Merge pull request #24 from LinuxJedi/update-wolfssl

dgarske · web-flow · commit 3c928b113778 · 2022-02-07T11:18:17.000-08:00
Update wolfSSL to 5.1.1 and fix any issues
diff --git a/.gitignore b/.gitignore
@@ -16,7 +16,6 @@ dist/
 downloads/
 eggs/
 .eggs/
-lib/
 lib64/
 parts/
 sdist/
diff --git a/.gitmodules b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "lib/wolfssl"]
+	path = lib/wolfssl
+	url = https://github.com/wolfssl/wolfssl
diff --git a/Makefile b/Makefile
@@ -33,8 +33,10 @@ clean-build: ## remove build artifacts
 	rm -fr build/
 	rm -fr dist/
 	rm -fr .eggs/
+	rm -fr wolfssl/_ffi*
 	find . -name '*.egg-info' -exec rm -fr {} +
 	find . -name '*.egg' -exec rm -f {} +
+	-cd lib/wolfssl && make clean
 
 clean-pyc: ## remove Python file artifacts
 	find . -name '*.pyc' -exec rm -f {} +
@@ -81,7 +83,7 @@ servedocs: docs ## compile the docs watching for changes
 
 dist: clean ## builds source and wheel package
 	python setup.py sdist
-	
+
 	./make/osx/build_wheels.sh
 
 	./make/manylinux1/build_wheels.sh
diff --git a/README.rst b/README.rst
@@ -13,6 +13,16 @@ library targeted at IoT, embedded, and RTOS environments primarily because of
 its size, speed, and feature set. It works seamlessly in desktop, enterprise,
 and cloud environments as well.
 
+Compiling
+=========
+
+The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or pip. You'll also need the Python development package for your Python version:
+
+* `cffi`
+* `tox`
+* `pytest`
+
+To build a source package run `python setup.py sdist`, to build a wheel package run `python setup.py bdist_wheel`. To test the build run `tox`. The `tox` tests rely on Python 3.9 being installed, if you do not have this version we recommend using `pyenv` to install it.
 
 Installation
 ============
@@ -35,7 +45,7 @@ The default pip install clones wolfSSL from GitHub. To build wolfssl-py using a
 local installation of the native wolfSSL C library, the USE_LOCAL_WOLFSSL
 environment variable should be set.  USE_LOCAL_WOLFSSL can be set to "1" to use
 the default library installation location (/usr/local/lib, /usr/local/include),
-or to use a custom location it can be set to the install locaiton of your native
+or to use a custom location it can be set to the install location of your native
 wolfSSL library.  For example:
 
 .. code-block:: bash
diff --git a/certs/ca-digicert-ev.pem b/certs/ca-digicert-ev.pem
diff --git a/certs/ca-globalsign-r3.pem b/certs/ca-globalsign-r3.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
+A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
+Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
+MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG
+A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8
+RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT
+gHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm
+KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd
+QQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ
+XriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw
+DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o
+LkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU
+RUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp
+jjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK
+6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX
+mcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs
+Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
+WD9f
+-----END CERTIFICATE-----
diff --git a/docs/usage.rst b/docs/usage.rst
@@ -16,7 +16,7 @@ Note 1:
     time and resources.
 
 Note 2:
-    Each path provides its own options for fine-tuning the securint parameters.
+    Each path provides its own options for fine-tuning the security parameters.
     Check them out in the API documentation.
 
 
diff --git a/lib/wolfssl b/lib/wolfssl
@@ -0,0 +1 @@
+Subproject commit c3513bf2573c30f6d2df815de216120e92142020
diff --git a/setup.py b/setup.py
@@ -27,10 +27,6 @@
 from setuptools.command.build_ext import build_ext
 
 
-# Adding src folder to the include path in order to import from wolfssl
-package_dir = os.path.join(os.path.dirname(__file__), "src")
-sys.path.insert(0, package_dir)
-
 import wolfssl
 from wolfssl._build_wolfssl import build_wolfssl
 from wolfssl._build_wolfssl import wolfssl_inc_path, wolfssl_lib_path
@@ -90,10 +86,9 @@ def build_extension(self, ext):
     license=wolfssl.__license__,
 
     packages=["wolfssl"],
-    package_dir={"":package_dir},
 
     zip_safe=False,
-    cffi_modules=["./src/wolfssl/_build_ffi.py:ffi"],
+    cffi_modules=["./wolfssl/_build_ffi.py:ffi"],
 
     keywords="wolfssl, wolfcrypt, security, cryptography",
     classifiers=[
diff --git a/tests/test_client.py b/tests/test_client.py
@@ -27,12 +27,13 @@
 
 HOST = "www.python.org"
 PORT = 443
-CA_CERTS = "certs/ca-digicert-ev.pem"
+CA_CERTS = "certs/ca-globalsign-r3.pem"
 
 
 @pytest.fixture(
     params=["wrap_socket", "wrap_socket_with_ca",
             "wrap_socket_from_context", "ssl_socket"])
+
 def secure_socket(request, ssl_provider, tcp_socket):
     sock = None
 
@@ -64,7 +65,6 @@ def secure_socket(request, ssl_provider, tcp_socket):
         yield sock
         sock.close()
 
-
 def test_secure_connection(secure_socket):
     secure_socket.connect((HOST, PORT))
 
diff --git a/tox.ini b/tox.ini
@@ -1,6 +1,5 @@
 [tox]
-envlist = py27, py34, py35, py36
-skip_missing_interpreters = true
+envlist = py3
 
 [testenv]
 setenv =
diff --git a/wolfssl/__about__.py b/wolfssl/__about__.py
@@ -26,7 +26,7 @@
 
 # When bumping the C library version, reset the POST count to 0
 
-__wolfssl_version__ = "v4.8.1-stable"
+__wolfssl_version__ = "v5.1.1-stable"
 
 # We're using implicit post releases [PEP 440] to bump package version
 # while maintaining the C library version intact for better reference.
diff --git a/wolfssl/__init__.py b/wolfssl/__init__.py
@@ -50,8 +50,8 @@
 
 from wolfssl._methods import (  # noqa: F401
     PROTOCOL_SSLv23, PROTOCOL_SSLv3, PROTOCOL_TLSv1,
-    PROTOCOL_TLSv1_1, PROTOCOL_TLSv1_2, PROTOCOL_TLS,
-    WolfSSLMethod as _WolfSSLMethod
+    PROTOCOL_TLSv1_1, PROTOCOL_TLSv1_2, PROTOCOL_TLSv1_3,
+    PROTOCOL_TLS, WolfSSLMethod as _WolfSSLMethod
 )
 
 CERT_NONE = 0
@@ -138,6 +138,7 @@ class SSLContext(object):
     """
 
     def __init__(self, protocol, server_side=None):
+        _lib.wolfSSL_Init()
         method = _WolfSSLMethod(protocol, server_side)
 
         self.protocol = protocol
@@ -154,7 +155,7 @@ def __init__(self, protocol, server_side=None):
         method.native_object = _ffi.NULL
 
         if self.native_object == _ffi.NULL:
-            raise MemoryError("Unnable to allocate context object")
+            raise MemoryError("Unable to allocate context object")
 
         # verify_mode initialization needs a valid native_object.
         self.verify_mode = CERT_NONE
@@ -437,12 +438,12 @@ def __init__(self, sock=None, keyfile=None, certfile=None,
         # create the SSL object
         self.native_object = _lib.wolfSSL_new(self.context.native_object)
         if self.native_object == _ffi.NULL:
-            raise MemoryError("Unnable to allocate ssl object")
+            raise MemoryError("Unable to allocate ssl object")
 
         ret = _lib.wolfSSL_set_fd(self.native_object, self._sock.fileno())
         if ret != _SSL_SUCCESS:
             self._release_native_object()
-            raise ValueError("Unnable to set fd to ssl object")
+            raise ValueError("Unable to set fd to ssl object")
 
         # match domain name / host name if set in context
         if server_hostname is not None:
@@ -806,7 +807,7 @@ def getpeercert(self, binary_form=False):
                 'subjectAltName': x509.get_altnames() }
 
     # The following functions expose functionality of the underlying
-    # Socket object. These are also expsed through Python's ssl module
+    # Socket object. These are also exposed through Python's ssl module
     # API and are provided here for compatibility.
     def close(self):
         self._sock.close()
@@ -903,10 +904,6 @@ def wrap_socket(sock, keyfile=None, certfile=None, server_side=False,
         Which connections succeed will vary depending on the versions of the
         ssl providers on both sides of the communication.
 
-    Note 2:
-        For TLS 1.3 connections use PROTOCOL_TLS as there is no dedicated
-        PROTOCOL constant for just TLS 1.3.
-
     The ciphers parameter sets the available ciphers for this SSL object. It
     should be a string in the wolfSSL cipher list format.
 
diff --git a/wolfssl/_build_ffi.py b/wolfssl/_build_ffi.py
@@ -24,14 +24,17 @@
 
 from distutils.util import get_platform
 from cffi import FFI
-from wolfssl._build_wolfssl import wolfssl_inc_path, wolfssl_lib_path
+from wolfssl._build_wolfssl import wolfssl_inc_path, wolfssl_lib_path, ensure_wolfssl_src, make, make_flags, local_path
+from wolfssl.__about__ import __wolfssl_version__ as version
 import wolfssl._openssl as openssl
 import subprocess
 import shlex
 import os
 from ctypes import cdll
 from collections import namedtuple
 
+libwolfssl_path = ""
+
 def make_optional_func_list(libwolfssl_path, funcs):
     if libwolfssl_path.endswith(".so"):
         libwolfssl = cdll.LoadLibrary(libwolfssl_path)
@@ -52,12 +55,26 @@ def make_optional_func_list(libwolfssl_path, funcs):
 
     return defined
 
-libwolfssl_path = os.path.join(wolfssl_lib_path(), "libwolfssl.a")
-if not os.path.exists(libwolfssl_path):
-    libwolfssl_path = os.path.join(wolfssl_lib_path(), "libwolfssl.so")
+def get_libwolfssl():
+    libwolfssl_path = os.path.join(wolfssl_lib_path(), "libwolfssl.a")
     if not os.path.exists(libwolfssl_path):
-        err = "Couldn't find libwolfssl under {}.".format(wolfssl_lib_path())
-        raise Exception(err)
+        libwolfssl_path = os.path.join(wolfssl_lib_path(), "libwolfssl.so")
+        if not os.path.exists(libwolfssl_path):
+            return 0
+        else:
+            return 1
+    else:
+        return 1
+
+def generate_libwolfssl():
+    ensure_wolfssl_src(version)
+    prefix = local_path("lib/wolfssl/{}/{}".format(
+        get_platform(), version))
+    make(make_flags(prefix, False))
+
+if get_libwolfssl() == 0:
+    generate_libwolfssl()
+    get_libwolfssl()
 
 WolfFunction = namedtuple("WolfFunction", ["name", "native_sig", "ossl_sig"])
 # Depending on how wolfSSL was configured, the functions below may or may not be
@@ -175,6 +192,7 @@ def make_optional_func_list(libwolfssl_path, funcs):
     /**
      * SSL/TLS Session functions
      */
+    void wolfSSL_Init();
     WOLFSSL* wolfSSL_new(WOLFSSL_CTX*);
     void  wolfSSL_free(WOLFSSL*);
 
@@ -276,5 +294,4 @@ def make_optional_func_list(libwolfssl_path, funcs):
 ffi_cdef = cdef + openssl.construct_cdef(optional_funcs)
 ffi.cdef(ffi_cdef)
 
-if __name__ == "__main__":
-    ffi.compile(verbose=True)
+ffi.compile(verbose=True)
diff --git a/wolfssl/_build_wolfssl.py b/wolfssl/_build_wolfssl.py
@@ -30,19 +30,17 @@
 def local_path(path):
     """ Return path relative to the root of this project
     """
-    current = os.path.dirname(__file__)
-    gparent = os.path.dirname(os.path.dirname(current))
-    return os.path.abspath(os.path.join(gparent, path))
+    current = os.path.abspath(os.getcwd())
+    return os.path.abspath(os.path.join(current, path))
 
 
-WOLFSSL_GIT_ADDR = "https://github.com/wolfssl/wolfssl.git"
-WOLFSSL_SRC_PATH = local_path("lib/wolfssl/src")
+WOLFSSL_SRC_PATH = local_path("lib/wolfssl")
 
 
 def wolfssl_inc_path():
     wolfssl_path = os.environ.get("USE_LOCAL_WOLFSSL")
     if wolfssl_path is None:
-        return local_path("lib/wolfssl/src")
+        return local_path("lib/wolfssl")
     else:
         if os.path.isdir(wolfssl_path) and os.path.exists(wolfssl_path):
             return wolfssl_path + "/include"
@@ -87,20 +85,17 @@ def chdir(new_path, mkdir=False):
         os.chdir(old_path)
 
 
-def clone_wolfssl(ref):
-    """ Clone wolfSSL C library repository
-    """
-    call("git clone --depth=1 --branch={} {} {}".format(
-        ref, WOLFSSL_GIT_ADDR, WOLFSSL_SRC_PATH))
-
-
 def checkout_ref(ref):
     """ Ensure that we have the right version
     """
     with chdir(WOLFSSL_SRC_PATH):
-        current = subprocess.check_output(
-            ["git", "describe", "--all", "--exact-match"]
-        ).strip().decode().split('/')[-1]
+        current = ""
+        try:
+            current = subprocess.check_output(
+                ["git", "describe", "--all", "--exact-match"]
+            ).strip().decode().split('/')[-1]
+        except:
+            pass
 
         if current != ref:
             tags = subprocess.check_output(
@@ -120,9 +115,13 @@ def checkout_ref(ref):
 def ensure_wolfssl_src(ref):
     """ Ensure that wolfssl sources are presents and up-to-date
     """
-    if not os.path.isdir(WOLFSSL_SRC_PATH):
-        clone_wolfssl(ref)
-        return True
+    if not os.path.isdir("lib"):
+        os.mkdir("lib")
+        with chdir("lib"):
+            subprocess.run(["git", "clone", "--depth=1", "https://github.com/wolfssl/wolfssl"])
+
+    if not os.path.isdir(os.path.join(WOLFSSL_SRC_PATH, "wolfssl")):
+        subprocess.run(["git", "submodule", "update", "--init", "--depth=1"])
 
     return checkout_ref(ref)
 
@@ -145,6 +144,7 @@ def make_flags(prefix, debug):
 
     # tls 1.3
     flags.append("--enable-tls13")
+    flags.append("--enable-sslv3")
 
     # for urllib3 - requires SNI (tlsx), options (openssl compat), peer cert
     flags.append("--enable-tlsx")
diff --git a/wolfssl/_methods.py b/wolfssl/_methods.py
diff --git a/wolfssl/_openssl.py b/wolfssl/_openssl.py
diff --git a/wolfssl/exceptions.py b/wolfssl/exceptions.py
diff --git a/wolfssl/utils.py b/wolfssl/utils.py

-Original file line number
+Diff line change
 downloads/
 eggs/
 .eggs/
 -lib/
 lib64/
 parts/
 sdist/
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+[submodule "lib/wolfssl"]`
	`2`	`+ path = lib/wolfssl`
	`3`	`+ url = https://github.com/wolfssl/wolfssl`