正在检索具有ctypes的本机基类的地址

Question

我希望能够将证书传递到Python的ssl库，而不需要临时文件。Python ssl模块似乎无法做到这一点。

为了解决这个问题，我想从本机_ssl模块中检索存储在ssl._ssl._SSLContext类中的底层SSL_CTX结构。然后，使用ctypes，我可以使用该上下文从libssl手动调用相应的SSL_CTX_*函数。这里展示了如何在C中做到这一点，我也会通过ctypes做同样的事情。

不幸的是，我陷入了从ssl._ssl._SSLContext挂接load_verify_locations函数的困境，但似乎无法获得ssl._ssl._SSLContext结构实例的正确内存地址。load_verify_locations函数所看到的只是父对象ssl.SSLContext。

我的问题是，如何从ssl.SSLContext对象的实例获取本机基类ssl._ssl._SSLContext的内存？如果我愿意的话，我可以很容易地访问它的ctx成员。

这是我迄今为止的代码。Lincoln Clarette 的禁果项目获得了如何对本地Python模块进行猴痘编程的学分

Py_ssize_t = hasattr(ctypes.pythonapi, 'Py_InitModule4_64') and ctypes.c_int64 or ctypes.c_int
class PyObject(ctypes.Structure):
pass
PyObject._fields_ = [
('ob_refcnt', Py_ssize_t),
('ob_type', ctypes.POINTER(PyObject)),
]
class SlotsProxy(PyObject):
_fields_ = [('dict', ctypes.POINTER(PyObject))]
class PySSLContext(ctypes.Structure):
pass
PySSLContext._fields_ = [
('ob_refcnt', Py_ssize_t),
('ob_type', ctypes.POINTER(PySSLContext)),
('ctx', ctypes.c_void_p),
]
name = ssl._ssl._SSLContext.__name__
target = ssl._ssl._SSLContext.__dict__
proxy_dict = SlotsProxy.from_address(id(target))
namespace = {}
ctypes.pythonapi.PyDict_SetItem(
ctypes.py_object(namespace),
ctypes.py_object(name),
proxy_dict.dict,
)
patchable = namespace[name]
old_value = patchable["load_verify_locations"]
libssl = ctypes.cdll.LoadLibrary("libssl.so.1.0.0")
libssl.SSL_CTX_set_verify.argtypes = (ctypes.c_void_p, ctypes.c_int, ctypes.c_void_p)
libssl.SSL_CTX_get_verify_mode.argtypes = (ctypes.c_void_p,)
def load_verify_locations(self, cafile, capath, cadata):
print(self)
print(self.verify_mode)
addr = PySSLContext.from_address(id(self)).ctx
libssl.SSL_CTX_set_verify(addr, 1337, None)
print(libssl.SSL_CTX_get_verify_mode(addr))
print(self.verify_mode)
return old_value(self, cafile, capath, cadata)
patchable["load_verify_locations"] = load_verify_locations
context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)

输出为：

<ssl.SSLContext object at 0x7f4b81304ba8>
2
1337
2

这表明，我所更改的不是Python所知道的ssl上下文，而是其他一些随机内存位置。

要试用上面的代码，您必须运行https服务器。使用生成自签名SSL证书

$ openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -subj '/CN=localhost' -nodes

并使用以下代码启动服务器：

import http.server, http.server
import ssl
httpd = http.server.HTTPServer(('localhost', 4443), http.server.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket, certfile='cert.pem', keyfile='key.pem', server_side=True)
httpd.serve_forever()

然后在上面示例代码的末尾添加以下行：

urllib.request.urlopen("https://localhost:4443", context=context)

Answer 1

实际SSLContext答案即将到来，该假设不再正确。

请参阅https://docs.python.org/3/library/ssl.html#ssl.SSLContext.load_verify_locations

还有第三个论点，cadata

cadata对象(如果存在)是一个或更多PEM编码的证书或DER编码的类似字节的对象证书。

显然，自Python 3.4 以来就是这样

获取底层PyObject上下文

这很简单，ssl.SSLContext继承了_ssl._SSLContext，在Python数据模型中，这意味着在一个内存地址上只有一个对象。

因此，ssl.SSLContext().load_verify_locations(...)实际上会调用：

ctx = 
ssl.SSLContext.__new__(<type ssl.SSLContext>, ...)  # which calls
self = _ssl._SSLContext.__new__(<type ssl.SSLContext>, ...)  # which calls
<type ssl.SSLContext>->tp_alloc()  # which understands inheritance
self->ctx = SSL_CTX_new(...)  # _ssl fields
self.set_ciphers(...)  # ssl fields
return self
_ssl._SSLContext.load_verify_locations(ctx, ...)`.

C实现会得到一个类型看似错误的对象，但这没关系，因为所有期望的字段都在那里，因为它是由泛型type->tp_alloc分配的，字段首先由_ssl._SSLContext填充，然后由ssl.SSLContext填充。

这里有一个演示(省略了乏味的细节)：

# _parent.c
typedef struct {
PyObject_HEAD
} PyParent;
static PyObject* parent_new(PyTypeObject* type, PyObject* args,
PyObject* kwargs) {
PyParent* self = (PyParent*)type->tp_alloc(type, 0);
printf("Created parent %ldn", (long)self);
return (PyObject*)self;
}
# child.py
class Child(_parent.Parent):
def foo(self):
print(id(self))
c1 = Child()
print("Created child:", id(c1))
# prints:
Created parent 139990593076080
Created child: 139990593076080

获取底层OpenSSL上下文

typedef struct {
PyObject_HEAD
SSL_CTX *ctx;
<details skipped>
} PySSLContext;

因此，ctx处于已知偏移处，该偏移为：

PyObject_HEAD
This is a macro which expands to the declarations of the fields of the PyObject type; it is used when declaring new types which represent objects without a varying length. The specific fields it expands to depend on the definition of Py_TRACE_REFS. By default, that macro is not defined, and PyObject_HEAD expands to:
Py_ssize_t ob_refcnt;
PyTypeObject *ob_type;
When Py_TRACE_REFS is defined, it expands to:
PyObject *_ob_next, *_ob_prev;
Py_ssize_t ob_refcnt;
PyTypeObject *ob_type;

因此，在生产(非调试)构建中，考虑到自然对齐，PySSLContext变为：

struct {
void*;
void*;
SSL_CTX *ctx;
...
}

因此：

_ctx = _ssl._SSLContext(2)
c_ctx = ctypes.cast(id(_ctx), ctypes.POINTER(ctypes.c_void_p))
c_ctx[:3]
[1, 140486908969728, 94916219331584]
# refcnt,      type,          C ctx

把它们放在一起

import ssl
import socket
import ctypes
import pytest

def contact_github(cafile=""):
ctx = ssl.SSLContext()
ctx.verify_mode = ssl.VerifyMode.CERT_REQUIRED
# ctx.load_verify_locations(cafile, "empty", None) done via ctypes
ssl_ctx = ctypes.cast(id(ctx), ctypes.POINTER(ctypes.c_void_p))[2]
cssl = ctypes.CDLL("/usr/lib/x86_64-linux-gnu/libssl.so.1.1")
cssl.SSL_CTX_load_verify_locations.argtypes = [ctypes.c_void_p, ctypes.c_char_p, ctypes.c_char_p]
assert cssl.SSL_CTX_load_verify_locations(ssl_ctx, cafile.encode("utf-8"), b"empty")
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("github.com", 443))
ss = ctx.wrap_socket(s)
ss.send(b"GET / HTTP/1.0nn")
print(ss.recv(1024))

def test_wrong_cert():
with pytest.raises(ssl.SSLError):
contact_github(cafile="bad-cert.pem")

def test_correct_cert():
contact_github(cafile="good-cert.pem")