#define PY_SSIZE_T_CLEAN

#include "Python.h"

#include "pythread.h"

#define _PySSL_FIX_ERRNO

#define PySSL_BEGIN_ALLOW_THREADS_S(save) \

do { if (_ssl_locks_count>0) { (save) = PyEval_SaveThread(); } } while (0)

#define PySSL_END_ALLOW_THREADS_S(save) \

do { if (_ssl_locks_count>0) { PyEval_RestoreThread(save); } _PySSL_FIX_ERRNO; } while (0)

#define PySSL_BEGIN_ALLOW_THREADS { \

PyThreadState *_save = NULL; \

PySSL_BEGIN_ALLOW_THREADS_S(_save);

#define PySSL_BLOCK_THREADS PySSL_END_ALLOW_THREADS_S(_save);

#define PySSL_UNBLOCK_THREADS PySSL_BEGIN_ALLOW_THREADS_S(_save);

#define PySSL_END_ALLOW_THREADS PySSL_END_ALLOW_THREADS_S(_save); }

#include "socketmodule.h"

static PySocketModule_APIObject PySocketModule;

#if defined(HAVE_POLL_H)

#include <poll.h>

#elif defined(HAVE_SYS_POLL_H)

#include <sys/poll.h>

#ifdef __GNUC__

#pragma GCC diagnostic ignored "-Wdeprecated-declarations"

#ifdef __clang__

#pragma clang diagnostic ignored "-Wdeprecated-declarations"

#include "openssl/rsa.h"

#include "openssl/crypto.h"

#include "openssl/x509.h"

#include "openssl/x509v3.h"

#include "openssl/pem.h"

#include "openssl/ssl.h"

#include "openssl/err.h"

#include "openssl/rand.h"

#include "openssl/bio.h"

#ifndef HAVE_X509_VERIFY_PARAM_SET1_HOST

# ifdef LIBRESSL_VERSION_NUMBER

# error "LibreSSL is missing X509_VERIFY_PARAM_set1_host(), see https://github.com/libressl-portable/portable/issues/381"

# elif OPENSSL_VERSION_NUMBER > 0x1000200fL

# define HAVE_X509_VERIFY_PARAM_SET1_HOST

# error "libssl is too old and does not support X509_VERIFY_PARAM_set1_host()"

static PyObject *PySSLErrorObject;

static PyObject *PySSLCertVerificationErrorObject;

static PyObject *PySSLZeroReturnErrorObject;

static PyObject *PySSLWantReadErrorObject;

static PyObject *PySSLWantWriteErrorObject;

static PyObject *PySSLSyscallErrorObject;

static PyObject *PySSLEOFErrorObject;

static PyObject *err_codes_to_names;

static PyObject *err_names_to_codes;

static PyObject *lib_codes_to_names;

struct py_ssl_error_code {

const char *mnemonic;

int library, reason;

};

struct py_ssl_library_code {

const char *library;

int code;

};

#if defined(MS_WINDOWS) && defined(Py_DEBUG)

static void _PySSLFixErrno(void) {

HMODULE ucrtbase = GetModuleHandleW(L"ucrtbase.dll");

if (!ucrtbase) {

/* If ucrtbase.dll is not loaded but the SSL DLLs are, we likely

return;

}

typedef int *(__stdcall *errno_func)(void);

errno_func ssl_errno = (errno_func)GetProcAddress(ucrtbase, "_errno");

if (ssl_errno) {

errno = *ssl_errno();

*ssl_errno() = 0;

} else {

errno = ENOTRECOVERABLE;

}

}

#undef _PySSL_FIX_ERRNO

#define _PySSL_FIX_ERRNO _PySSLFixErrno()

#include "_ssl_data.h"

#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)

# define OPENSSL_VERSION_1_1 1

# define PY_OPENSSL_1_1_API 1

#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER >= 0x2070000fL

# define PY_OPENSSL_1_1_API 1

#if OPENSSL_VERSION_NUMBER >= 0x10001000L

# define HAVE_TLSv1_2 1

# define HAVE_TLSv1_2 0

#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME

# define HAVE_SNI 1

# define HAVE_SNI 0

#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation

# define HAVE_ALPN 1

# define HAVE_ALPN 0

#ifdef OPENSSL_NO_NEXTPROTONEG

# define HAVE_NPN 0

#elif (OPENSSL_VERSION_NUMBER >= 0x10101000L) && !defined(LIBRESSL_VERSION_NUMBER)

# define HAVE_NPN 0

#elif defined(TLSEXT_TYPE_next_proto_neg)

# define HAVE_NPN 1

# define HAVE_NPN 0

#ifndef INVALID_SOCKET /* MS defines this */

#define INVALID_SOCKET (-1)

#ifndef OPENSSL_VERSION_1_1

#define HAVE_OPENSSL_CRYPTO_LOCK

#if defined(OPENSSL_VERSION_1_1) && !defined(OPENSSL_NO_SSL2)

#define OPENSSL_NO_SSL2

#ifndef PY_OPENSSL_1_1_API

#define TLS_method SSLv23_method

#define TLS_client_method SSLv23_client_method

#define TLS_server_method SSLv23_server_method

static int X509_NAME_ENTRY_set(const X509_NAME_ENTRY *ne)

{

return ne->set;

}

#ifndef OPENSSL_NO_COMP

static int COMP_get_type(const COMP_METHOD *meth)

{

return meth->type;

}

static pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx)

{

return ctx->default_passwd_callback;

}

static void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx)

{

return ctx->default_passwd_callback_userdata;

}

static int X509_OBJECT_get_type(X509_OBJECT *x)

{

return x->type;

}

static X509 *X509_OBJECT_get0_X509(X509_OBJECT *x)

{

return x->data.x509;

}

static int BIO_up_ref(BIO *b)

{

CRYPTO_add(&b->references, 1, CRYPTO_LOCK_BIO);

return 1;

}

static STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *store) {

return store->objs;

}

static int

SSL_SESSION_has_ticket(const SSL_SESSION *s)

{

return (s->tlsext_ticklen > 0) ? 1 : 0;

}

static unsigned long

SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *s)

{

return s->tlsext_tick_lifetime_hint;

}

#endif /* OpenSSL < 1.1.0 or LibreSSL < 2.7.0 */

#ifndef PY_SSL_DEFAULT_CIPHERS

#define PY_SSL_DEFAULT_CIPHERS 1

#if PY_SSL_DEFAULT_CIPHERS == 0

#ifndef PY_SSL_DEFAULT_CIPHER_STRING

#error "Py_SSL_DEFAULT_CIPHERS 0 needs Py_SSL_DEFAULT_CIPHER_STRING"

#endif

#elif PY_SSL_DEFAULT_CIPHERS == 1

#define PY_SSL_DEFAULT_CIPHER_STRING "DEFAULT:!aNULL:!eNULL:!MD5:!3DES:!DES:!RC4:!IDEA:!SEED:!aDSS:!SRP:!PSK"

#elif PY_SSL_DEFAULT_CIPHERS == 2

#define PY_SSL_DEFAULT_CIPHER_STRING SSL_DEFAULT_CIPHER_LIST

#error "Unsupported PY_SSL_DEFAULT_CIPHERS"

enum py_ssl_error {

};

enum py_ssl_server_or_client {

PY_SSL_CLIENT,

PY_SSL_SERVER

};

enum py_ssl_cert_requirements {

};

enum py_ssl_version {

};

enum py_proto_version {

};

static unsigned int _ssl_locks_count = 0;

#define X509_NAME_MAXLEN 256

#if OPENSSL_VERSION_NUMBER >= 0x009080dfL && OPENSSL_VERSION_NUMBER != 0x00909000L

# define HAVE_SSL_CTX_CLEAR_OPTIONS

# undef HAVE_SSL_CTX_CLEAR_OPTIONS

#define PySSL_CB_MAXLEN 128

typedef struct {

PyObject_HEAD

SSL_CTX *ctx;

#if HAVE_NPN

unsigned char *npn_protocols;

int npn_protocols_len;

#if HAVE_ALPN

unsigned char *alpn_protocols;

unsigned int alpn_protocols_len;

#ifndef OPENSSL_NO_TLSEXT

PyObject *set_sni_cb;

int check_hostname;

/* OpenSSL has no API to get hostflags from X509_VERIFY_PARAM* struct.

unsigned int hostflags;

int protocol;

} PySSLContext;

typedef struct {

PyObject_HEAD

PyObject *Socket; /* weakref to socket on which we're layered */

SSL *ssl;

PySSLContext *ctx; /* weakref to SSL context */

char shutdown_seen_zero;

enum py_ssl_server_or_client socket_type;

PyObject *owner; /* Python level "owner" passed to servername callback */

PyObject *server_hostname;

int ssl_errno; /* last seen error from SSL */

int c_errno; /* last seen error from libc */

#ifdef MS_WINDOWS

int ws_errno; /* last seen error from winsock */

} PySSLSocket;

typedef struct {

PyObject_HEAD

BIO *bio;

int eof_written;

} PySSLMemoryBIO;

typedef struct {

PyObject_HEAD

SSL_SESSION *session;

PySSLContext *ctx;

} PySSLSession;

static PyTypeObject PySSLContext_Type;

static PyTypeObject PySSLSocket_Type;

static PyTypeObject PySSLMemoryBIO_Type;

static PyTypeObject PySSLSession_Type;

#ifdef MS_WINDOWS

#define _PySSL_UPDATE_ERRNO_IF(cond, sock, retcode) if (cond) { \

(sock)->ws_errno = WSAGetLastError(); \

_PySSL_FIX_ERRNO; \

(sock)->c_errno = errno; \

(sock)->ssl_errno = SSL_get_error((sock->ssl), (retcode)); \

} else { sock->ws_errno = 0; sock->c_errno = 0; sock->ssl_errno = 0; }

#define _PySSL_UPDATE_ERRNO_IF(cond, sock, retcode) if (cond) { \

(sock)->c_errno = errno; \

(sock)->ssl_errno = SSL_get_error((sock->ssl), (retcode)); \

} else { (sock)->c_errno = 0; (sock)->ssl_errno = 0; }

#define _PySSL_UPDATE_ERRNO(sock, retcode) _PySSL_UPDATE_ERRNO_IF(1, (sock), (retcode))

#include "clinic/_ssl.c.h"

static int PySSL_select(PySocketSockObject *s, int writing, _PyTime_t timeout);

static int PySSL_set_owner(PySSLSocket *, PyObject *, void *);

static int PySSL_set_session(PySSLSocket *, PyObject *, void *);

#define PySSLSocket_Check(v) (Py_TYPE_IS(v, &PySSLSocket_Type))

#define PySSLMemoryBIO_Check(v) (Py_TYPE_IS(v, &PySSLMemoryBIO_Type))

#define PySSLSession_Check(v) (Py_TYPE_IS(v, &PySSLSession_Type))

typedef enum {

SOCKET_IS_NONBLOCKING,

SOCKET_IS_BLOCKING,

SOCKET_HAS_TIMED_OUT,

SOCKET_HAS_BEEN_CLOSED,

SOCKET_TOO_LARGE_FOR_SELECT,

SOCKET_OPERATION_OK

} timeout_state;

#define ERRSTR1(x,y,z) (x ":" y ": " z)

#define ERRSTR(x) ERRSTR1("_ssl.c", Py_STRINGIFY(__LINE__), x)

#define GET_SOCKET(obj) ((obj)->Socket ? \

(PySocketSockObject *) PyWeakref_GetObject((obj)->Socket) : NULL)

#define GET_SOCKET_TIMEOUT(sock) \

((sock != NULL) ? (sock)->sock_timeout : 0)

PyDoc_STRVAR(SSLError_doc,

"An error occurred in the SSL implementation.");

PyDoc_STRVAR(SSLCertVerificationError_doc,

"A certificate could not be verified.");

PyDoc_STRVAR(SSLZeroReturnError_doc,

"SSL/TLS session closed cleanly.");

PyDoc_STRVAR(SSLWantReadError_doc,

"before the requested operation can be completed.");

PyDoc_STRVAR(SSLWantWriteError_doc,

"before the requested operation can be completed.");

PyDoc_STRVAR(SSLSyscallError_doc,

"System error when attempting SSL operation.");

PyDoc_STRVAR(SSLEOFError_doc,

"SSL/TLS connection terminated abruptly.");

static PyObject *

SSLError_str(PyOSErrorObject *self)

{

if (self->strerror != NULL && PyUnicode_Check(self->strerror)) {

Py_INCREF(self->strerror);

return self->strerror;

}

else

return PyObject_Str(self->args);

}

static PyType_Slot sslerror_type_slots[] = {

{Py_tp_base, NULL}, /* Filled out in module init as it's not a constant */

{Py_tp_doc, SSLError_doc},

{Py_tp_str, SSLError_str},

{0, 0},

};

static PyType_Spec sslerror_type_spec = {

"ssl.SSLError",

sizeof(PyOSErrorObject),

0,

Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,

sslerror_type_slots

};

static void

fill_and_set_sslerror(PySSLSocket *sslsock, PyObject *type, int ssl_errno,

const char *errstr, int lineno, unsigned long errcode)

{

PyObject *err_value = NULL, *reason_obj = NULL, *lib_obj = NULL;

PyObject *verify_obj = NULL, *verify_code_obj = NULL;

PyObject *init_value, *msg, *key;

_Py_IDENTIFIER(reason);

_Py_IDENTIFIER(library);

_Py_IDENTIFIER(verify_message);

_Py_IDENTIFIER(verify_code);

if (errcode != 0) {

int lib, reason;

lib = ERR_GET_LIB(errcode);

reason = ERR_GET_REASON(errcode);

key = Py_BuildValue("ii", lib, reason);

if (key == NULL)

goto fail;

reason_obj = PyDict_GetItemRef(err_codes_to_names, key);

Py_DECREF(key);

if (reason_obj == NULL) {

/* XXX if reason < 100, it might reflect a library number (!!) */

PyErr_Clear();

}

key = PyLong_FromLong(lib);

if (key == NULL)

goto fail;

lib_obj = PyDict_GetItemRef(lib_codes_to_names, key);

Py_DECREF(key);

if (lib_obj == NULL) {

PyErr_Clear();

}

if (errstr == NULL)

errstr = ERR_reason_error_string(errcode);

}

if (errstr == NULL)

errstr = "unknown error";

/* verify code for cert validation error */

if ((sslsock != NULL) && (type == PySSLCertVerificationErrorObject)) {

const char *verify_str = NULL;

long verify_code;

verify_code = SSL_get_verify_result(sslsock->ssl);

verify_code_obj = PyLong_FromLong(verify_code);

if (verify_code_obj == NULL) {

goto fail;

}

switch (verify_code) {

#ifdef X509_V_ERR_HOSTNAME_MISMATCH

/* OpenSSL >= 1.0.2, LibreSSL >= 2.5.3 */

case X509_V_ERR_HOSTNAME_MISMATCH:

verify_obj = PyUnicode_FromFormat(

"Hostname mismatch, certificate is not valid for '%S'.",

sslsock->server_hostname

);

break;

#ifdef X509_V_ERR_IP_ADDRESS_MISMATCH

case X509_V_ERR_IP_ADDRESS_MISMATCH:

verify_obj = PyUnicode_FromFormat(

"IP address mismatch, certificate is not valid for '%S'.",

sslsock->server_hostname

);

break;

default:

verify_str = X509_verify_cert_error_string(verify_code);

if (verify_str != NULL) {

verify_obj = PyUnicode_FromString(verify_str);

} else {

verify_obj = Py_None;

Py_INCREF(verify_obj);

}

break;

}

if (verify_obj == NULL) {

goto fail;

}

}

if (verify_obj && reason_obj && lib_obj)

msg = PyUnicode_FromFormat("[%S: %S] %s: %S (_ssl.c:%d)",

lib_obj, reason_obj, errstr, verify_obj,

lineno);

else if (reason_obj && lib_obj)

msg = PyUnicode_FromFormat("[%S: %S] %s (_ssl.c:%d)",

lib_obj, reason_obj, errstr, lineno);

else if (lib_obj)

msg = PyUnicode_FromFormat("[%S] %s (_ssl.c:%d)",

lib_obj, errstr, lineno);

else

msg = PyUnicode_FromFormat("%s (_ssl.c:%d)", errstr, lineno);

if (msg == NULL)

goto fail;

init_value = Py_BuildValue("iN", ssl_errno, msg);

if (init_value == NULL)

goto fail;

err_value = PyObject_CallObject(type, init_value);

Py_DECREF(init_value);

if (err_value == NULL)

goto fail;

if (!reason_obj) {

reason_obj = Py_None;

Py_INCREF(reason_obj);

}

if (_PyObject_SetAttrId(err_value, &PyId_reason, reason_obj))

goto fail;

if (!lib_obj) {

lib_obj = Py_None;

Py_INCREF(lib_obj);

}

if (_PyObject_SetAttrId(err_value, &PyId_library, lib_obj))

goto fail;

if ((sslsock != NULL) && (type == PySSLCertVerificationErrorObject)) {

/* Only set verify code / message for SSLCertVerificationError */

if (_PyObject_SetAttrId(err_value, &PyId_verify_code,

verify_code_obj))

goto fail;

if (_PyObject_SetAttrId(err_value, &PyId_verify_message, verify_obj))

goto fail;

}

PyErr_SetObject(type, err_value);

fail:

Py_XDECREF(reason_obj);

Py_XDECREF(lib_obj);

Py_XDECREF(err_value);

Py_XDECREF(verify_code_obj);

Py_XDECREF(verify_obj);

}

static PyObject *

PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)

{

PyObject *type = PySSLErrorObject;

char *errstr = NULL;

int err;

enum py_ssl_error p = PY_SSL_ERROR_NONE;

unsigned long e = 0;

assert(ret <= 0);

e = ERR_peek_last_error();

if (sslsock->ssl != NULL) {

err = sslsock->ssl_errno;

switch (err) {

case SSL_ERROR_ZERO_RETURN:

errstr = "TLS/SSL connection has been closed (EOF)";

type = PySSLZeroReturnErrorObject;

p = PY_SSL_ERROR_ZERO_RETURN;

break;

case SSL_ERROR_WANT_READ:

errstr = "The operation did not complete (read)";

type = PySSLWantReadErrorObject;

p = PY_SSL_ERROR_WANT_READ;

break;

case SSL_ERROR_WANT_WRITE:

p = PY_SSL_ERROR_WANT_WRITE;

type = PySSLWantWriteErrorObject;

errstr = "The operation did not complete (write)";

break;

case SSL_ERROR_WANT_X509_LOOKUP:

p = PY_SSL_ERROR_WANT_X509_LOOKUP;

errstr = "The operation did not complete (X509 lookup)";

break;

case SSL_ERROR_WANT_CONNECT:

p = PY_SSL_ERROR_WANT_CONNECT;

errstr = "The operation did not complete (connect)";

break;

case SSL_ERROR_SYSCALL:

{

if (e == 0) {

PySocketSockObject *s = GET_SOCKET(sslsock);

if (ret == 0 || (((PyObject *)s) == Py_None)) {

p = PY_SSL_ERROR_EOF;

type = PySSLEOFErrorObject;

errstr = "EOF occurred in violation of protocol";

} else if (s && ret == -1) {

/* underlying BIO reported an I/O error */

ERR_clear_error();

#ifdef MS_WINDOWS

if (sslsock->ws_errno)

return PyErr_SetFromWindowsErr(sslsock->ws_errno);

if (sslsock->c_errno) {

errno = sslsock->c_errno;

return PyErr_SetFromErrno(PyExc_OSError);

}

Py_INCREF(s);

s->errorhandler();

Py_DECREF(s);

return NULL;

} else { /* possible? */

p = PY_SSL_ERROR_SYSCALL;

type = PySSLSyscallErrorObject;

errstr = "Some I/O error occurred";

}

} else {

p = PY_SSL_ERROR_SYSCALL;

}

break;

}

case SSL_ERROR_SSL:

{

p = PY_SSL_ERROR_SSL;

if (e == 0) {

/* possible? */

errstr = "A failure in the SSL library occurred";

}

if (ERR_GET_LIB(e) == ERR_LIB_SSL &&

ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {

type = PySSLCertVerificationErrorObject;

}

break;

}

default:

p = PY_SSL_ERROR_INVALID_ERROR_CODE;

errstr = "Invalid error code";

}

}

fill_and_set_sslerror(sslsock, type, p, errstr, lineno, e);

ERR_clear_error();

return NULL;

}

static PyObject *

_setSSLError (const char *errstr, int errcode, const char *filename, int lineno) {

if (errstr == NULL)

errcode = ERR_peek_last_error();

else

errcode = 0;

fill_and_set_sslerror(NULL, PySSLErrorObject, errcode, errstr, lineno, errcode);

ERR_clear_error();

return NULL;

}

static int

_ssl_configure_hostname(PySSLSocket *self, const char* server_hostname)

{

int retval = -1;

ASN1_OCTET_STRING *ip;

PyObject *hostname;

size_t len;

assert(server_hostname);

/* Disable OpenSSL's special mode with leading dot in hostname:

len = strlen(server_hostname);

if (len == 0 || *server_hostname == '.') {

PyErr_SetString(

PyExc_ValueError,

"server_hostname cannot be an empty string or start with a "

"leading dot.");

return retval;

}

/* inet_pton is not available on all platforms. */

ip = a2i_IPADDRESS(server_hostname);

if (ip == NULL) {

ERR_clear_error();

}

hostname = PyUnicode_Decode(server_hostname, len, "ascii", "strict");

if (hostname == NULL) {

goto error;

}

self->server_hostname = hostname;

/* Only send SNI extension for non-IP hostnames */

if (ip == NULL) {

if (!SSL_set_tlsext_host_name(self->ssl, server_hostname)) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

}

}

if (self->ctx->check_hostname) {

X509_VERIFY_PARAM *param = SSL_get0_param(self->ssl);

if (ip == NULL) {

if (!X509_VERIFY_PARAM_set1_host(param, server_hostname,

strlen(server_hostname))) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto error;

}

} else {

if (!X509_VERIFY_PARAM_set1_ip(param, ASN1_STRING_data(ip),

ASN1_STRING_length(ip))) {

_setSSLError(NULL, 0, __FILE__, __LINE__);

goto error;

}

}

}

retval = 0;

error:

if (ip != NULL) {

ASN1_OCTET_STRING_free(ip);

}

return retval;

}

static PySSLSocket *

newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,

PySSLMemoryBIO *inbio, PySSLMemoryBIO *outbio)

{

PySSLSocket *self;

SSL_CTX *ctx = sslctx->ctx;

self = PyObject_New(PySSLSocket, &PySSLSocket_Type);

if (self == NULL)

return NULL;

self->ssl = NULL;

self->Socket = NULL;

self->ctx = sslctx;

Py_INCREF(sslctx);

self->shutdown_seen_zero = 0;

self->owner = NULL;

self->server_hostname = NULL;

self->ssl_errno = 0;

self->c_errno = 0;

#ifdef MS_WINDOWS

self->ws_errno = 0;

/* Make sure the SSL error state is initialized */

ERR_clear_error();

PySSL_BEGIN_ALLOW_THREADS

self->ssl = SSL_new(ctx);

PySSL_END_ALLOW_THREADS

SSL_set_app_data(self->ssl, self);

if (sock) {

SSL_set_fd(self->ssl, Py_SAFE_DOWNCAST(sock->sock_fd, SOCKET_T, int));

} else {

/* BIOs are reference counted and SSL_set_bio borrows our reference.

BIO_up_ref(inbio->bio);

BIO_up_ref(outbio->bio);

SSL_set_bio(self->ssl, inbio->bio, outbio->bio);

}

SSL_set_mode(self->ssl,

SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER | SSL_MODE_AUTO_RETRY);

if (server_hostname != NULL) {

if (_ssl_configure_hostname(self, server_hostname) < 0) {

Py_DECREF(self);

return NULL;

}

}

/* If the socket is in non-blocking mode or timeout mode, set the BIO

if (sock && sock->sock_timeout >= 0) {

BIO_set_nbio(SSL_get_rbio(self->ssl), 1);

BIO_set_nbio(SSL_get_wbio(self->ssl), 1);

}

PySSL_BEGIN_ALLOW_THREADS

if (socket_type == PY_SSL_CLIENT)

SSL_set_connect_state(self->ssl);

else

SSL_set_accept_state(self->ssl);

PySSL_END_ALLOW_THREADS

self->socket_type = socket_type;

if (sock != NULL) {

self->Socket = PyWeakref_NewRef((PyObject *) sock, NULL);

if (self->Socket == NULL) {

Py_DECREF(self);

return NULL;

}

}

if (owner && owner != Py_None) {

if (PySSL_set_owner(self, owner, NULL) == -1) {

Py_DECREF(self);

return NULL;

}

}

if (session && session != Py_None) {

if (PySSL_set_session(self, session, NULL) == -1) {

Py_DECREF(self);

return NULL;

}

}

return self;

}

static PyObject *

_ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)

{

int ret;

int err;

int sockstate, nonblocking;

PySocketSockObject *sock = GET_SOCKET(self);

_PyTime_t timeout, deadline = 0;

int has_timeout;

if (sock) {

if (((PyObject*)sock) == Py_None) {

_setSSLError("Underlying socket connection gone",

PY_SSL_ERROR_NO_SOCKET, __FILE__, __LINE__);

return NULL;

}

Py_INCREF(sock);

/* just in case the blocking state of the socket has been changed */

nonblocking = (sock->sock_timeout >= 0);

BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);