Skip to content

Commit 2bb523a

Browse files
youknowoneyouknowone
committed
apply review
1 parent c9c754f commit 2bb523a

File tree

5 files changed

+25
-39
lines changed

5 files changed

+25
-39
lines changed

‎src/lib.rs‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,14 @@ pub use rustpython_vm as vm;
5959
pub use settings::{InstallPipMode, RunMode, parse_opts};
6060
pub use shell::run_shell;
6161

62+
#[cfg(all(
63+
feature = "ssl",
64+
not(any(feature = "ssl-rustls", feature = "ssl-openssl"))
65+
))]
66+
compile_error!(
67+
"Feature \"ssl\" is now enabled by either \"ssl-rustls\" or \"ssl-openssl\" to be enabled. Do not manually pass \"ssl\" feature. To enable ssl-openssl, use --no-default-features to disable ssl-rustls"
68+
);
69+
6270
/// The main cli of the `rustpython` interpreter. This function will return `std::process::ExitCode`
6371
/// based on the return code of the python code ran through the cli.
6472
pub fn run(init: impl FnOnce(&mut VirtualMachine) + 'static) -> ExitCode {
@@ -141,12 +149,7 @@ __import__("io").TextIOWrapper(
141149
}
142150

143151
fn install_pip(installer: InstallPipMode, scope: Scope, vm: &VirtualMachine) -> PyResult<()> {
144-
if cfg!(feature = "ssl") {
145-
#[cfg(not(any(feature = "ssl-rustls", feature = "ssl-openssl")))]
146-
compile_error!(
147-
"Feature \"ssl\" is now enabled by either \"ssl-rustls\" or \"ssl-openssl\" to be enabled. Do not manually pass \"ssl\" feature. To enable ssl-openssl, use --no-default-features to disable ssl-rustls"
148-
);
149-
} else {
152+
if !cfg!(feature = "ssl") {
150153
return Err(vm.new_exception_msg(
151154
vm.ctx.exceptions.system_error.to_owned(),
152155
"install-pip requires rustpython be build with '--features=ssl'".to_owned(),

‎stdlib/src/openssl.rs‎

Lines changed: 5 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -834,8 +834,6 @@ mod _ssl {
834834
post_handshake_auth: PyMutex<bool>,
835835
sni_callback: PyMutex<Option<PyObjectRef>>,
836836
msg_callback: PyMutex<Option<PyObjectRef>>,
837-
psk_client_callback: PyMutex<Option<PyObjectRef>>,
838-
psk_server_callback: PyMutex<Option<PyObjectRef>>,
839837
}
840838

841839
impl fmt::Debug for PySslContext {
@@ -940,8 +938,6 @@ mod _ssl {
940938
post_handshake_auth: PyMutex::new(false),
941939
sni_callback: PyMutex::new(None),
942940
msg_callback: PyMutex::new(None),
943-
psk_client_callback: PyMutex::new(None),
944-
psk_server_callback: PyMutex::new(None),
945941
}
946942
.into_ref_with_type(vm, cls)
947943
.map(Into::into)
@@ -1670,8 +1666,6 @@ mod _ssl {
16701666
ctx_ref: PyRef<PySslContext>,
16711667
server_side: bool,
16721668
server_hostname: Option<PyStrRef>,
1673-
owner: Option<PyObjectRef>,
1674-
session: Option<PyObjectRef>,
16751669
vm: &VirtualMachine,
16761670
) -> PyResult<(ssl::Ssl, SslServerOrClient, Option<PyStrRef>)> {
16771671
// Validate socket type and context protocol
@@ -1778,14 +1772,8 @@ mod _ssl {
17781772
vm: &VirtualMachine,
17791773
) -> PyResult<PyObjectRef> {
17801774
// Use common helper function
1781-
let (ssl, socket_type, server_hostname) = Self::new_py_ssl_socket(
1782-
zelf.clone(),
1783-
args.server_side,
1784-
args.server_hostname,
1785-
args.owner.clone(),
1786-
args.session.clone(),
1787-
vm,
1788-
)?;
1775+
let (ssl, socket_type, server_hostname) =
1776+
Self::new_py_ssl_socket(zelf.clone(), args.server_side, args.server_hostname, vm)?;
17891777

17901778
// Create SslStream with socket
17911779
let stream = ssl::SslStream::new(ssl, SocketStream(args.sock.clone()))
@@ -1838,14 +1826,8 @@ mod _ssl {
18381826
vm: &VirtualMachine,
18391827
) -> PyResult<PyObjectRef> {
18401828
// Use common helper function
1841-
let (ssl, socket_type, server_hostname) = Self::new_py_ssl_socket(
1842-
zelf.clone(),
1843-
args.server_side,
1844-
args.server_hostname,
1845-
args.owner.clone(),
1846-
args.session.clone(),
1847-
vm,
1848-
)?;
1829+
let (ssl, socket_type, server_hostname) =
1830+
Self::new_py_ssl_socket(zelf.clone(), args.server_side, args.server_hostname, vm)?;
18491831

18501832
// Create BioStream wrapper
18511833
let bio_stream = BioStream {
@@ -2891,6 +2873,7 @@ mod _ssl {
28912873
}
28922874

28932875
// Message callback type
2876+
#[allow(non_camel_case_types)]
28942877
type SSL_CTX_msg_callback = Option<
28952878
unsafe extern "C" fn(
28962879
write_p: libc::c_int,
@@ -3059,18 +3042,12 @@ mod _ssl {
30593042
// These are typically macros in OpenSSL, implemented via BIO_ctrl
30603043
const BIO_CTRL_PENDING: libc::c_int = 10;
30613044
const BIO_CTRL_SET_EOF: libc::c_int = 2;
3062-
const BIO_CTRL_EOF: libc::c_int = 2;
30633045

30643046
#[allow(non_snake_case)]
30653047
unsafe fn BIO_ctrl_pending(bio: *mut sys::BIO) -> usize {
30663048
unsafe { sys::BIO_ctrl(bio, BIO_CTRL_PENDING, 0, std::ptr::null_mut()) as usize }
30673049
}
30683050

3069-
#[allow(non_snake_case)]
3070-
unsafe fn BIO_eof(bio: *mut sys::BIO) -> libc::c_int {
3071-
unsafe { sys::BIO_ctrl(bio, BIO_CTRL_EOF, 0, std::ptr::null_mut()) as libc::c_int }
3072-
}
3073-
30743051
#[allow(non_snake_case)]
30753052
unsafe fn BIO_set_mem_eof_return(bio: *mut sys::BIO, eof: libc::c_int) -> libc::c_int {
30763053
unsafe {

‎stdlib/src/openssl/cert.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,15 +74,15 @@ pub(crate) mod ssl_cert {
7474
let format = format.unwrap_or(ENCODING_PEM);
7575

7676
match format {
77-
x if x == ENCODING_DER => {
77+
ENCODING_DER => {
7878
// DER encoding
7979
let der = self
8080
.cert
8181
.to_der()
8282
.map_err(|e| convert_openssl_error(vm, e))?;
8383
Ok(vm.ctx.new_bytes(der).into())
8484
}
85-
x if x == ENCODING_PEM => {
85+
ENCODING_PEM => {
8686
// PEM encoding
8787
let pem = self
8888
.cert

‎stdlib/src/ssl/cert.rs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ use std::collections::HashSet;
2222
use std::sync::Arc;
2323
use x509_parser::prelude::*;
2424

25+
use super::compat::VERIFY_X509_STRICT;
26+
2527
// Error Handling Utilities
2628

2729
/// Certificate loading error types with specific error messages
@@ -1306,7 +1308,6 @@ impl ServerCertVerifier for StrictCertVerifier {
13061308
)?;
13071309

13081310
// If VERIFY_X509_STRICT flag is set, perform additional validation
1309-
const VERIFY_X509_STRICT: i32 = 0x00000020;
13101311
if self.verify_flags & VERIFY_X509_STRICT != 0 {
13111312
// Check end entity certificate for AKI
13121313
// RFC 5280 Section 4.2.1.1: self-signed certificates are exempt from AKI requirement

‎stdlib/src/ssl/compat.rs‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ use super::_ssl::{
3535
create_ssl_want_read_error, create_ssl_want_write_error, create_ssl_zero_return_error,
3636
};
3737

38+
// SSL Verification Flags
39+
/// VERIFY_X509_STRICT flag for RFC 5280 strict compliance
40+
/// When set, performs additional validation including AKI extension checks
41+
pub const VERIFY_X509_STRICT: i32 = 0x20;
42+
3843
// CryptoProvider Initialization:
3944

4045
/// Ensure the default CryptoProvider is installed (thread-safe, runs once)
@@ -809,8 +814,8 @@ fn apply_verifier_wrappers(
809814
verifier
810815
};
811816

812-
// Wrap with StrictCertVerifier if other verify_flags are set
813-
if verify_flags != 0 {
817+
// Wrap with StrictCertVerifier if VERIFY_X509_STRICT flag is set
818+
if verify_flags & VERIFY_X509_STRICT != 0 {
814819
Arc::new(super::cert::StrictCertVerifier::new(verifier, verify_flags))
815820
} else {
816821
verifier

0 commit comments

Comments
 (0)