Add support for a subset of pyOpenSSL 19.0.0. #69
Conversation
| + `cd ../../..` to get back to the root directory. | ||
| + Run the tests (all should pass): | ||
| + `python -m ndg.httpsclient.test.test_https`. | ||
| + `python -m ndg.httpsclient.test.test_urllib2`. |
There was a problem hiding this comment.
All tests passed for me but for some reason this one didn't exit. I needed to interrupt manually. Any idea why this might be and if this may be an error?
There was a problem hiding this comment.
Huh, no ideas right now, but I'll try the tests again and see if I notice the same thing. If so, will debug.
There was a problem hiding this comment.
Specifically, the subset needed to support the Python module ndg_httpsclient.
haydenroche5
force-pushed
the
pyopenssl
branch
from
c0a14f0
to
002f510
Compare
| + # _from_raw_x509_ptr has code to call X509_free on the X509 | ||
| + # object when it's time to do garbage collection. With wolfSSL, | ||
| + # when that X509_free call happens, it's possible that the X509 | ||
| + # object has already been freed by FreeX509 (an internal | ||
| + # function). That function doesn't care what the reference count | ||
| + # is and does the free unconditionally. This causes problems | ||
| + # when the garbage collector comes along and tries to free the | ||
| + # already freed X509. The solution for the wolfSSL case is to | ||
| + # duplicate the object rather than fiddling with the ref count. | ||
| + x509_copy = _lib.X509_dup(x509) | ||
| + cert = X509._from_raw_x509_ptr(x509_copy) |
There was a problem hiding this comment.
All calls to FreeX509 should be changed to wolfSSL_X509_free. Leaving it like this is just going to cause problems down the line. I've found the following calls. Please change all calls to wolfSSL_X509_free. Then this section should not need a wolfSSL exception.
$ grep -rP '[^_]FreeX509\(' --include=*.[ch]
wolfssl/internal.h: WOLFSSL_LOCAL void FreeX509(WOLFSSL_X509*);
src/ssl.c: FreeX509(&ssl->peerCert);
src/ssl.c:static void ExternalFreeX509(WOLFSSL_X509* x509)
src/ssl.c: FreeX509(x509);
src/ssl.c: ExternalFreeX509(x509);
src/internal.c:void FreeX509(WOLFSSL_X509* x509)
src/internal.c: FreeX509(&ssl->peerCert);
src/internal.c: FreeX509(x509);
src/internal.c: FreeX509(x509);
src/internal.c: FreeX509(&ssl->peerCert);
src/internal.c: FreeX509(&ssl->peerCert);
There was a problem hiding this comment.
Obviously only ExternalFreeX509 should be calling FreeX509 (which means that FreeX509 could be a static function in ssl.c.
There was a problem hiding this comment.
Makes sense to me. I'll create a wolfSSL PR today or Monday doing that (I'm off tomorrow).
Specifically, the subset needed to support the Python module ndg_httpsclient.