(any, optional)]
server_hostname: Option<PyUtf8StrRef>,
#[pyarg(named, optional)]
Expand Down Expand Up @@ -464,14 +464,14 @@ mod _ssl {

#[derive(FromArgs)]
struct GetCertArgs {
#[pyarg(positional, default)]
der: bool,
#[pyarg(positional, default = ArgIntoBool::FALSE)]
der: ArgIntoBool,
}

#[derive(FromArgs)]
struct GetCaCertsArgs {
#[pyarg(any, default)]
binary_form: bool,
#[pyarg(any, default = ArgIntoBool::FALSE)]
binary_form: ArgIntoBool,
}

#[pyclass(with(Constructor, Representable), flags(BASETYPE))]
Expand Down Expand Up @@ -576,7 +576,8 @@ mod _ssl {
}

#[pygetset(setter)]
fn set_check_hostname(zelf: &Py<Self>, value: bool) {
fn set_check_hostname(zelf: &Py<Self>, value: ArgIntoBool) {
let value = value.into_bool();
*zelf.check_hostname.write() = value;
// When check_hostname is enabled, ensure verify_mode is at least CERT_REQUIRED
if value {
Expand Down Expand Up @@ -642,7 +643,8 @@ mod _ssl {
}

#[pygetset(setter)]
fn set_post_handshake_auth(zelf: &Py<Self>, value: bool) {
fn set_post_handshake_auth(zelf: &Py<Self>, value: ArgIntoBool) {
let value = value.into_bool();
*zelf.post_handshake_auth.write() = value;
zelf.invalidate_policy();
}
Expand Down Expand Up @@ -1596,7 +1598,7 @@ mod _ssl {
args: GetCaCertsArgs,
vm: &VirtualMachine,
) -> PyResult<PyListRef> {
let binary_form = args.binary_form;
let binary_form = args.binary_form.into_bool();
let ca_certs_der = zelf.ca_certs_der.read();

let mut certs = Vec::new();
Expand Down Expand Up @@ -1726,6 +1728,7 @@ mod _ssl {
args: WrapSocketArgs,
vm: &VirtualMachine,
) -> PyResult<PyRef<PySSLSocket>> {
let server_side = args.server_side.into_bool();
let socket_mod = vm.import("socket", 0)?;
let socket_class = socket_mod.get_attr("socket", vm)?;

Expand All @@ -1741,7 +1744,7 @@ mod _ssl {
};

// Validate socket type and context protocol
if args.server_side && zelf.protocol == PROTOCOL_TLS_CLIENT {
if server_side && zelf.protocol == PROTOCOL_TLS_CLIENT {
return Err(vm
.new_os_subtype_error(
PySSLError::class(&vm.ctx).to_owned(),
Expand All @@ -1750,7 +1753,7 @@ mod _ssl {
)
.upcast());
}
if !args.server_side && zelf.protocol == PROTOCOL_TLS_SERVER {
if !server_side && zelf.protocol == PROTOCOL_TLS_SERVER {
return Err(vm
.new_os_subtype_error(
PySSLError::class(&vm.ctx).to_owned(),
Expand All @@ -1770,10 +1773,10 @@ mod _ssl {
record_cursor: PyMutex::new(RecordCursor::default()),
key_log: Arc::new(super::keylog::ConnectionKeyLog::new(zelf.key_log.clone())),
context: PyRwLock::new(zelf),
server_side: args.server_side,
server_side,
server_hostname: PyRwLock::new(hostname),
connection: PyMutex::new(None),
state: PyMutex::new(TlsState::new(args.server_side)),
state: PyMutex::new(TlsState::new(server_side)),
got_eof_error: AtomicBool::new(false),
session_was_reused: PyMutex::new(false),
owner: PyRwLock::new(args.owner.map(|o| o.downgrade(None, vm)).transpose()?),
Expand Down Expand Up @@ -1819,7 +1822,7 @@ mod _ssl {
None => None,
};

let server_side = args.server_side;
let server_side = args.server_side.into_bool();

// Validate socket type and context protocol
if server_side && zelf.protocol == PROTOCOL_TLS_CLIENT {
Expand Down Expand Up @@ -3604,7 +3607,7 @@ mod _ssl {
args: GetCertArgs,
vm: &VirtualMachine,
) -> PyResult<Option<PyObjectRef>> {
let binary = args.der;
let binary = args.der.into_bool();

// Check if handshake is complete
if !zelf.handshake_completed() {
Expand Down Expand Up @@ -4485,9 +4488,8 @@ mod _ssl {
}

#[pyfunction]
fn RAND_add(_string: PyObjectRef, _entropy: f64) {
fn RAND_add(_string: ArgStrOrBytesLike, _entropy: ArgIntoFloat) {
// No-op: the configured rustls provider handles its own entropy.
// Accept any type (str, bytes, bytearray)
}

#[pyfunction]
Expand Down
22 changes: 14 additions & 8 deletions crates/stdlib/src/ssl_wasm.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,10 @@ mod _ssl {
AsObject, Py, PyObject, PyObjectRef, PyPayload, PyRef, PyResult, TryFromObject,
VirtualMachine,
builtins::{PyBytesRef, PyType, PyUtf8StrRef},
function::{ArgBytesLike, FuncArgs, OptionalArg, PyComparisonValue, PySetterValue},
function::{
ArgBytesLike, ArgIntoBool, ArgIntoFloat, ArgStrOrBytesLike, FuncArgs, OptionalArg,
PyComparisonValue, PySetterValue,
},
stdlib::_warnings,
types::{Comparable, Constructor, PyComparisonOp, Representable},
},
Expand Down Expand Up @@ -221,7 +224,8 @@ mod _ssl {
}

#[pygetset(setter)]
fn set_check_hostname(zelf: &Py<Self>, value: bool) {
fn set_check_hostname(zelf: &Py<Self>, value: ArgIntoBool) {
let value = value.into_bool();
*zelf.check_hostname.write() = value;
if value && *zelf.verify_mode.read() == CERT_NONE {
*zelf.verify_mode.write() = CERT_REQUIRED;
Expand Down Expand Up @@ -278,7 +282,8 @@ mod _ssl {
}

#[pygetset(setter)]
fn set_post_handshake_auth(zelf: &Py<Self>, value: bool) {
fn set_post_handshake_auth(zelf: &Py<Self>, value: ArgIntoBool) {
let value = value.into_bool();
*zelf.post_handshake_auth.write() = value;
}

Expand Down Expand Up @@ -572,16 +577,17 @@ mod _ssl {
args: WrapBioArgs,
vm: &VirtualMachine,
) -> PyResult<PyObjectRef> {
let server_side = args.server_side.map_or(false, ArgIntoBool::into_bool);
if let Some(hostname) = args.server_hostname {
validate_hostname(hostname.as_str(), vm)?;
}
if args.server_side.unwrap_or(false) && zelf.protocol == PROTOCOL_TLS_CLIENT {
if server_side && zelf.protocol == PROTOCOL_TLS_CLIENT {
return ssl_error(
vm,
"Cannot create a server socket with a PROTOCOL_TLS_CLIENT context",
);
}
if !args.server_side.unwrap_or(false) && zelf.protocol == PROTOCOL_TLS_SERVER {
if !server_side && zelf.protocol == PROTOCOL_TLS_SERVER {
return ssl_error(
vm,
"Cannot create a client socket with a PROTOCOL_TLS_SERVER context",
Expand Down Expand Up @@ -669,7 +675,7 @@ mod _ssl {
#[derive(FromArgs)]
struct GetCertArgs {
#[pyarg(any, optional)]
binary_form: OptionalArg<bool>,
binary_form: OptionalArg<ArgIntoBool>,
}

#[derive(FromArgs)]
Expand All @@ -689,7 +695,7 @@ mod _ssl {
#[allow(dead_code)]
outgoing: PyRef<PyMemoryBIO>,
#[pyarg(named, optional)]
server_side: OptionalArg<bool>,
server_side: OptionalArg<ArgIntoBool>,
#[pyarg(named, optional)]
server_hostname: Option<PyUtf8StrRef>,
#[pyarg(named, optional)]
Expand Down Expand Up @@ -901,7 +907,7 @@ mod _ssl {
}

#[pyfunction]
fn RAND_add(_string: PyObjectRef, _entropy: f64) {}
fn RAND_add(_string: ArgStrOrBytesLike, _entropy: ArgIntoFloat) {}

#[pyfunction]
fn RAND_bytes(n: i32, vm: &VirtualMachine) -> PyResult<PyBytesRef> {
Expand Down
Loading
Loading