Move POW extension module into rpkid directory and use distutils to

build it.

svn path=/configure; revision=3610

1 files changed, 0 insertions, 8564 deletions

diff --git a/pow/POW.c b/pow/POW.c
deleted file mode 100644
index 666a8919..00000000
--- a/pow/POW.c
+++ /dev/null
@@ -1,8564 +0,0 @@
-/*****************************************************************************/
-/*                                                                           */
-/*  Copyright (c) 2001, 2002, Peter Shannon                                  */
-/*  All rights reserved.                                                     */
-/*                                                                           */
-/*  Redistribution and use in source and binary forms, with or without       */
-/*  modification, are permitted provided that the following conditions       */
-/*  are met:                                                                 */
-/*                                                                           */
-/*      * Redistributions of source code must retain the above               */
-/*        copyright notice, this list of conditions and the following        */
-/*        disclaimer.                                                        */
-/*                                                                           */
-/*      * Redistributions in binary form must reproduce the above            */
-/*        copyright notice, this list of conditions and the following        */
-/*        disclaimer in the documentation and/or other materials             */
-/*        provided with the distribution.                                    */
-/*                                                                           */
-/*      * The name of the contributors may be used to endorse or promote     */
-/*        products derived from this software without specific prior         */
-/*        written permission.                                                */
-/*                                                                           */
-/*  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS      */
-/*  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT        */
-/*  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS        */
-/*  FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS   */
-/*  OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,          */
-/*  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT         */
-/*  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,    */
-/*  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY    */
-/*  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT      */
-/*  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE    */
-/*  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.     */
-/*                                                                           */
-/*****************************************************************************/
-
-#include <Python.h>
-
-#include <openssl/opensslconf.h>
-#include <openssl/crypto.h>
-#include <openssl/rand.h>
-#include <openssl/asn1.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-#include <openssl/pem.h>
-#include <openssl/ssl.h>
-#include <openssl/evp.h>
-#include <openssl/err.h>
-#include <openssl/md5.h>
-#ifndef OPENSSL_NO_MD2
-#include <openssl/md2.h>
-#endif
-#include <openssl/sha.h>
-#include <openssl/hmac.h>
-#include <openssl/ripemd.h>
-#include <openssl/cms.h>
-
-#include <time.h>
-
-// Symmetric ciphers
-#define DES_ECB               1
-#define DES_EDE               2
-#define DES_EDE3              3
-#define DES_CFB               4
-#define DES_EDE_CFB           5
-#define DES_EDE3_CFB          6
-#define DES_OFB               7
-#define DES_EDE_OFB           8
-#define DES_EDE3_OFB          9
-#define DES_CBC               10
-#define DES_EDE_CBC           11
-#define DES_EDE3_CBC          12
-#define DESX_CBC              13
-#define RC4                   14
-#define RC4_40                15
-#define IDEA_ECB              16
-#define IDEA_CFB              17
-#define IDEA_OFB              18
-#define IDEA_CBC              19
-#define RC2_ECB               20
-#define RC2_CBC               21
-#define RC2_40_CBC            22
-#define RC2_CFB               23
-#define RC2_OFB               24
-#define BF_ECB                25
-#define BF_CBC                26
-#define BF_CFB                27
-#define BF_OFB                28
-#define CAST5_ECB             29
-#define CAST5_CBC             30
-#define CAST5_CFB             31
-#define CAST5_OFB             32
-#define RC5_32_12_16_CBC      33
-#define RC5_32_12_16_CFB      34
-#define RC5_32_12_16_ECB      35
-#define RC5_32_12_16_OFB      36
-
-// SSL connection methods
-#define SSLV2_SERVER_METHOD   1
-#define SSLV2_CLIENT_METHOD   2
-#define SSLV2_METHOD          3
-#define SSLV3_SERVER_METHOD   4
-#define SSLV3_CLIENT_METHOD   5
-#define SSLV3_METHOD          6
-#define TLSV1_SERVER_METHOD   7
-#define TLSV1_CLIENT_METHOD   8
-#define TLSV1_METHOD          9
-#define SSLV23_SERVER_METHOD  10
-#define SSLV23_CLIENT_METHOD  11
-#define SSLV23_METHOD         12
-
-// SSL connection states
-
-// PEM encoded data types
-#define RSA_PUBLIC_KEY        1
-#define RSA_PRIVATE_KEY       2
-#define DSA_PUBLIC_KEY        3
-#define DSA_PRIVATE_KEY       4
-#define DH_PUBLIC_KEY         5
-#define DH_PRIVATE_KEY        6
-#define X509_CERTIFICATE      7
-#define X_X509_CRL            8     // X509_CRL already used by OpenSSL library
-#define CMS_MESSAGE           9
-
-// Asymmetric ciphers
-#define RSA_CIPHER            1
-#define DSA_CIPHER            2
-#define DH_CIPHER             3
-//#define NO_DSA
-//#define NO_DH
-
-// Digests
-#ifndef OPENSSL_NO_MD2
-#define MD2_DIGEST            1
-#endif
-#define MD5_DIGEST            2
-#define SHA_DIGEST            3
-#define SHA1_DIGEST           4
-#define RIPEMD160_DIGEST      5
-#define SHA256_DIGEST         6
-#define SHA384_DIGEST         7
-#define SHA512_DIGEST         8
-
-// Object format
-#define SHORTNAME_FORMAT      1
-#define LONGNAME_FORMAT       2
-
-// Output format
-#define PEM_FORMAT            1
-#define DER_FORMAT            2
-
-// Object check functions
-#define X_X509_Check(op)         ((op)->ob_type == &x509type)
-#define X_X509_store_Check(op)   ((op)->ob_type == &x509_storetype)
-#define X_X509_crl_Check(op)     ((op)->ob_type == &x509_crltype)
-#define X_X509_revoked_Check(op) ((op)->ob_type == &x509_revokedtype)
-#define X_asymmetric_Check(op)   ((op)->ob_type == &asymmetrictype)
-#define X_symmetric_Check(op)    ((op)->ob_type == &symmetrictype)
-#define X_digest_Check(op)       ((op)->ob_type == &digesttype)
-#define X_hmac_Check(op)         ((op)->ob_type == &hmactype)
-#define X_ssl_Check(op)          ((op)->ob_type == &ssltype)
-#define X_cms_Check(op)          ((op)->ob_type == &cmstype)
-
-// Symbolic representation of "no SSL shutdown mode requested"
-#define SSL_NO_SHUTDOWN       0
-
-static char pow_module__doc__ [] =
-"<moduleDescription>\n"
-"   <header>\n"
-"      <name>POW</name>\n"
-"      <author>Peter Shannon</author>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This third major release of POW addresses the most critical missing\n"
-"         parts of functionality, X509v3 support.  Initially I thought adding\n"
-"         support via the OpenSSL code would be the easiest option but this\n"
-"         proved to be incorrect mainly due to the way I have chosen to handle\n"
-"         the complex data such as <classname>directoryNames</classname> and\n"
-"         <classname>generalNames</classname>.  It is easier in python to\n"
-"         construct complex sets of data using lists and dictionaries than\n"
-"         coordinate large numbers of objects and method calls.  This is no\n"
-"         criticism, it is just extremely easy.  Coding complex data such as the\n"
-"         <classname>certificatePolicies</classname> coding coding routines in C\n"
-"         to handle the data proved laborous and ultimately error prone.\n"
-"      </para>\n"
-"      <para>\n"
-"         PKIX structures are supported by a few operations on the relevant POW\n"
-"         objects and through a Python library which is modelled on the DER\n"
-"         encoding rules.  Modeling DER does expose some of the complexities of\n"
-"         the ASN1 specifications but avoids coding many assumptions into the\n"
-"         data structures and the interface for the objects.  For an example of\n"
-"         overly complex definitions take a look at the\n"
-"         <classname>Name</classname> object in RFC3280.  It is equally\n"
-"         important that modeling DER in the way leads to a library which is\n"
-"         trivial to extend to support new objects - simple objects are one\n"
-"         liners and complex objects only require the definition of a new\n"
-"         constructor.\n"
-"      </para>\n"
-"      <para>\n"
-"         functionality have been plugged.  The <classname>Ssl</classname> class has received\n"
-"         several new features relating to security.  Other areas have been\n"
-"         improved: PRNG support, certificate and CRL signing, certificate chain\n"
-"         and client verification.  Many bugs have been fixed, and certain\n"
-"         parts of code re-written where necessary.  I hope you enjoy using POW\n"
-"         and please feel free to send me feature requests and bug reports.\n"
-"      </para>\n"
-"   </body>\n"
-"</moduleDescription>\n"
-;
-
-/*========== Pre-definitions ==========*/
-static PyObject
-  *ErrorObject,
-  *SSLErrorObject,
-  *ZeroReturnErrorObject,
-  *WantReadErrorObject,
-  *WantWriteErrorObject,
-  *SSLSyscallErrorObject,
-  *SSLErrorSSLErrorObject,
-  *SSLSyscallSSLErrorObject,
-  *SSLUnexpectedEOFErrorObject,
-  *SSLOtherErrorObject;
-
-static PyTypeObject
-  x509type,
-  x509_storetype,
-  x509_crltype,
-  x509_revokedtype,
-  asymmetrictype,
-  symmetrictype,
-  digesttype,
-  hmactype,
-  ssltype,
-  cmstype;
-/*========== Pre-definitions ==========*/
-
-/*========== C structs ==========*/
-typedef struct {
-  PyObject_HEAD
-  X509 *x509;
-} x509_object;
-
-typedef struct {
-  PyObject_HEAD
-  X509_STORE *store;
-} x509_store_object;
-
-typedef struct {
-  PyObject_HEAD
-  X509_CRL *crl;
-} x509_crl_object;
-
-typedef struct {
-  PyObject_HEAD
-  X509_REVOKED *revoked;
-} x509_revoked_object;
-
-typedef struct {
-  PyObject_HEAD
-  void *cipher;
-  int key_type;
-  int cipher_type;
-} asymmetric_object;
-
-typedef struct {
-  PyObject_HEAD
-  EVP_CIPHER_CTX cipher_ctx;
-  int cipher_type;
-} symmetric_object;
-
-typedef struct {
-  PyObject_HEAD
-  EVP_MD_CTX digest_ctx;
-  int digest_type;
-} digest_object;
-
-typedef struct {
-  PyObject_HEAD
-  HMAC_CTX hmac_ctx;
-} hmac_object;
-
-typedef struct {
-  PyObject_HEAD
-  int ctxset;
-  SSL *ssl;
-  SSL_CTX *ctx;
-  STACK_OF(X509) *trusted_certs;
-  char *x509_cb_err;
-} ssl_object;
-
-typedef struct {
-  PyObject_HEAD
-  CMS_ContentInfo *cms;
-} cms_object;
-
-/*========== C structs ==========*/
-
-/*========== helper functions ==========*/
-
-/*
- * Minimal intervention debug-by-printf() hack, use only for good.
- */
-
-#if 0
-#define KVETCH(_msg_)   write(2, _msg_ "\n", sizeof(_msg_))
-#else
-#define KVETCH(_msg_)
-#endif
-
-/*
- * Error handling macros.  These macros make two assumptions:
- *
- * 1) All the macros assume that there's a cleanup label named
- *    "error" which these macros can use as a goto target.
- *
- * 2) assert_no_unhandled_openssl_errors() assumes that the return
- *    value is stored in a PyObject* variable named "result".
- *
- * These are icky assumptions, but they make it easier to provide
- * uniform error handling and make the code easier to read, not to
- * mention making it easier to track down obscure OpenSSL errors.
- */
-
-#define lose(_msg_)                                                     \
-  do {                                                                  \
-    PyErr_SetString(ErrorObject, (_msg_));                              \
-    goto error;                                                         \
-  } while (0)
-
-#define lose_type_error(_msg_)                                          \
-  do {                                                                  \
-    PyErr_SetString(PyExc_TypeError, (_msg_));                          \
-    goto error;                                                         \
-  } while (0)
-
-#define lose_openssl_error(_msg_)                                       \
-  do {                                                                  \
-    set_openssl_exception(ErrorObject, (_msg_));                        \
-    goto error;                                                         \
-  } while (0)
-
-#define lose_ssl_error(_self_, _code_)                                  \
-  do {                                                                  \
-    set_openssl_ssl_exception(_self_, _code_);                          \
-    goto error;                                                         \
-  } while (0)
-
-#define assert_no_unhandled_openssl_errors()                            \
-  do {                                                                  \
-    if (ERR_peek_error()) {                                             \
-      if (result) {                                                     \
-        Py_XDECREF(result);                                             \
-        result = NULL;                                                  \
-      }                                                                 \
-      lose_openssl_error(assert_helper(__LINE__));                      \
-    }                                                                   \
-  } while (0)
-
-static char *
-assert_helper(int line)
-{
-  static const char fmt[] = "Unhandled OpenSSL error at " __FILE__ ":%d!";
-  static char msg[sizeof(fmt) + 10];
-
-  snprintf(msg, sizeof(msg), fmt, line);
-  return msg;
-}
-
-static int
-docset_helper_add(PyObject *set, char *v)
-{
-  PyObject *value = NULL;
-
-  if ((value = PyString_FromString(v)) == NULL)
-    lose("could not allocate memory");
-
-  if (PyList_Append(set, value) != 0)
-    goto error;
-
-  Py_XDECREF(value);
-  return 1;
-
- error:
-
-  Py_XDECREF(value);
-  return 0;
-}
-
-/*
- * Generate an encrypion envelope.  Saves a lot of space having this case
- * statement in one place.
- */
-static const EVP_CIPHER *
-evp_cipher_factory(int cipher_type)
-{
-  switch(cipher_type) {
-#ifndef OPENSSL_NO_DES
-  case DES_ECB:           return EVP_des_ecb();
-  case DES_EDE:           return EVP_des_ede();
-  case DES_EDE3:          return EVP_des_ede3();
-  case DES_CFB:           return EVP_des_cfb();
-  case DES_EDE_CFB:       return EVP_des_ede_cfb();
-  case DES_EDE3_CFB:      return EVP_des_ede3_cfb();
-  case DES_OFB:           return EVP_des_ofb();
-  case DES_EDE_OFB:       return EVP_des_ede_ofb();
-  case DES_EDE3_OFB:      return EVP_des_ede3_ofb();
-  case DES_CBC:           return EVP_des_cbc();
-  case DES_EDE_CBC:       return EVP_des_ede_cbc();
-  case DES_EDE3_CBC:      return EVP_des_ede3_cbc();
-  case DESX_CBC:          return EVP_desx_cbc();
-#endif
-#ifndef OPENSSL_NO_RC4
-  case RC4:               return EVP_rc4();
-  case RC4_40:            return EVP_rc4_40();
-#endif
-#ifndef OPENSSL_NO_IDEA
-  case IDEA_ECB:          return EVP_idea_ecb();
-  case IDEA_CFB:          return EVP_idea_cfb();
-  case IDEA_OFB:          return EVP_idea_ofb();
-  case IDEA_CBC:          return EVP_idea_cbc();
-#endif
-#ifndef OPENSSL_NO_RC2
-  case RC2_ECB:           return EVP_rc2_ecb();
-  case RC2_CBC:           return EVP_rc2_cbc();
-  case RC2_40_CBC:        return EVP_rc2_40_cbc();
-  case RC2_CFB:           return EVP_rc2_cfb();
-  case RC2_OFB:           return EVP_rc2_ofb();
-#endif
-#ifndef OPENSSL_NO_BF
-  case BF_ECB:            return EVP_bf_ecb();
-  case BF_CBC:            return EVP_bf_cbc();
-  case BF_CFB:            return EVP_bf_cfb();
-  case BF_OFB:            return EVP_bf_ofb();
-#endif
-#ifndef OPENSSL_NO_CAST5
-  case CAST5_ECB:         return EVP_cast5_ecb();
-  case CAST5_CBC:         return EVP_cast5_cbc();
-  case CAST5_CFB:         return EVP_cast5_cfb();
-  case CAST5_OFB:         return EVP_cast5_ofb();
-#endif
-#ifndef OPENSSL_NO_RC5
-  case RC5_32_12_16_CBC:  return EVP_rc5_32_12_16_cbc();
-  case RC5_32_12_16_CFB:  return EVP_rc5_32_12_16_cfb();
-  case RC5_32_12_16_ECB:  return EVP_rc5_32_12_16_ecb();
-  case RC5_32_12_16_OFB:  return EVP_rc5_32_12_16_ofb();
-#endif
-  default:                return NULL;
-  }
-}
-
-/*
- * Raise an exception with data pulled from the OpenSSL error stack.
- * Exception value is a tuple with some internal structure.  If a
- * string error message is supplied, that string is the first element
- * of the exception value tuple.  Remainder of exception value tuple
- * is zero or more tuples, each representing one error from the stack.
- * Each error tuple contains six slots:
- * - the numeric error code
- * - string translation of numeric error code ("reason")
- * - name of library in which error occurred
- * - name of function in which error occurred
- * - name of file in which error occurred
- * - line number in file where error occurred
- */
-
-static void
-set_openssl_exception(PyObject *error_class, const char *msg)
-{
-  PyObject *errors;
-  unsigned long err;
-  const char *file;
-  int line;
-
-  errors = PyList_New(0);
-
-  if (msg) {
-    PyObject *s = Py_BuildValue("s", msg);
-    (void) PyList_Append(errors, s);
-    Py_XDECREF(s);
-  }
-
-  while ((err = ERR_get_error_line(&file, &line)) != 0) {
-    PyObject *t = Py_BuildValue("(issssi)",
-                                err,
-                                ERR_reason_error_string(err),
-                                ERR_lib_error_string(err),
-                                ERR_func_error_string(err),
-                                file,
-                                line);
-    (void) PyList_Append(errors, t);
-    Py_XDECREF(t);
-  }
-
-  PyErr_SetObject(error_class, PyList_AsTuple(errors));
-  Py_XDECREF(errors);
-}
-
-static void
-set_openssl_ssl_exception(const ssl_object *self, const int ret)
-{
-  int err = SSL_get_error(self->ssl, ret);
-  const char *s = NULL;
-
-  switch(err) {
-
-    /*
-     * These three get their own exceptions.
-     */
-
-  case SSL_ERROR_ZERO_RETURN:
-    PyErr_SetNone(ZeroReturnErrorObject);
-    break;
-  case SSL_ERROR_WANT_READ:
-    PyErr_SetNone(WantReadErrorObject);
-    break;
-  case SSL_ERROR_WANT_WRITE:
-    PyErr_SetNone(WantWriteErrorObject);
-    break;
-
-  case SSL_ERROR_SYSCALL:
-    /*
-     * Horrible jumbled mess of I/O related errors.  I'd ask what they
-     * were thinking, except that it's pretty clear that they weren't.
-     */
-    if (ERR_peek_error())
-      set_openssl_exception(SSLSyscallSSLErrorObject, NULL);
-    else if (ret)
-      PyErr_SetFromErrno(SSLSyscallErrorObject);
-    else
-      PyErr_SetNone(SSLUnexpectedEOFErrorObject);
-    break;
-
-  case SSL_ERROR_SSL:
-    /*
-     * Generic OpenSSL error during an SSL call.  I think.
-     */
-    set_openssl_exception(SSLErrorSSLErrorObject, self->x509_cb_err);
-    break;
-
-    /*
-     * All other SSL errors are returned as a (number, string) tuple.
-     */
-
-  case SSL_ERROR_NONE:
-    s = "SSL_ERROR_NONE";
-    break;
-  case SSL_ERROR_WANT_X509_LOOKUP:
-    s = "SSL_ERROR_WANT_X509_LOOKUP";
-    break;
-  case SSL_ERROR_WANT_CONNECT:
-    s = "SSL_ERROR_WANT_CONNECT";
-    break;
-  case SSL_ERROR_WANT_ACCEPT:
-    s = "SSL_ERROR_WANT_ACCEPT";
-    break;
-  default:
-    s = "UNKNOWN_SSL_ERROR";
-  }
-
-  if (s)
-    PyErr_SetObject(SSLOtherErrorObject, Py_BuildValue("(is)", err, s));
-}
-
-static PyObject *
-X509_object_helper_set_name(X509_NAME *name, PyObject *name_sequence)
-{
-  PyObject *pair = NULL; PyObject *type = NULL; PyObject *value = NULL;
-  int no_pairs = 0, i = 0, str_type = 0, nid;
-  unsigned char *valueptr = NULL;
-  char *typeptr = NULL;
-
-  no_pairs = PySequence_Size(name_sequence);
-  for (i = 0; i < no_pairs; i++) {
-    if ((pair = PySequence_GetItem(name_sequence, i)) == NULL)
-      return NULL;
-
-    if (!PyTuple_Check(pair) && !PyList_Check(pair))
-      lose_type_error("inapropriate type");
-
-    if (PySequence_Size(pair) != 2)
-      lose("each name entry must have 2 elements");
-
-    if ((type = PySequence_GetItem(pair, 0)) == NULL)
-      lose_type_error("could not get type string");
-
-    if (!PyString_Check(type))
-      lose_type_error("inapropriate type");
-
-    if ((value = PySequence_GetItem(pair, 1)) == NULL)
-      lose_type_error("could not get value string");
-
-    if (!PyString_Check(value))
-      lose_type_error("inapropriate type");
-
-    typeptr = PyString_AsString(type);
-    valueptr = (unsigned char *) PyString_AsString(value);
-
-    str_type = ASN1_PRINTABLE_type(valueptr, -1);
-    if ((nid = OBJ_ln2nid(typeptr)) == 0 &&
-        (nid = OBJ_sn2nid(typeptr)) == 0)
-      lose("unknown ASN1 object");
-
-    if (!X509_NAME_add_entry_by_NID(name, nid, str_type, valueptr,
-                                    strlen((char *) valueptr), -1, 0))
-      lose("unable to add name entry");
-
-    Py_XDECREF(pair);
-    Py_XDECREF(type);
-    Py_XDECREF(value);
-    pair = NULL;
-    type = NULL;
-    value = NULL;
-  }
-  return name_sequence;
-
- error:
-
-  Py_XDECREF(pair);
-  Py_XDECREF(type);
-  Py_XDECREF(value);
-
-  return NULL;
-}
-
-static PyObject *
-X509_object_helper_get_name(X509_NAME *name, int format)
-{
-  int no_entries = 0, no_pairs = 0, i = 0, j = 0, value_len = 0, nid = 0;
-  X509_NAME_ENTRY *entry = NULL;
-  char *value = NULL, long_name[512];
-  const char *short_name;
-
-  PyObject *result_list = NULL;
-  PyObject *pair = NULL;
-  PyObject *py_type = NULL;
-  PyObject *py_value = NULL;
-
-  no_entries = X509_NAME_entry_count(name);
-
-  if ((result_list = PyTuple_New(no_entries)) == NULL)
-    lose("could not allocate memory");
-
-  for(i = 0; i < no_entries; i++) {
-    if ((entry = X509_NAME_get_entry(name, i)) == NULL)
-      lose("could not get certificate name");
-
-    if (entry->value->length + 1 > value_len) {
-      if (value)
-        free(value);
-
-      if ((value = malloc(entry->value->length + 1)) == NULL)
-        lose("could not allocate memory");
-
-      value_len = entry->value->length + 1;
-    }
-    memcpy(value, entry->value->data, entry->value->length);
-    value[entry->value->length] = 0;
-
-    if (!i2t_ASN1_OBJECT(long_name, sizeof(long_name), entry->object))
-      lose("could not find object name");
-
-    switch (format) {
-    case SHORTNAME_FORMAT:
-      nid = OBJ_ln2nid(long_name);
-      short_name = OBJ_nid2sn(nid);
-      py_type = PyString_FromString(short_name);
-      break;
-    case LONGNAME_FORMAT:
-      py_type = PyString_FromString(long_name);
-      break;
-    default:
-      lose("unknown name format");
-    }
-
-    py_value = PyString_FromString(value);
-
-    if ((pair = PyTuple_New(2)) == NULL)
-      lose("could not allocate memory");
-
-    PyTuple_SetItem(pair, 0, py_type);
-    PyTuple_SetItem(pair, 1, py_value);
-    PyTuple_SetItem(result_list, i, pair);
-  }
-
-  if (value)
-    free(value);
-
-  return result_list;
-
- error:
-
-  if (value)
-    free(value);
-
-  if (result_list) {
-    no_pairs = PyTuple_Size(result_list);
-    for (i = 0; i < no_pairs; i++) {
-      pair = PyTuple_GetItem(result_list, i);
-      no_entries = PyTuple_Size(result_list);
-      for (j = 0; j < no_entries; j++) {
-        py_value = PyTuple_GetItem(pair, i);
-        Py_XDECREF(py_value);
-      }
-    }
-  }
-
-  Py_XDECREF(py_type);
-  Py_XDECREF(py_value);
-  Py_XDECREF(result_list);
-  return NULL;
-}
-
-static STACK_OF(X509) *
-x509_helper_sequence_to_stack(PyObject *x509_sequence)
-{
-  x509_object *x509obj = NULL;
-  STACK_OF(X509) *x509_stack = NULL;
-  int size = 0, i = 0;
-
-  if (x509_sequence != Py_None && !PyTuple_Check(x509_sequence) && !PyList_Check(x509_sequence))
-    lose_type_error("Inapropriate type");
-
-  if ((x509_stack = sk_X509_new_null()) == NULL)
-    lose("Couldn't create new X509 stack");
-
-  if (x509_sequence != Py_None) {
-    size = PySequence_Size(x509_sequence);
-
-    for (i = 0; i < size; i++) {
-      if ((x509obj = (x509_object*) PySequence_GetItem(x509_sequence, i)) == NULL)
-        goto error;
-
-      if (!X_X509_Check(x509obj))
-        lose_type_error("Inapropriate type");
-
-      if (!sk_X509_push(x509_stack, x509obj->x509))
-        lose("Couldn't add X509 object to stack");
-
-      Py_XDECREF(x509obj);
-      x509obj = NULL;
-    }
-  }
-
-  return x509_stack;
-
- error:
-
-  if (x509_stack)
-    sk_X509_free(x509_stack);
-
-  Py_XDECREF(x509obj);
-
-  return NULL;
-}
-
-static PyObject *
-stack_to_tuple_helper(_STACK *sk, PyObject *(*handler)(void *))
-{
-  PyObject *result_list = NULL, *result_tuple = NULL, *obj = NULL;
-
-  if ((result_list = PyList_New(0)) == NULL)
-    lose("could not allocate memory");
-
-  while (sk_num(sk)) {
-
-    if ((obj = handler(sk_value(sk, 0))) == NULL)
-      lose("could not allocate memory");
-
-    sk_shift(sk);
-
-    if (PyList_Append(result_list, obj) != 0)
-      goto error;
-
-    Py_XDECREF(obj);
-    obj = NULL;
-  }
-
-  result_tuple = PyList_AsTuple(result_list);
-  Py_XDECREF(result_list);
-
-  return result_tuple;
-
- error:
-
-  Py_XDECREF(obj);
-  Py_XDECREF(result_list);
-  return NULL;
-}
-
-/*
- * Time conversion functions.  These follow RFC 5280, but use a single
- * text encoding that looks like GeneralizedTime as restricted by RFC
- * 5280; conversion to and from UTCTime is handled internally
- * according to the RFC 5280 rules.  The intent is to hide the
- * horrible short-sighted mess from Python code entirely.
- */
-
-static PyObject *
-ASN1_TIME_to_Python(ASN1_TIME *t)
-{
-  ASN1_GENERALIZEDTIME *g = ASN1_TIME_to_generalizedtime(t, NULL);
-  PyObject *result = NULL;
-  if (g) {
-    result = Py_BuildValue("s", g->data);
-    ASN1_GENERALIZEDTIME_free(g);
-  }
-  return result;
-}
-
-static int
-python_ASN1_TIME_set_string(ASN1_TIME *t, const char *s)
-{
-  if (t == NULL || s == NULL || strlen(s) < 10)
-    return 0;
-  if ((s[0] == '1' && s[1] == '9' && s[2] > '4') ||
-      (s[0] == '2' && s[1] == '0' && s[2] < '5'))
-    return ASN1_UTCTIME_set_string(t, s + 2);
-  else
-    return ASN1_GENERALIZEDTIME_set_string(t, s);
-}
-
-/*========== helper funcitons ==========*/
-
-/*========== X509 code ==========*/
-static x509_object *
-X509_object_new(void)
-{
-  x509_object *self;
-
-  self = PyObject_New(x509_object, &x509type);
-  if (self == NULL)
-    goto error;
-
-  self->x509 = X509_new();
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-/*
- * This function is pretty dumb.  Most of the work is done by the module
- * function pow_module_pem_read().
- */
-static x509_object *
-X509_object_pem_read(BIO *in)
-{
-  x509_object *self;
-
-  if ((self = PyObject_New(x509_object, &x509type)) == NULL)
-    goto error;
-
-  if ((self->x509 = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL)
-    lose("could not load PEM encoded certificate");
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static x509_object *
-X509_object_der_read(unsigned char *src, int len)
-{
-  x509_object *self;
-  unsigned char *ptr = src;
-
-  if ((self = PyObject_New(x509_object, &x509type)) == NULL)
-    goto error;
-
-  self->x509 = X509_new();
-
-  if(!d2i_X509(&self->x509, (const unsigned char **) &ptr, len))
-    lose("could not load PEM encoded certificate");
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-/*
- * Unlike the previous function this creates the BIO itself.  The BIO_s_mem
- * is used as a buffer which the certificate is read into, from this buffer
- * it is read into a char[] and returned as a string.
- */
-static PyObject *
-X509_object_write_helper(x509_object *self, PyObject *args, int format)
-{
-  int len = 0;
-  char *buf = NULL;
-  BIO *out_bio = NULL;
-  PyObject *cert = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    return NULL;
-
-  out_bio = BIO_new(BIO_s_mem());
-
-  switch (format) {
-
-  case DER_FORMAT:
-    if (!i2d_X509_bio(out_bio, self->x509))
-      lose("unable to write certificate");
-    break;
-
-  case PEM_FORMAT:
-    if (!PEM_write_bio_X509(out_bio, self->x509))
-      lose("unable to write certificate");
-    break;
-
-  default:
-    lose("internal error, unknown output format");
-  }
-
-  if ((len = BIO_ctrl_pending(out_bio)) == 0)
-    lose("unable to get bytes stored in bio");
-
-  if ((buf = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  if (BIO_read(out_bio, buf, len) != len)
-    lose("unable to write out cert");
-
-  cert = Py_BuildValue("s#", buf, len);
-
-  BIO_free(out_bio);
-  free(buf);
-  return cert;
-
- error:
-
-  if (out_bio)
-    BIO_free(out_bio);
-
-  if (buf)
-    free(buf);
-
-  Py_XDECREF(cert);
-  return NULL;
-}
-
-static char X509_object_pem_write__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>pemWrite</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a PEM encoded certificate as a\n"
-"         string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_pem_write(x509_object *self, PyObject *args)
-{
-  return X509_object_write_helper(self, args, PEM_FORMAT);
-}
-
-static char X509_object_der_write__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>derWrite</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a DER encoded certificate as a\n"
-"         string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_der_write(x509_object *self, PyObject *args)
-{
-  return X509_object_write_helper(self, args, DER_FORMAT);
-}
-
-/*
- * Currently this function only supports RSA keys.
- */
-static char X509_object_set_public_key__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>setPublicKey</name>\n"
-"      <parameter>key</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method sets the public key for this certificate object.  The\n"
-"         parameter <parameter>key</parameter> should be an instance of\n"
-"         <classname>Asymmetric</classname> containing a public key.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-
-static PyObject *
-X509_object_set_public_key(x509_object *self, PyObject *args)
-{
-  EVP_PKEY *pkey = NULL;
-  asymmetric_object *asym;
-
-  if (!PyArg_ParseTuple(args, "O!", &asymmetrictype, &asym))
-    goto error;
-
-  if ((pkey = EVP_PKEY_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!EVP_PKEY_assign_RSA(pkey, asym->cipher))
-    lose("EVP_PKEY assignment error");
-
-  if (!X509_set_pubkey(self->x509,pkey))
-    lose("could not set certificate's public key");
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (pkey)
-    EVP_PKEY_free(pkey);
-
-  return NULL;
-
-}
-
-static char X509_object_sign__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>sign</name>\n"
-"      <parameter>key</parameter>\n"
-"      <optional><parameter>digest = MD5_DIGEST</parameter></optional>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method signs a certificate with a private key.  See the\n"
-"         example for the methods which should be invoked before signing a\n"
-"         certificate.  <parameter>key</parameter> should be an instance of\n"
-"         <classname>Asymmetric</classname> containing a private key.\n"
-"         The optional parameter <parameter>digest</parameter> indicates\n"
-"         which digest function should be used to compute the hash to be\n"
-"         signed, it should be one of the following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-#ifndef OPENSSL_NO_MD2
-"         <member><constant>MD2_DIGEST</constant></member>\n"
-#endif
-"         <member><constant>MD5_DIGEST</constant></member>\n"
-"         <member><constant>SHA_DIGEST</constant></member>\n"
-"         <member><constant>SHA1_DIGEST</constant></member>\n"
-"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
-"         <member><constant>SHA256_DIGEST</constant></member>\n"
-"         <member><constant>SHA384_DIGEST</constant></member>\n"
-"         <member><constant>SHA512_DIGEST</constant></member>\n"
-"     </simplelist>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-
-static PyObject *
-X509_object_sign(x509_object *self, PyObject *args)
-{
-  EVP_PKEY *pkey = NULL;
-  asymmetric_object *asym;
-  int digest = MD5_DIGEST;
-
-  if (!PyArg_ParseTuple(args, "O!|i", &asymmetrictype, &asym, &digest))
-    goto error;
-
-  if ((pkey = EVP_PKEY_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (asym->key_type != RSA_PRIVATE_KEY)
-    lose("cannot use this type of key");
-
-  if (!EVP_PKEY_assign_RSA(pkey, asym->cipher))
-    lose("EVP_PKEY assignment error");
-
-  switch (digest) {
-  case MD5_DIGEST:
-    if (!X509_sign(self->x509, pkey, EVP_md5()))
-      lose("could not sign certificate");
-    break;
-
-#ifndef OPENSSL_NO_MD2
-  case MD2_DIGEST:
-    if (!X509_sign(self->x509, pkey, EVP_md2()))
-      lose("could not sign certificate");
-    break;
-#endif
-
-  case SHA_DIGEST:
-    if (!X509_sign(self->x509, pkey, EVP_sha()))
-      lose("could not sign certificate");
-    break;
-
-  case SHA1_DIGEST:
-    if (!X509_sign(self->x509, pkey, EVP_sha1()))
-      lose("could not sign certificate");
-    break;
-
-  case RIPEMD160_DIGEST:
-    if (!X509_sign(self->x509, pkey, EVP_ripemd160()))
-      lose("could not sign certificate");
-    break;
-
-  case SHA256_DIGEST:
-    if (!X509_sign(self->x509, pkey, EVP_sha256()))
-      lose("could not sign certificate");
-    break;
-
-  case SHA384_DIGEST:
-    if (!X509_sign(self->x509, pkey, EVP_sha384()))
-      lose("could not sign certificate");
-    break;
-
-  case SHA512_DIGEST:
-    if (!X509_sign(self->x509, pkey, EVP_sha512()))
-      lose("could not sign certificate");
-    break;
-  }
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (pkey)
-    EVP_PKEY_free(pkey);
-
-  return NULL;
-
-}
-
-static char X509_object_get_version__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>getVersion</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the version number from the version field of\n"
-"         this certificate.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-
-static PyObject *
-X509_object_get_version(x509_object *self, PyObject *args)
-{
-  long version = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  version = X509_get_version(self->x509);
-
-  return Py_BuildValue("l", version);
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_set_version__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>setVersion</name>\n"
-"      <parameter>version</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method sets the version number in the version field of\n"
-"         this certificate.  <parameter>version</parameter> should be an\n"
-"         integer.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_set_version(x509_object *self, PyObject *args)
-{
-  long version = 0;
-
-  if (!PyArg_ParseTuple(args, "l", &version))
-    goto error;
-
-  if (!X509_set_version(self->x509, version))
-    lose("could not set certificate version");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_get_serial__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>getSerial</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method get the serial number in the serial field of\n"
-"         this certificate.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_get_serial(x509_object *self, PyObject *args)
-{
-  long serial = 0;
-  ASN1_INTEGER *asn1i = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((asn1i = X509_get_serialNumber(self->x509)) == NULL)
-    lose("could not get serial number");
-
-  if ((serial = ASN1_INTEGER_get(asn1i)) == -1)
-    lose("could not convert ASN1 Integer to long");
-
-  return Py_BuildValue("l", serial);
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_set_serial__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>setSerial</name>\n"
-"      <parameter>serial</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method sets the serial number in the serial field of\n"
-"         this certificate.  <parameter>serial</parameter> should ba an\n"
-"         integer.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_set_serial(x509_object *self, PyObject *args)
-{
-  long serial = 0;
-  ASN1_INTEGER *asn1i = NULL;
-
-  if (!PyArg_ParseTuple(args, "l", &serial))
-    goto error;
-
-  if ((asn1i = ASN1_INTEGER_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!ASN1_INTEGER_set(asn1i, serial))
-    lose("could not set ASN1 integer");
-
-  if (!X509_set_serialNumber(self->x509, asn1i))
-    lose("could not set certificate serial");
-
-  ASN1_INTEGER_free(asn1i);
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (asn1i)
-    ASN1_INTEGER_free(asn1i);
-
-  return NULL;
-}
-
-static char X509_object_get_issuer__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>getIssuer</name>\n"
-"      <parameter>format = SHORTNAME_FORMAT</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a tuple containing the issuers name.  Each\n"
-"         element of the tuple is a tuple with 2 elements.  The first tuple\n"
-"         is an object name and the second is it's value.  Both issuer and\n"
-"         subject are names distinguished normally composed of a small\n"
-"         number of objects:\n"
-"      </para>\n"
-"      <simplelist>\n"
-"         <member><constant>c</constant> or <constant>countryName</constant></member>\n"
-"         <member><constant>st</constant> or <constant>stateOrProvinceName</constant></member>\n"
-"         <member><constant>o</constant> or <constant>organizationName</constant></member>\n"
-"         <member><constant>l</constant> or <constant>localityName</constant></member>\n"
-"         <member><constant>ou</constant> or <constant>organizationalUnitName</constant></member>\n"
-"         <member><constant>cn</constant> or <constant>commonName</constant></member>\n"
-"      </simplelist>\n"
-"      <para>\n"
-"         The data type varies from one object to another, however, all the\n"
-"         common objects are strings.  It would be possible to specify any\n"
-"         kind of object but that would certainly adversely effect\n"
-"         portability and is not recommended.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_get_issuer(x509_object *self, PyObject *args)
-{
-  PyObject *result_list = NULL;
-  X509_NAME *name = NULL;
-  int format = SHORTNAME_FORMAT;
-
-  if (!PyArg_ParseTuple(args, "|i", &format))
-    goto error;
-
-  if ((name = X509_get_issuer_name(self->x509)) == NULL)
-    lose("could not get issuers name");
-
-  if ((result_list = X509_object_helper_get_name(name, format)) == NULL)
-    lose("failed to produce name list");
-
-  return result_list;
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_get_subject__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>getSubject</name>\n"
-"      <parameter>format = SHORTNAME_FORMAT</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a tuple containing the subjects name.  See\n"
-"         <function>getIssuer</function> for a description of the returned\n"
-"         object's format.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_get_subject(x509_object *self, PyObject *args)
-{
-  PyObject *result_list = NULL;
-  X509_NAME *name = NULL;
-  int format = SHORTNAME_FORMAT;
-
-  if (!PyArg_ParseTuple(args, "|i", &format))
-    goto error;
-
-  if ((name = X509_get_subject_name(self->x509)) == NULL)
-    lose("could not get issuers name");
-
-  if ((result_list = X509_object_helper_get_name(name, format)) == NULL)
-    lose("failed to produce name list");
-
-  return result_list;
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_set_subject__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>setSubject</name>\n"
-"      <parameter>name</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to set the subjects name.\n"
-"         <parameter>name</parameter> can be comprised of lists or tuples in\n"
-"         the format described in the <function>getIssuer</function> method.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_set_subject(x509_object *self, PyObject *args)
-{
-  PyObject *name_sequence = NULL;
-  X509_NAME *name = NULL;
-
-  if (!PyArg_ParseTuple(args, "O", &name_sequence))
-    goto error;
-
-  if (!PyTuple_Check(name_sequence) && !PyList_Check(name_sequence))
-    lose_type_error("Inapropriate type");
-
-  if ((name = X509_NAME_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!X509_object_helper_set_name(name, name_sequence))
-    lose("unable to set new name");
-
-  if (!X509_set_subject_name(self->x509, name))
-    lose("unable to set name");
-
-  X509_NAME_free(name);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_set_issuer__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>setIssuer</name>\n"
-"      <parameter>name</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to set the issuers name.\n"
-"         <parameter>name</parameter> can be comprised of lists or tuples in\n"
-"         the format described in the <function>getissuer</function> method.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_set_issuer(x509_object *self, PyObject *args)
-{
-  PyObject *name_sequence = NULL;
-  X509_NAME *name = NULL;
-
-  if (!PyArg_ParseTuple(args, "O", &name_sequence))
-    goto error;
-
-  if (!PyTuple_Check(name_sequence) && !PyList_Check(name_sequence))
-    lose_type_error("Inapropriate type");
-
-  if ((name = X509_NAME_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!X509_object_helper_set_name(name, name_sequence))
-    lose("unable to set new name");
-
-  if (!X509_set_issuer_name(self->x509,name))
-    lose("unable to set name");
-
-  X509_NAME_free(name);
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (name)
-    X509_NAME_free(name);
-
-  return  NULL;
-}
-
-static char X509_object_get_not_before__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>getNotBefore</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this function returns a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-
-;
-
-static PyObject *
-X509_object_get_not_before (x509_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  return ASN1_TIME_to_Python(self->x509->cert_info->validity->notBefore);
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_get_not_after__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>getNotAfter</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this function returns a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_get_not_after (x509_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  return ASN1_TIME_to_Python(self->x509->cert_info->validity->notAfter);
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_set_not_after__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>setNotAfter</name>\n"
-"      <parameter>time</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this accepts one parameter, a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_set_not_after (x509_object *self, PyObject *args)
-{
-  char *new_time = NULL;
-
-  if (!PyArg_ParseTuple(args, "s", &new_time))
-    goto error;
-
-  if (!python_ASN1_TIME_set_string(self->x509->cert_info->validity->notAfter, new_time))
-    lose("Could not set notAfter");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_set_not_before__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>setNotBefore</name>\n"
-"      <parameter>time</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this accepts one parameter, a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_set_not_before (x509_object *self, PyObject *args)
-{
-  char *new_time = NULL;
-
-  if (!PyArg_ParseTuple(args, "s", &new_time))
-    goto error;
-
-  if (!python_ASN1_TIME_set_string(self->x509->cert_info->validity->notBefore, new_time))
-    lose("Could not set notBefore");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_add_extension__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>addExtension</name>\n"
-"      <parameter>extensionName</parameter>\n"
-"      <parameter>critical</parameter>\n"
-"      <parameter>extensionValue</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method adds an extension to this certificate.\n"
-"         <parameter>extensionName</parameter> should be the of the\n"
-"         extension.  <parameter>critical</parameter> should an integer, 1\n"
-"         for true and 0 for false.  <parameter>extensionValue</parameter>\n"
-"         should be a string, DER encoded value of the extension.  The name\n"
-"         of the extension must be correct according to OpenSSL and can be\n"
-"         checked in the <constant>objects.h</constant> header file, part of\n"
-"         the OpenSSL source distribution.  In the majority of cases they\n"
-"         are the same as those defined in <constant>POW._oids</constant>\n"
-"         but if you do encounter problems is may be worth checking.\n"
-"      </para>\n"
-"      <example>\n"
-"         <title><function>addExtension</function> method usage</title>\n"
-"         <programlisting>\n"
-"      basic = POW.pkix.BasicConstraints()\n"
-"      basic.set([1,5])\n"
-"      serverCert.addExtension('basicConstraints', 0, basic.toString())\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_add_extension(x509_object *self, PyObject *args)
-{
-  int critical = 0, nid = 0, len = 0;
-  char *name = NULL;
-  unsigned char *buf = NULL;
-  ASN1_OCTET_STRING *octetString = NULL;
-  X509_EXTENSION *extn = NULL;
-
-  if (!PyArg_ParseTuple(args, "sis#", &name, &critical, &buf, &len))
-    goto error;
-
-  if ((octetString = M_ASN1_OCTET_STRING_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!ASN1_OCTET_STRING_set(octetString, buf, len))
-    lose("could not set ASN1 Octect string");
-
-  if ((nid = OBJ_txt2nid(name)) == NID_undef)
-    lose("extension has unknown object identifier");
-
-  if ((extn = X509_EXTENSION_create_by_NID(NULL, nid, critical, octetString)) == NULL)
-    lose("unable to create ASN1 X509 Extension object");
-
-  if (!self->x509->cert_info->extensions &&
-      (self->x509->cert_info->extensions = sk_X509_EXTENSION_new_null()) == NULL)
-    lose("unable to allocate memory");
-
-  if (!sk_X509_EXTENSION_push(self->x509->cert_info->extensions, extn))
-    lose("unable to add extension");
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (extn)
-    X509_EXTENSION_free(extn);
-
-  return NULL;
-}
-
-static char X509_object_clear_extensions__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>clearExtensions</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method clears the structure which holds the extension for\n"
-"         this certificate.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_clear_extensions(x509_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (self->x509->cert_info->extensions) {
-    sk_X509_EXTENSION_free(self->x509->cert_info->extensions);
-    self->x509->cert_info->extensions = NULL;
-  }
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_count_extensions__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>countExtensions</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the size of the structure which holds the\n"
-"         extension for this certificate.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_count_extensions(x509_object *self, PyObject *args)
-{
-  int num = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (self->x509->cert_info->extensions)
-    num = sk_X509_EXTENSION_num(self->x509->cert_info->extensions);
-
-  return Py_BuildValue("i", num);
-
- error:
-
-  return NULL;
-}
-
-static char X509_object_get_extension__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>getExtension</name>\n"
-"      <parameter>index</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a tuple equivalent the parameters of\n"
-"         <function>addExtension</function>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_object_get_extension(x509_object *self, PyObject *args)
-{
-  int num = 0, index = 0, ext_nid = 0;
-  char const *ext_ln = NULL;
-  char unknown_ext [] = "unknown";
-  X509_EXTENSION *ext;
-
-  if (!PyArg_ParseTuple(args, "i", &index))
-    goto error;
-
-  if (self->x509->cert_info->extensions)
-    num = sk_X509_EXTENSION_num(self->x509->cert_info->extensions);
-
-  if (index >= num)
-    lose("certificate does not have that many extensions");
-
-  if ((ext = sk_X509_EXTENSION_value(self->x509->cert_info->extensions, index)) == NULL)
-    lose("could not get extension");
-
-  if ((ext_nid = OBJ_obj2nid(ext->object)) == NID_undef)
-    lose("extension has unknown object identifier");
-
-  if ((ext_ln = OBJ_nid2sn(ext_nid)) == NULL)
-    ext_ln = unknown_ext;
-
-  return Py_BuildValue("sis#", ext_ln, ext->critical, ext->value->data, ext->value->length);
-
- error:
-
-  return NULL;
-}
-
-static char x509_object_pprint__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"      <name>pprint</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a formatted string showing the information\n"
-"         held in the certificate.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_object_pprint(x509_object *self, PyObject *args)
-{
-  int len = 0, ret = 0;
-  char *buf = NULL;
-  BIO *out_bio = NULL;
-  PyObject *cert = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  out_bio = BIO_new(BIO_s_mem());
-
-  if (!X509_print(out_bio, self->x509))
-    lose("unable to write crl");
-
-  if ((len = BIO_ctrl_pending(out_bio)) == 0)
-    lose("unable to get bytes stored in bio");
-
-  if ((buf = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  if ((ret = BIO_read(out_bio, buf, len)) != len)
-    lose("unable to write out cert");
-
-  cert = Py_BuildValue("s#", buf, len);
-
-  BIO_free(out_bio);
-  free(buf);
-  return cert;
-
- error:
-
-  if (out_bio)
-    BIO_free(out_bio);
-
-  if (buf)
-    free(buf);
-
-  return NULL;
-
-}
-
-static struct PyMethodDef X509_object_methods[] = {
-  {"pemWrite",          (PyCFunction)X509_object_pem_write,        METH_VARARGS,  NULL},
-  {"derWrite",          (PyCFunction)X509_object_der_write,        METH_VARARGS,  NULL},
-  {"sign",              (PyCFunction)X509_object_sign,             METH_VARARGS,  NULL},
-  {"setPublicKey",      (PyCFunction)X509_object_set_public_key,   METH_VARARGS,  NULL},
-  {"getVersion",        (PyCFunction)X509_object_get_version,      METH_VARARGS,  NULL},
-  {"setVersion",        (PyCFunction)X509_object_set_version,      METH_VARARGS,  NULL},
-  {"getSerial",         (PyCFunction)X509_object_get_serial,       METH_VARARGS,  NULL},
-  {"setSerial",         (PyCFunction)X509_object_set_serial,       METH_VARARGS,  NULL},
-  {"getIssuer",         (PyCFunction)X509_object_get_issuer,       METH_VARARGS,  NULL},
-  {"setIssuer",         (PyCFunction)X509_object_set_issuer,       METH_VARARGS,  NULL},
-  {"getSubject",        (PyCFunction)X509_object_get_subject,      METH_VARARGS,  NULL},
-  {"setSubject",        (PyCFunction)X509_object_set_subject,      METH_VARARGS,  NULL},
-  {"getNotBefore",      (PyCFunction)X509_object_get_not_before,   METH_VARARGS,  NULL},
-  {"getNotAfter",       (PyCFunction)X509_object_get_not_after,    METH_VARARGS,  NULL},
-  {"setNotAfter",       (PyCFunction)X509_object_set_not_after,    METH_VARARGS,  NULL},
-  {"setNotBefore",      (PyCFunction)X509_object_set_not_before,   METH_VARARGS,  NULL},
-  {"addExtension",      (PyCFunction)X509_object_add_extension,    METH_VARARGS,  NULL},
-  {"clearExtensions",   (PyCFunction)X509_object_clear_extensions, METH_VARARGS,  NULL},
-  {"countExtensions",   (PyCFunction)X509_object_count_extensions, METH_VARARGS,  NULL},
-  {"getExtension",      (PyCFunction)X509_object_get_extension,    METH_VARARGS,  NULL},
-  {"pprint",            (PyCFunction)x509_object_pprint,           METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-X509_object_getattr(x509_object *self, char *name)
-{
-  return Py_FindMethod(X509_object_methods, (PyObject *)self, name);
-}
-
-static void
-X509_object_dealloc(x509_object *self, char *name)
-{
-  X509_free(self->x509);
-  PyObject_Del(self);
-}
-
-static char x509type__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>X509</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides access to a significant proportion of X509\n"
-"         functionality of OpenSSL.\n"
-"      </para>\n"
-"\n"
-"      <example>\n"
-"         <title><classname>x509</classname> class usage</title>\n"
-"         <programlisting>\n"
-"      privateFile = open('test/private.key', 'r')\n"
-"      publicFile = open('test/public.key', 'r')\n"
-"      certFile = open('test/cacert.pem', 'w')\n"
-"\n"
-"      publicKey = POW.pemRead(POW.RSA_PUBLIC_KEY, publicFile.read())\n"
-"      privateKey = POW.pemRead(POW.RSA_PRIVATE_KEY, privateFile.read(), 'pass')\n"
-"\n"
-"      c = POW.X509()\n"
-"\n"
-"      name = [  ['C', 'GB'], ['ST', 'Hertfordshire'],\n"
-"                ['O','The House'], ['CN', 'Peter Shannon'] ]\n"
-"\n"
-"      c.setIssuer(name)\n"
-"      c.setSubject(name)\n"
-"      c.setSerial(0)\n"
-"      t1 = POW.pkix.time2utc(time.time())\n"
-"      t2 = POW.pkix.time2utc(time.time() + 60*60*24*365)\n"
-"      c.setNotBefore(t1)\n"
-"      c.setNotAfter(t2)\n"
-"      c.setPublicKey(publicKey)\n"
-"      c.sign(privateKey)\n"
-"\n"
-"      certFile.write(c.pemWrite())\n"
-"\n"
-"      privateFile.close()\n"
-"      publicFile.close()\n"
-"      certFile.close()\n"
-"         </programlisting>\n"
-"      </example>\n"
-"\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject x509type = {
-   PyObject_HEAD_INIT(0)
-   0,                                  /*ob_size*/
-   "X509",                             /*tp_name*/
-   sizeof(x509_object),                /*tp_basicsize*/
-   0,                                  /*tp_itemsize*/
-   (destructor)X509_object_dealloc,    /*tp_dealloc*/
-   (printfunc)0,                       /*tp_print*/
-   (getattrfunc)X509_object_getattr,   /*tp_getattr*/
-   (setattrfunc)0,                     /*tp_setattr*/
-   (cmpfunc)0,                         /*tp_compare*/
-   (reprfunc)0,                        /*tp_repr*/
-   0,                                  /*tp_as_number*/
-   0,                                  /*tp_as_sequence*/
-   0,                                  /*tp_as_mapping*/
-   (hashfunc)0,                        /*tp_hash*/
-   (ternaryfunc)0,                     /*tp_call*/
-   (reprfunc)0,                        /*tp_str*/
-   0,
-   0,
-   0,
-   0,
-   x509type__doc__                     /* Documentation string */
-};
-/*========== X509 Code ==========*/
-
-/*========== x509 store Code ==========*/
-static x509_store_object *
-x509_store_object_new(void)
-{
-  x509_store_object *self = NULL;
-
-  if ((self = PyObject_New(x509_store_object, &x509_storetype)) == NULL)
-    goto error;
-
-  self->store = X509_STORE_new();
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static char x509_store_object_verify__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Store</memberof>\n"
-"      <name>verify</name>\n"
-"      <parameter>certificate</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         The <classname>X509Store</classname> method\n"
-"         <function>verify</function> is based on the\n"
-"         <function>X509_verify_cert</function>.  It handles certain aspects\n"
-"         of verification but not others.  The certificate will be verified\n"
-"         against <constant>notBefore</constant>,\n"
-"         <constant>notAfter</constant> and trusted certificates.\n"
-"         It crucially will not handle checking the certificate against\n"
-"         CRLs.  This functionality will probably make it into OpenSSL\n"
-"         0.9.7.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_store_object_verify(x509_store_object *self, PyObject *args)
-{
-  X509_STORE_CTX csc;
-  x509_object *x509 = NULL;
-  int ok;
-
-  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
-    goto error;
-
-  X509_STORE_CTX_init(&csc, self->store, x509->x509, NULL);
-  ok = X509_verify_cert(&csc) == 1;
-  X509_STORE_CTX_cleanup(&csc);
-
-  return PyBool_FromLong(ok);
-
- error:
-
-  return NULL;
-}
-
-static char x509_store_object_verify_chain__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Store</memberof>\n"
-"      <name>verifyChain</name>\n"
-"      <parameter>certificate</parameter>\n"
-"      <parameter>chain</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         The <classname>X509Store</classname> method <function>verifyChain</function>\n"
-"         is based on the <function>X509_verify_cert</function> but is initialised\n"
-"         with a <classname>X509</classname> object to verify and list of\n"
-"         <classname>X509</classname> objects which form a chain to a trusted\n"
-"         certificate.  Certain aspects of the verification are handled but not others.\n"
-"         The certificates will be verified against <constant>notBefore</constant>,\n"
-"         <constant>notAfter</constant> and trusted certificates.  It crucially will\n"
-"         not handle checking the certificate against CRLs.  This functionality will\n"
-"         probably make it into OpenSSL 0.9.7.\n"
-"      </para>\n"
-"      <para>\n"
-"         This may all sound quite straight forward but determining the\n"
-"         certificate associated with the signature on another certificate\n"
-"         can be very time consuming.  The management aspects of\n"
-"         certificates are addressed by various V3 extensions which are not\n"
-"         currently supported.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_store_object_verify_chain(x509_store_object *self, PyObject *args)
-{
-  PyObject *x509_sequence = NULL;
-  X509_STORE_CTX csc;
-  x509_object *x509 = NULL;
-  STACK_OF(X509) *x509_stack = NULL;
-  int ok;
-
-  if (!PyArg_ParseTuple(args, "O!O", &x509type, &x509, &x509_sequence))
-    goto error;
-
-  if ((x509_stack = x509_helper_sequence_to_stack(x509_sequence)) == NULL)
-    goto error;
-
-  X509_STORE_CTX_init(&csc, self->store, x509->x509, x509_stack);
-
-  ok = X509_verify_cert(&csc) == 1;
-
-  X509_STORE_CTX_cleanup(&csc);
-  sk_X509_free(x509_stack);
-
-  return PyBool_FromLong(ok);
-
- error:
-
-  if (x509_stack)
-    sk_X509_free(x509_stack);
-
-  return NULL;
-}
-
-static char x509_store_object_verify_detailed__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Store</memberof>\n"
-"      <name>verifyDetailed</name>\n"
-"      <parameter>certificate</parameter>\n"
-"      <optional>\n"
-"        <parameter>chain</parameter>\n"
-"      </optional>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         The <classname>X509Store</classname> method <function>verifyDetailed</function>\n"
-"         is based on the <function>X509_verify_cert</function> but is initialised\n"
-"         with a <classname>X509</classname> object to verify and list of\n"
-"         <classname>X509</classname> objects which form a chain to a trusted\n"
-"         certificate.  Certain aspects of the verification are handled but not others.\n"
-"         The certificates will be verified against <constant>notBefore</constant>,\n"
-"         <constant>notAfter</constant> and trusted certificates.  It crucially will\n"
-"         not handle checking the certificate against CRLs.  This functionality will\n"
-"         probably make it into OpenSSL 0.9.7.\n"
-"      </para>\n"
-"      <para>\n"
-"         This may all sound quite straight forward but determining the\n"
-"         certificate associated with the signature on another certificate\n"
-"         can be very time consuming.  The management aspects of\n"
-"         certificates are addressed by various V3 extensions which are not\n"
-"         currently supported.\n"
-"      </para>\n"
-"      <para>\n"
-"         Unlike the <function>verify</function> and <function>verifyChain</function>\n"
-"         methods, <function>verifyDetailed</function> returns some information about\n"
-"         what went wrong when verification fails.  The return value is currently a 3-tuple:\n"
-"         the first value is the return value from X509_verify_cert(), the second and third\n"
-"         are the error and error_depth values from the X509_STORE_CTX.\n"
-"         Other values may added to this tuple later.\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_store_object_verify_detailed(x509_store_object *self, PyObject *args)
-{
-  PyObject *x509_sequence = Py_None;
-  X509_STORE_CTX csc;
-  x509_object *x509 = NULL;
-  STACK_OF(X509) *x509_stack = NULL;
-  PyObject *result = NULL;
-  int ok;
-
-  if (!PyArg_ParseTuple(args, "O!|O", &x509type, &x509, &x509_sequence))
-    goto error;
-
-  if (x509_sequence && !(x509_stack = x509_helper_sequence_to_stack(x509_sequence)))
-    goto error;
-
-  X509_STORE_CTX_init(&csc, self->store, x509->x509, x509_stack);
-
-  ok = X509_verify_cert(&csc) == 1;
-
-  result = Py_BuildValue("(iii)", ok, csc.error, csc.error_depth);
-
-  X509_STORE_CTX_cleanup(&csc);
-
- error:                          /* fall through */
-
-  if (x509_stack)
-    sk_X509_free(x509_stack);
-
-  return result;
-}
-
-static char x509_store_object_add_trust__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Store</memberof>\n"
-"      <name>addTrust</name>\n"
-"      <parameter>cert</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method adds a new certificate to the store to be used in the\n"
-"         verification process.  <parameter>cert</parameter> should be an\n"
-"         instance of <classname>X509</classname>.  Using trusted certificates to manage\n"
-"         verification is relatively primitive, more sophisticated systems\n"
-"         can be constructed at an application level by by constructing\n"
-"         certificate chains to verify.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_store_object_add_trust(x509_store_object *self, PyObject *args)
-{
-  x509_object *x509 = NULL;
-
-  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
-    goto error;
-
-  X509_STORE_add_cert(self->store, x509->x509);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char x509_store_object_add_crl__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Store</memberof>\n"
-"      <name>addCrl</name>\n"
-"      <parameter>crl</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method adds a CRL to a store to be used for verification.\n"
-"         <parameter>crl</parameter> should be an instance of\n"
-"         <classname>X509Crl</classname>.\n"
-"         Unfortunately, the current stable release of OpenSSL does not\n"
-"         support CRL checking for certificate verification.\n"
-"         This functionality will probably make it into OpenSSL 0.9.7, until\n"
-"         it does this function is useless and CRL verification must be\n"
-"         implemented by the application.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_store_object_add_crl(x509_store_object *self, PyObject *args)
-{
-  x509_crl_object *crl = NULL;
-
-  if (!PyArg_ParseTuple(args, "O!", &x509_crltype, &crl))
-    goto error;
-
-  X509_STORE_add_crl(self->store, crl->crl);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static struct PyMethodDef x509_store_object_methods[] = {
-  {"verify",         (PyCFunction)x509_store_object_verify,          METH_VARARGS,  NULL},
-  {"verifyChain",    (PyCFunction)x509_store_object_verify_chain,    METH_VARARGS,  NULL},
-  {"verifyDetailed", (PyCFunction)x509_store_object_verify_detailed, METH_VARARGS,  NULL},
-  {"addTrust",       (PyCFunction)x509_store_object_add_trust,       METH_VARARGS,  NULL},
-  {"addCrl",         (PyCFunction)x509_store_object_add_crl,         METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-x509_store_object_getattr(x509_store_object *self, char *name)
-{
-  return Py_FindMethod(x509_store_object_methods, (PyObject *)self, name);
-}
-
-static void
-x509_store_object_dealloc(x509_store_object *self, char *name)
-{
-  X509_STORE_free(self->store);
-  PyObject_Del(self);
-}
-
-static char x509_storetype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>X509Store</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides preliminary access to OpenSSL X509 verification\n"
-"         facilities.\n"
-"      </para>\n"
-"\n"
-"      <example>\n"
-"         <title><classname>x509_store</classname> class usage</title>\n"
-"         <programlisting>\n"
-"      store = POW.X509Store()\n"
-"\n"
-"      caFile = open('test/cacert.pem', 'r')\n"
-"      ca = POW.pemRead(POW.X509_CERTIFICATE, caFile.read())\n"
-"      caFile.close()\n"
-"\n"
-"      store.addTrust(ca)\n"
-"\n"
-"      certFile = open('test/foocom.cert', 'r')\n"
-"      x509 = POW.pemRead(POW.X509_CERTIFICATE, certFile.read())\n"
-"      certFile.close()\n"
-"\n"
-"      print x509.pprint()\n"
-"\n"
-"      if store.verify(x509):\n"
-"         print 'Verified certificate!.'\n"
-"      else:\n"
-"         print 'Failed to verify certificate!.'\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject x509_storetype = {
-   PyObject_HEAD_INIT(0)
-   0,                                        /*ob_size*/
-   "X509Store",                              /*tp_name*/
-   sizeof(x509_store_object),                /*tp_basicsize*/
-   0,                                        /*tp_itemsize*/
-   (destructor)x509_store_object_dealloc,    /*tp_dealloc*/
-   (printfunc)0,                             /*tp_print*/
-   (getattrfunc)x509_store_object_getattr,   /*tp_getattr*/
-   (setattrfunc)0,                           /*tp_setattr*/
-   (cmpfunc)0,                               /*tp_compare*/
-   (reprfunc)0,                              /*tp_repr*/
-   0,                                        /*tp_as_number*/
-   0,                                        /*tp_as_sequence*/
-   0,                                        /*tp_as_mapping*/
-   (hashfunc)0,                              /*tp_hash*/
-   (ternaryfunc)0,                           /*tp_call*/
-   (reprfunc)0,                              /*tp_str*/
-   0,
-   0,
-   0,
-   0,
-   x509_storetype__doc__                    /* Documentation string */
-};
-/*========== x509 store Code ==========*/
-
-/*========== x509 crl Code ==========*/
-static x509_crl_object *
-x509_crl_object_new(void)
-{
-  x509_crl_object *self = NULL;
-
-  self = PyObject_New(x509_crl_object, &x509_crltype);
-  if (self == NULL)
-    goto error;
-
-  self->crl = X509_CRL_new();
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static x509_crl_object *
-x509_crl_object_pem_read(BIO *in)
-{
-  x509_crl_object *self;
-
-  if ((self = PyObject_New(x509_crl_object, &x509_crltype)) == NULL)
-    goto error;
-
-  if ((self->crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL)) == NULL)
-    lose("could not load certificate");
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static x509_crl_object *
-x509_crl_object_der_read(unsigned char *src, int len)
-{
-  x509_crl_object *self;
-  unsigned char* ptr = src;
-
-  if ((self = PyObject_New(x509_crl_object, &x509_crltype)) == NULL)
-    goto error;
-
-  self->crl = X509_CRL_new();
-
-  if (!d2i_X509_CRL(&self->crl, (const unsigned char **) &ptr, len))
-    lose("could not load PEM encoded CRL");
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static char x509_crl_object_get_version__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>getVersion</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the version number from the version field of\n"
-"         this CRL.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_get_version(x509_crl_object *self, PyObject *args)
-{
-  long version = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((version = ASN1_INTEGER_get(self->crl->crl->version)) == -1)
-    lose("could not get crl version");
-
-  return Py_BuildValue("l", version);
-
- error:
-
-  return NULL;
-}
-
-static char x509_crl_object_set_version__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>setVersion</name>\n"
-"      <parameter>version</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method sets the version number in the version field of\n"
-"         this CRL.  <parameter>version</parameter> should be an\n"
-"         integer.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_set_version(x509_crl_object *self, PyObject *args)
-{
-  long version = 0;
-  ASN1_INTEGER *asn1_version = NULL;
-
-  if (!PyArg_ParseTuple(args, "i", &version))
-    goto error;
-
-  if ((asn1_version = ASN1_INTEGER_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!ASN1_INTEGER_set(asn1_version, version))
-    lose("could not get set version");
-
-  self->crl->crl->version = asn1_version;
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (asn1_version)
-    ASN1_INTEGER_free(asn1_version);
-
-  return NULL;
-}
-
-static char x509_crl_object_get_issuer__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>getIssuer</name>\n"
-"      <parameter>format = SHORTNAME_FORMAT</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a tuple containing the issuers name.  See the\n"
-"         <function>getIssuer</function> method of\n"
-"         <classname>X509</classname> for more details.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_get_issuer(x509_crl_object *self, PyObject *args)
-{
-  PyObject *result_list = NULL;
-  int format = SHORTNAME_FORMAT;
-
-  if (!PyArg_ParseTuple(args, "|i", &format))
-    goto error;
-
-  if ((result_list = X509_object_helper_get_name(self->crl->crl->issuer, format)) == NULL)
-    lose("failed to produce name list");
-
-  return result_list;
-
- error:
-
-  return NULL;
-}
-
-static char x509_crl_object_set_issuer__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>setIssuer</name>\n"
-"      <parameter>name</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to set the issuers name.\n"
-"         <parameter>name</parameter> can be comprised of lists or tuples in\n"
-"         the format described in the <function>getIssuer</function> method\n"
-"         of <classname>X509</classname>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_set_issuer(x509_crl_object *self, PyObject *args)
-{
-  PyObject *name_sequence = NULL;
-  X509_NAME *name = NULL;
-
-  if (!PyArg_ParseTuple(args, "O", &name_sequence))
-    goto error;
-
-  if (!PyTuple_Check(name_sequence) && !PyList_Check(name_sequence))
-    lose_type_error("Inapropriate type");
-
-  if ((name = X509_NAME_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!X509_object_helper_set_name(name, name_sequence))
-    lose("unable to set new name");
-
-  if (!X509_NAME_set(&self->crl->crl->issuer, name))
-    lose("unable to set name");
-
-  X509_NAME_free(name);
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (name)
-    X509_NAME_free(name);
-
-  return  NULL;
-}
-
-static char x509_crl_object_set_this_update__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>setThisUpdate</name>\n"
-"      <parameter>time</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this accepts one parameter, a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_set_this_update (x509_crl_object *self, PyObject *args)
-{
-  char *new_time = NULL;
-
-  if (!PyArg_ParseTuple(args, "s", &new_time))
-    goto error;
-
-  if (!python_ASN1_TIME_set_string(self->crl->crl->lastUpdate, new_time))
-    lose("Could not set lastUpdate");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char x509_crl_object_get_this_update__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>getThisUpdate</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this function returns a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_get_this_update (x509_crl_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  return ASN1_TIME_to_Python(self->crl->crl->lastUpdate);
-
- error:
-
-  return NULL;
-}
-
-static char x509_crl_object_set_next_update__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>setNextUpdate</name>\n"
-"      <parameter>time</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this accepts one parameter, a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_set_next_update (x509_crl_object *self, PyObject *args)
-{
-  char *new_time = NULL;
-  ASN1_UTCTIME *time = NULL;
-
-  if (!PyArg_ParseTuple(args, "s", &new_time))
-    goto error;
-
-  if (self->crl->crl->nextUpdate == NULL && (time = ASN1_UTCTIME_new()) == NULL)
-    lose("could not allocate memory");
-
-  self->crl->crl->nextUpdate = time;
-
-  if (!python_ASN1_TIME_set_string(time, new_time))
-    lose("Could not set nextUpdate");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char x509_crl_object_get_next_update__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>getNextUpdate</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this function returns a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_get_next_update (x509_crl_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  return ASN1_TIME_to_Python(self->crl->crl->nextUpdate);
-
- error:
-
-  return NULL;
-}
-
-static char x509_crl_object_set_revoked__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>setRevoked</name>\n"
-"      <parameter>revoked</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method sets the sequence of revoked certificates in this CRL.\n"
-"         <parameter>revoked</parameter> should be a list or tuple of\n"
-"         <classname>X509Revoked</classname>.\n"
-"      </para>\n"
-"      <example>\n"
-"         <title><function>setRevoked</function> function usage</title>\n"
-"         <programlisting>\n"
-"      privateFile = open('test/private.key', 'r')\n"
-"      publicFile = open('test/public.key', 'r')\n"
-"      crlFile = open('test/crl.pem', 'w')\n"
-"\n"
-"      publicKey = POW.pemRead(POW.RSA_PUBLIC_KEY, publicFile.read())\n"
-"      privateKey = POW.pemRead(POW.RSA_PRIVATE_KEY, privateFile.read(), 'pass')\n"
-"\n"
-"      crl = POW.X509Crl()\n"
-"\n"
-"      name = [  ['C', 'GB'], ['ST', 'Hertfordshire'],\n"
-"                ['O','The House'], ['CN', 'Peter Shannon'] ]\n"
-"\n"
-"      t1 = POW.pkix.time2utc(time.time())\n"
-"      t2 = POW.pkix.time2utc(time.time() + 60*60*24*365)\n"
-"      crl.setIssuer(name)\n"
-"      rev = [  POW.X509Revoked(3, t1),\n"
-"               POW.X509Revoked(4, t1),\n"
-"               POW.X509Revoked(5, t1)    ]\n"
-"\n"
-"      crl.setRevoked(rev)\n"
-"      crl.setThisUpdate(t1)\n"
-"      crl.setNextUpdate(t2)\n"
-"      crl.sign(privateKey)\n"
-"\n"
-"      crlFile.write(crl.pemWrite())\n"
-"\n"
-"      privateFile.close()\n"
-"      publicFile.close()\n"
-"      crlFile.close()\n"
-"         </programlisting>\n"
-"      </example>\n"
-"\n"
-"   </body>\n"
-"</method>\n"
-;
-
-// added because we don't already have one!
-static X509_REVOKED *
-X509_REVOKED_dup(X509_REVOKED *rev)
-{
-  return((X509_REVOKED *)ASN1_dup((i2d_of_void *) i2d_X509_REVOKED,
-                                  (d2i_of_void *) d2i_X509_REVOKED,
-                                  (char *) rev));
-}
-
-static PyObject *
-x509_crl_object_set_revoked(x509_crl_object *self, PyObject *args)
-{
-  PyObject *revoked_sequence = NULL;
-  x509_revoked_object *revoked = NULL;
-  X509_REVOKED *tmp_revoked = NULL;
-  int i = 0,size = 0;
-
-  if (!PyArg_ParseTuple(args, "O", &revoked_sequence))
-    goto error;
-
-  if (!PyTuple_Check(revoked_sequence) && !PyList_Check(revoked_sequence))
-    lose_type_error("inapropriate type");
-
-  size = PySequence_Size(revoked_sequence);
-  for (i = 0; i < size; i++) {
-    if ((revoked = (x509_revoked_object*) PySequence_GetItem(revoked_sequence, i)) == NULL)
-      goto error;
-
-    if (!X_X509_revoked_Check(revoked))
-      lose_type_error("inapropriate type");
-
-    if ((tmp_revoked = X509_REVOKED_dup(revoked->revoked)) == NULL)
-      lose("could not allocate memory");
-
-    if (!X509_CRL_add0_revoked(self->crl, tmp_revoked))
-      lose("could not add revokation to stack");
-
-    Py_XDECREF(revoked);
-    revoked = NULL;
-  }
-
-  Py_RETURN_NONE;
-
- error:
-
-  Py_XDECREF(revoked);
-
-  return  NULL;
-}
-
-static PyObject *
-x509_crl_object_helper_get_revoked(STACK_OF(X509_REVOKED) *revoked)
-{
-  int no_entries = 0, i = 0;
-  x509_revoked_object *revoke_obj = NULL;
-  PyObject *result_list = NULL, *result_tuple = NULL;
-
-  no_entries = sk_X509_REVOKED_num(revoked);
-
-  if ((result_list = PyList_New(0)) == NULL)
-    lose("could not allocate memory");
-
-  for (i = 0; i < no_entries; i++) {
-    if ((revoke_obj = PyObject_New(x509_revoked_object, &x509_revokedtype)) == NULL)
-      lose("could not allocate memory");
-
-    if ((revoke_obj->revoked = X509_REVOKED_dup(sk_X509_REVOKED_value(revoked, i))) == NULL)
-      lose("could not get revocation");
-
-    if (PyList_Append(result_list, (PyObject*) revoke_obj) != 0)
-      goto error;
-
-    Py_XDECREF(revoke_obj);
-    revoke_obj = NULL;
-  }
-
-  result_tuple = PyList_AsTuple(result_list);
-  Py_XDECREF(result_list);
-
-  return result_tuple;
-
- error:
-
-  Py_XDECREF(revoke_obj);
-  Py_XDECREF(result_list);
-  return NULL;
-}
-
-static char x509_crl_object_get_revoked__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>getRevoked</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a tuple of <classname>X509Revoked</classname>\n"
-"         objects described in the CRL.\n"
-"      </para>\n"
-"      <example>\n"
-"         <title><function>getRevoked</function> function usage</title>\n"
-"         <programlisting>\n"
-"      publicFile = open('test/public.key', 'r')\n"
-"      crlFile = open('test/crl.pem', 'r')\n"
-"\n"
-"      publicKey = POW.pemRead(POW.RSA_PUBLIC_KEY, publicFile.read())\n"
-"\n"
-"      crl = POW.pemRead(POW.X509_CRL, crlFile.read())\n"
-"\n"
-"      print crl.pprint()\n"
-"      if crl.verify(publicKey):\n"
-"         print 'signature ok!'\n"
-"      else:\n"
-"         print 'signature not ok!'\n"
-"\n"
-"      revocations = crl.getRevoked()\n"
-"      for revoked in revocations:\n"
-"         print 'serial number:', revoked.getSerial()\n"
-"         print 'date:', time.ctime(revoked.getDate()[0])\n"
-"\n"
-"      publicFile.close()\n"
-"      crlFile.close()\n"
-"         </programlisting>\n"
-"      </example>\n"
-"\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_get_revoked(x509_crl_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  return x509_crl_object_helper_get_revoked(X509_CRL_get_REVOKED(self->crl));
-
- error:
-
-  return NULL;
-}
-
-static char X509_crl_object_add_extension__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>addExtension</name>\n"
-"      <parameter>extensionName</parameter>\n"
-"      <parameter>critical</parameter>\n"
-"      <parameter>extensionValue</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method adds an extension to this CRL.\n"
-"         <parameter>extensionName</parameter> should be the of the\n"
-"         extension.  <parameter>critical</parameter> should an integer, 1\n"
-"         for true and 0 for clase.  <parameter>extensionValue</parameter>\n"
-"         should be a string, DER encoded value of the extension.  The name\n"
-"         of the extension must be correct according to OpenSSL and can be\n"
-"         checkd in the <constant>objects.h</constant> header file, part of\n"
-"         the OpenSSL source distrobution.  In the majority of cases they\n"
-"         are the same as those defined in <constant>POW._oids</constant>\n"
-"         but if you do encounter problems is may be worth checking.\n"
-"      </para>\n"
-"      <example>\n"
-"         <title><function>addExtension</function> method usage</title>\n"
-"         <programlisting>\n"
-"      oids = POW.pkix.OidData()\n"
-"      o2i = oids.obj2oid\n"
-"\n"
-"      n1 = ('directoryName',  (((o2i('countryName'), ('printableString', 'UK')),),\n"
-"                               ((o2i('stateOrProvinceName'), ('printableString', 'Herts')),),\n"
-"                               ((o2i('organizationName'), ('printableString', 'The House')),),\n"
-"                               ((o2i('commonName'), ('printableString', 'Shannon Works')),)))\n"
-"\n"
-"      n2 = ('rfc822Name', 'peter_shannon@yahoo.com')\n"
-"      n3 = ('uri', 'http://www.p-s.org.uk')\n"
-"      n4 = ('iPAddress', (192,168,100,51))\n"
-"\n"
-"      issuer = POW.pkix.IssuerAltName()\n"
-"      issuer.set([n1,n2,n3,n4])\n"
-"      crl.addExtension('issuerAltName', 0, issuer.toString())\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_crl_object_add_extension(x509_crl_object *self, PyObject *args)
-{
-  int critical = 0, nid = 0, len = 0;
-  char *name = NULL;
-  unsigned char *buf = NULL;
-  ASN1_OCTET_STRING *octetString = NULL;
-  X509_EXTENSION *extn = NULL;
-
-  if (!PyArg_ParseTuple(args, "sis#", &name, &critical, &buf, &len))
-    goto error;
-
-  if ((octetString = M_ASN1_OCTET_STRING_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!ASN1_OCTET_STRING_set(octetString, buf, len))
-    lose("could not set ASN1 Octect string");
-
-  if ((nid = OBJ_txt2nid(name)) == NID_undef)
-    lose("extension has unknown object identifier");
-
-  if ((extn = X509_EXTENSION_create_by_NID(NULL, nid, critical, octetString)) == NULL)
-    lose("unable to create ASN1 X509 Extension object");
-
-  if (!self->crl->crl->extensions &&
-      (self->crl->crl->extensions = sk_X509_EXTENSION_new_null()) == NULL)
-    lose("unable to allocate memory");
-
-  if (!sk_X509_EXTENSION_push(self->crl->crl->extensions, extn))
-    lose("unable to add extension");
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (extn)
-    X509_EXTENSION_free(extn);
-
-  return NULL;
-}
-
-static char X509_crl_object_clear_extensions__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>clearExtensions</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method clears the structure which holds the extension for\n"
-"         this CRL.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_crl_object_clear_extensions(x509_crl_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (self->crl->crl->extensions) {
-    sk_X509_EXTENSION_free(self->crl->crl->extensions);
-    self->crl->crl->extensions = NULL;
-  }
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char X509_crl_object_count_extensions__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>countExtensions</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the size of the structure which holds the\n"
-"         extension for this CRL.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_crl_object_count_extensions(x509_crl_object *self, PyObject *args)
-{
-  int num = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (self->crl->crl->extensions)
-    num = sk_X509_EXTENSION_num(self->crl->crl->extensions);
-
-  return Py_BuildValue("i", num);
-
- error:
-
-  return NULL;
-}
-
-static char X509_crl_object_get_extension__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>getExtension</name>\n"
-"      <parameter>index</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a tuple equivalent the parameters of\n"
-"         <function>addExtension</function>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_crl_object_get_extension(x509_crl_object *self, PyObject *args)
-{
-  int num = 0, index = 0, ext_nid = 0;
-  char const *ext_ln = NULL;
-  char unknown_ext [] = "unknown";
-  X509_EXTENSION *ext;
-
-  if (!PyArg_ParseTuple(args, "i", &index))
-    goto error;
-
-  if (self->crl->crl->extensions)
-    num = sk_X509_EXTENSION_num(self->crl->crl->extensions);
-
-
-  if (index >= num)
-    lose("certificate does not have that many extensions");
-
-  if ((ext = sk_X509_EXTENSION_value(self->crl->crl->extensions, index)) == NULL)
-    lose("could not get extension");
-
-  if ((ext_nid = OBJ_obj2nid(ext->object)) == NID_undef)
-    lose("extension has unknown object identifier");
-
-  if ((ext_ln = OBJ_nid2sn(ext_nid)) == NULL)
-    ext_ln = unknown_ext;
-
-  return Py_BuildValue("sis#", ext_ln, ext->critical, ext->value->data, ext->value->length);
-
- error:
-
-  return NULL;
-}
-
-static char x509_crl_object_sign__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>sign</name>\n"
-"      <parameter>key</parameter>\n"
-"      <parameter>digest = MD5_DIGEST</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         <parameter>key</parameter> should be an instance of\n"
-"         <classname>Asymmetric</classname> and contain a private key.\n"
-"         <parameter>digest</parameter> indicates\n"
-"         which digest function should be used to compute the hash to be\n"
-"         signed, it should be one of the following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-#ifndef OPENSSL_NO_MD2
-"         <member><constant>MD2_DIGEST</constant></member>\n"
-#endif
-"         <member><constant>MD5_DIGEST</constant></member>\n"
-"         <member><constant>SHA_DIGEST</constant></member>\n"
-"         <member><constant>SHA1_DIGEST</constant></member>\n"
-"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
-"         <member><constant>SHA256_DIGEST</constant></member>\n"
-"         <member><constant>SHA384_DIGEST</constant></member>\n"
-"         <member><constant>SHA512_DIGEST</constant></member>\n"
-"     </simplelist>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_sign(x509_crl_object *self, PyObject *args)
-{
-  EVP_PKEY *pkey = NULL;
-  asymmetric_object *asym;
-  int digest = MD5_DIGEST;
-
-  if (!PyArg_ParseTuple(args, "O!|i", &asymmetrictype, &asym, &digest))
-    goto error;
-
-  if ((pkey = EVP_PKEY_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (asym->key_type != RSA_PRIVATE_KEY)
-    lose("cannot use this type of key");
-
-  if (!EVP_PKEY_assign_RSA(pkey, asym->cipher))
-    lose("EVP_PKEY assignment error");
-
-  switch (digest) {
-  case MD5_DIGEST:
-    if (!X509_CRL_sign(self->crl, pkey, EVP_md5()))
-      lose("could not sign CRL");
-    break;
-
-#ifndef OPENSSL_NO_MD2
-  case MD2_DIGEST:
-    if (!X509_CRL_sign(self->crl, pkey, EVP_md2()))
-      lose("could not sign CRL");
-    break;
-#endif
-
-  case SHA_DIGEST:
-    if (!X509_CRL_sign(self->crl, pkey, EVP_sha()))
-      lose("could not sign CRL");
-    break;
-
-  case SHA1_DIGEST:
-    if (!X509_CRL_sign(self->crl, pkey, EVP_sha1()))
-      lose("could not sign CRL");
-    break;
-
-  case RIPEMD160_DIGEST:
-    if (!X509_CRL_sign(self->crl, pkey, EVP_ripemd160()))
-      lose("could not sign CRL");
-    break;
-
-  case SHA256_DIGEST:
-    if (!X509_CRL_sign(self->crl, pkey, EVP_sha256()))
-      lose("could not sign CRL");
-    break;
-
-  case SHA384_DIGEST:
-    if (!X509_CRL_sign(self->crl, pkey, EVP_sha384()))
-      lose("could not sign CRL");
-    break;
-
-  case SHA512_DIGEST:
-    if (!X509_CRL_sign(self->crl, pkey, EVP_sha512()))
-      lose("could not sign CRL");
-    break;
-  }
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (pkey)
-    EVP_PKEY_free(pkey);
-
-  return NULL;
-
-}
-
-static char x509_crl_object_verify__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>verify</name>\n"
-"      <parameter>key</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         The <classname>X509Crl</classname> method\n"
-"         <function>verify</function> is based on the\n"
-"         <function>X509_CRL_verify</function> function.  Unlike the\n"
-"         <classname>X509</classname> function of the same name, this\n"
-"         function simply checks the CRL was signed with the private key\n"
-"         which corresponds the parameter <parameter>key</parameter>.\n"
-"         <parameter>key</parameter> should be an instance of\n"
-"         <classname>Asymmetric</classname> and contain a public key.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_verify(x509_crl_object *self, PyObject *args)
-{
-  EVP_PKEY *pkey = NULL;
-  asymmetric_object *asym;
-  int ok;
-
-  if (!PyArg_ParseTuple(args, "O!", &asymmetrictype, &asym))
-    goto error;
-
-  if ((pkey = EVP_PKEY_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!EVP_PKEY_assign_RSA(pkey, asym->cipher))
-    lose("EVP_PKEY assignment error");
-
-  ok = X509_CRL_verify(self->crl, pkey);
-
-  return PyBool_FromLong(ok);
-
- error:
-
-  if (pkey)
-    EVP_PKEY_free(pkey);
-
-  return NULL;
-
-}
-
-static PyObject *
-x509_crl_object_write_helper(x509_crl_object *self, PyObject *args, int format)
-{
-  int len = 0, ret = 0;
-  char *buf = NULL;
-  BIO *out_bio = NULL;
-  PyObject *cert = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  out_bio = BIO_new(BIO_s_mem());
-
-  switch (format) {
-
-  case DER_FORMAT:
-    if (!i2d_X509_CRL_bio(out_bio, self->crl))
-      lose("unable to write certificate");
-    break;
-
-  case PEM_FORMAT:
-    if (!PEM_write_bio_X509_CRL(out_bio, self->crl))
-      lose("unable to write certificate");
-
-  default:
-    lose("internal error, unknown output format");
-  }
-
-  if ((len = BIO_ctrl_pending(out_bio)) == 0)
-    lose("unable to get bytes stored in bio");
-
-  if ((buf = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  if ((ret = BIO_read(out_bio, buf, len)) != len)
-    lose("unable to write out cert");
-
-  cert = Py_BuildValue("s#", buf, len);
-
-  BIO_free(out_bio);
-  free(buf);
-  return cert;
-
- error:
-
-  if (out_bio)
-    BIO_free(out_bio);
-
-  if (buf)
-    free(buf);
-
-  return NULL;
-}
-
-static char x509_crl_object_pem_write__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>pemWrite</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a PEM encoded CRL as a\n"
-"         string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_pem_write(x509_crl_object *self, PyObject *args)
-{
-  return x509_crl_object_write_helper(self, args, PEM_FORMAT);
-}
-
-static char x509_crl_object_der_write__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>derWrite</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a DER encoded CRL as a string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_der_write(x509_crl_object *self, PyObject *args)
-{
-  return x509_crl_object_write_helper(self, args, DER_FORMAT);
-}
-
-static char x509_crl_object_pprint__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Crl</memberof>\n"
-"      <name>pprint</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a formatted string showing the information\n"
-"         held in the CRL.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_crl_object_pprint(x509_crl_object *self, PyObject *args)
-{
-  int len = 0, ret = 0;
-  char *buf = NULL;
-  BIO *out_bio = NULL;
-  PyObject *crl = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  out_bio = BIO_new(BIO_s_mem());
-
-  if (!X509_CRL_print(out_bio, self->crl))
-    lose("unable to write crl");
-
-  if ((len = BIO_ctrl_pending(out_bio)) == 0)
-    lose("unable to get bytes stored in bio");
-
-  if ((buf = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  if ((ret = BIO_read(out_bio, buf, len)) != len)
-    lose("unable to write out cert");
-
-  crl = Py_BuildValue("s#", buf, len);
-
-  BIO_free(out_bio);
-  free(buf);
-  return crl;
-
- error:
-
-  if (out_bio)
-    BIO_free(out_bio);
-
-  if (buf)
-    free(buf);
-
-  return NULL;
-
-}
-
-static struct PyMethodDef x509_crl_object_methods[] = {
-  {"sign",             (PyCFunction)x509_crl_object_sign,              METH_VARARGS,  NULL},
-  {"verify",           (PyCFunction)x509_crl_object_verify,            METH_VARARGS,  NULL},
-  {"getVersion",       (PyCFunction)x509_crl_object_get_version,       METH_VARARGS,  NULL},
-  {"setVersion",       (PyCFunction)x509_crl_object_set_version,       METH_VARARGS,  NULL},
-  {"getIssuer",        (PyCFunction)x509_crl_object_get_issuer,        METH_VARARGS,  NULL},
-  {"setIssuer",        (PyCFunction)x509_crl_object_set_issuer,        METH_VARARGS,  NULL},
-  {"getThisUpdate",    (PyCFunction)x509_crl_object_get_this_update,   METH_VARARGS,  NULL},
-  {"setThisUpdate",    (PyCFunction)x509_crl_object_set_this_update,   METH_VARARGS,  NULL},
-  {"getNextUpdate",    (PyCFunction)x509_crl_object_get_next_update,   METH_VARARGS,  NULL},
-  {"setNextUpdate",    (PyCFunction)x509_crl_object_set_next_update,   METH_VARARGS,  NULL},
-  {"setRevoked",       (PyCFunction)x509_crl_object_set_revoked,       METH_VARARGS,  NULL},
-  {"getRevoked",       (PyCFunction)x509_crl_object_get_revoked,       METH_VARARGS,  NULL},
-  {"addExtension",     (PyCFunction)X509_crl_object_add_extension,     METH_VARARGS,  NULL},
-  {"clearExtensions",  (PyCFunction)X509_crl_object_clear_extensions,  METH_VARARGS,  NULL},
-  {"countExtensions",  (PyCFunction)X509_crl_object_count_extensions,  METH_VARARGS,  NULL},
-  {"getExtension",     (PyCFunction)X509_crl_object_get_extension,     METH_VARARGS,  NULL},
-  {"pemWrite",         (PyCFunction)x509_crl_object_pem_write,         METH_VARARGS,  NULL},
-  {"derWrite",         (PyCFunction)x509_crl_object_der_write,         METH_VARARGS,  NULL},
-  {"pprint",           (PyCFunction)x509_crl_object_pprint,            METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-x509_crl_object_getattr(x509_crl_object *self, char *name)
-{
-  return Py_FindMethod(x509_crl_object_methods, (PyObject *)self, name);
-}
-
-static void
-x509_crl_object_dealloc(x509_crl_object *self, char *name)
-{
-  X509_CRL_free(self->crl);
-  PyObject_Del(self);
-}
-
-static char x509_crltype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>X509Crl</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides access to OpenSSL X509 CRL management\n"
-"         facilities.\n"
-"      </para>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject x509_crltype = {
-  PyObject_HEAD_INIT(0)
-  0,                                     /*ob_size*/
-  "X509Crl",                             /*tp_name*/
-  sizeof(x509_crl_object),               /*tp_basicsize*/
-  0,                                     /*tp_itemsize*/
-  (destructor)x509_crl_object_dealloc,   /*tp_dealloc*/
-  (printfunc)0,                          /*tp_print*/
-  (getattrfunc)x509_crl_object_getattr,  /*tp_getattr*/
-  (setattrfunc)0,                        /*tp_setattr*/
-  (cmpfunc)0,                            /*tp_compare*/
-  (reprfunc)0,                           /*tp_repr*/
-  0,                                     /*tp_as_number*/
-  0,                                     /*tp_as_sequence*/
-  0,                                     /*tp_as_mapping*/
-  (hashfunc)0,                           /*tp_hash*/
-  (ternaryfunc)0,                        /*tp_call*/
-  (reprfunc)0,                           /*tp_str*/
-  0,
-  0,
-  0,
-  0,
-  x509_crltype__doc__                   /* Documentation string */
-};
-/*========== x509 crl Code ==========*/
-
-/*========== revoked Code ==========*/
-x509_revoked_object* x509_revoked_object_new(void)
-{
-  x509_revoked_object *self = NULL;
-
-  if ((self = PyObject_New(x509_revoked_object, &x509_revokedtype)) == NULL)
-    goto error;
-
-  self->revoked = X509_REVOKED_new();
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static char x509_revoked_object_set_serial__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <name>setSerial</name>\n"
-"      <parameter>serial</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method sets the serial number in the serial field of\n"
-"         this object.  <parameter>serial</parameter> should be an\n"
-"         integer.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_revoked_object_set_serial(x509_revoked_object *self, PyObject *args)
-{
-  int serial = 0;
-
-  if (!PyArg_ParseTuple(args, "i", &serial))
-    goto error;
-
-  if (!ASN1_INTEGER_set(self->revoked->serialNumber, serial))
-    lose("unable to set serial number");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char x509_revoked_object_get_serial__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <name>getSerial</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method gets the serial number in the serial field of\n"
-"         this object.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_revoked_object_get_serial(x509_revoked_object *self, PyObject *args)
-{
-  int serial = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((serial = ASN1_INTEGER_get(self->revoked->serialNumber)) == -1)
-    lose("unable to get serial number");
-
-  return Py_BuildValue("i", serial);
-
- error:
-
-  return NULL;
-}
-
-static char x509_revoked_object_get_date__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <name>getDate</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this function returns a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_revoked_object_get_date(x509_revoked_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  return ASN1_TIME_to_Python(self->revoked->revocationDate);
-
- error:
-
-  return NULL;
-}
-
-static char x509_revoked_object_set_date__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <name>setDate</name>\n"
-"      <parameter>time</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         In a change from previous releases, for reasons of portability\n"
-"         and to avoid hard to fix issues with problems in unreliable time\n"
-"         functions, this accepts one parameter, a UTCTime string.  You\n"
-"         can use the function <function>time2utc</function> to convert to a\n"
-"         string if you like and <function>utc2time</function> to back.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-x509_revoked_object_set_date(x509_revoked_object *self, PyObject *args)
-{
-  char *time = NULL;
-
-  if (!PyArg_ParseTuple(args, "s", &time))
-    goto error;
-
-  if (!python_ASN1_TIME_set_string(self->revoked->revocationDate, time))
-    lose_type_error("Could not set revocationDate");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char X509_revoked_object_add_extension__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <name>addExtension</name>\n"
-"      <parameter>extensionName</parameter>\n"
-"      <parameter>critical</parameter>\n"
-"      <parameter>extensionValue</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method adds an extension to this revocation.\n"
-"         <parameter>extensionName</parameter> should be the of the\n"
-"         extension.  <parameter>critical</parameter> should an integer, 1\n"
-"         for true and 0 for clase.  <parameter>extensionValue</parameter>\n"
-"         should be a string, DER encoded value of the extension.  The name\n"
-"         of the extension must be correct according to OpenSSL and can be\n"
-"         checkd in the <constant>objects.h</constant> header file, part of\n"
-"         the OpenSSL source distrobution.  In the majority of cases they\n"
-"         are the same as those defined in <constant>POW._oids</constant>\n"
-"         but if you do encounter problems is may be worth checking.\n"
-"      </para>\n"
-"      <example>\n"
-"         <title><function>addExtension</function> method usage</title>\n"
-"         <programlisting>\n"
-"      reason = POW.pkix.CrlReason()\n"
-"      reason.set(1)\n"
-"      revocation.addExtension('CRLReason', 0, reason.toString())\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_revoked_object_add_extension(x509_revoked_object *self, PyObject *args)
-{
-  int critical = 0, nid = 0, len = 0;
-  char *name = NULL;
-  unsigned char *buf = NULL;
-  ASN1_OCTET_STRING *octetString = NULL;
-  X509_EXTENSION *extn = NULL;
-
-  if (!PyArg_ParseTuple(args, "sis#", &name, &critical, &buf, &len))
-    goto error;
-
-  if ((octetString = M_ASN1_OCTET_STRING_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (!ASN1_OCTET_STRING_set(octetString, buf, strlen((char *) buf)))
-    lose("could not set ASN1 Octect string");
-
-  if ((nid = OBJ_txt2nid(name)) == NID_undef)
-    lose("extension has unknown object identifier");
-
-  if ((extn = X509_EXTENSION_create_by_NID(NULL, nid, critical, octetString)) == NULL)
-    lose("unable to create ASN1 X509 Extension object");
-
-  if (!self->revoked->extensions && (self->revoked->extensions = sk_X509_EXTENSION_new_null()) == NULL)
-    lose("unable to allocate memory");
-
-  if (!sk_X509_EXTENSION_push(self->revoked->extensions, extn))
-    lose("unable to add extension");
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (extn)
-    X509_EXTENSION_free(extn);
-
-  return NULL;
-}
-
-static char X509_revoked_object_clear_extensions__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <name>clearExtensions</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method clears the structure which holds the extension for\n"
-"         this revocation.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_revoked_object_clear_extensions(x509_revoked_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (self->revoked->extensions) {
-    sk_X509_EXTENSION_free(self->revoked->extensions);
-    self->revoked->extensions = NULL;
-  }
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char X509_revoked_object_count_extensions__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <name>countExtensions</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the size of the structure which holds the\n"
-"         extension for this revocation.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_revoked_object_count_extensions(x509_revoked_object *self, PyObject *args)
-{
-  int num = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (self->revoked->extensions)
-    num = sk_X509_EXTENSION_num(self->revoked->extensions);
-
-  return Py_BuildValue("i", num);
-
- error:
-
-  return NULL;
-}
-
-static char X509_revoked_object_get_extension__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <name>getExtension</name>\n"
-"      <parameter>index</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a tuple equivalent the parameters of\n"
-"         <function>addExtension</function>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-X509_revoked_object_get_extension(x509_revoked_object *self, PyObject *args)
-{
-  int num = 0, index = 0, ext_nid = 0;
-  char const *ext_ln = NULL;
-  char unknown_ext [] = "unknown";
-  X509_EXTENSION *ext;
-
-  if (!PyArg_ParseTuple(args, "i", &index))
-    goto error;
-
-  if (self->revoked->extensions)
-    num = sk_X509_EXTENSION_num(self->revoked->extensions);
-
-  if (index >= num)
-    lose("certificate does not have that many extensions");
-
-  if ((ext = sk_X509_EXTENSION_value(self->revoked->extensions, index)) == NULL)
-    lose("could not get extension");
-
-  if ((ext_nid = OBJ_obj2nid(ext->object)) == NID_undef)
-    lose("extension has unknown object identifier");
-
-  if ((ext_ln = OBJ_nid2sn(ext_nid)) == NULL)
-    ext_ln = unknown_ext;
-
-  return Py_BuildValue("sis#", ext_ln, ext->critical, ext->value->data, ext->value->length);
-
- error:
-
-  return NULL;
-}
-
-static struct PyMethodDef x509_revoked_object_methods[] = {
-  {"getSerial",         (PyCFunction)x509_revoked_object_get_serial,       METH_VARARGS,  NULL},
-  {"setSerial",         (PyCFunction)x509_revoked_object_set_serial,       METH_VARARGS,  NULL},
-  {"getDate",           (PyCFunction)x509_revoked_object_get_date,         METH_VARARGS,  NULL},
-  {"setDate",           (PyCFunction)x509_revoked_object_set_date,         METH_VARARGS,  NULL},
-  {"addExtension",      (PyCFunction)X509_revoked_object_add_extension,    METH_VARARGS,  NULL},
-  {"clearExtensions",   (PyCFunction)X509_revoked_object_clear_extensions, METH_VARARGS,  NULL},
-  {"countExtensions",   (PyCFunction)X509_revoked_object_count_extensions, METH_VARARGS,  NULL},
-  {"getExtension",      (PyCFunction)X509_revoked_object_get_extension,    METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-x509_revoked_object_getattr(x509_revoked_object *self, char *name)
-{
-  return Py_FindMethod(x509_revoked_object_methods, (PyObject *) self, name);
-}
-
-static void
-x509_revoked_object_dealloc(x509_revoked_object *self, char *name)
-{
-  X509_REVOKED_free(self->revoked);
-  PyObject_Del(self);
-}
-
-static char x509_revokedtype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>X509Revoked</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides a container for details of a revoked\n"
-"         certificate.  It normally would only be used in association with\n"
-"         a CRL, its not much use by itself.  Indeed the only reason this\n"
-"         class exists is because in the future POW is likely to be extended\n"
-"         to support extensions for certificates, CRLs and revocations.\n"
-"         <classname>X509Revoked</classname> existing as an object in its\n"
-"         own right will make adding this support easier, while avoiding\n"
-"         backwards compatibility issues.\n"
-"      </para>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject x509_revokedtype = {
-  PyObject_HEAD_INIT(0)
-  0,                                        /*ob_size*/
-  "X509Revoked",                            /*tp_name*/
-  sizeof(x509_revoked_object),              /*tp_basicsize*/
-  0,                                        /*tp_itemsize*/
-  (destructor)x509_revoked_object_dealloc,  /*tp_dealloc*/
-  (printfunc)0,                             /*tp_print*/
-  (getattrfunc)x509_revoked_object_getattr, /*tp_getattr*/
-  (setattrfunc)0,                           /*tp_setattr*/
-  (cmpfunc)0,                               /*tp_compare*/
-  (reprfunc)0,                              /*tp_repr*/
-  0,                                        /*tp_as_number*/
-  0,                                        /*tp_as_sequence*/
-  0,                                        /*tp_as_mapping*/
-  (hashfunc)0,                              /*tp_hash*/
-  (ternaryfunc)0,                           /*tp_call*/
-  (reprfunc)0,                              /*tp_str*/
-  0,
-  0,
-  0,
-  0,
-  x509_revokedtype__doc__                  /* Documentation string */
-};
-/*========== x509 revoked Code ==========*/
-
-/*========== ssl Code ==========*/
-static char ssl_object_use_certificate__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>useCertificate</name>\n"
-"      <parameter>cert</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         The parameter <parameter>cert</parameter> must be an\n"
-"         instance of the <classname>X590</classname> class and must be\n"
-"         called before <function>setFd</function>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_use_certificate(ssl_object *self, PyObject *args)
-{
-  x509_object *x509 = NULL;
-
-  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
-    goto error;
-
-  if (self->ctxset)
-    lose("cannot be called after setFd()");
-
-  if (!SSL_CTX_use_certificate(self->ctx, x509->x509))
-    lose("could not use certificate");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static PyObject *
-ssl_object_add_certificate(ssl_object *self, PyObject *args)
-{
-  x509_object *x509 = NULL;
-  X509 *x = NULL;
-
-  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
-    goto error;
-
-  if (self->ctxset)
-    lose("cannot be called after setFd()");
-
-  if ((x = X509_dup(x509->x509)) == NULL)
-    lose("could not duplicate X509 object");
-
-  if (!SSL_CTX_add_extra_chain_cert(self->ctx, x))
-    lose_openssl_error("Could not add certificate");
-
-  x = NULL;
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (x)
-    X509_free(x);
-
-  return NULL;
-}
-
-static PyObject *
-ssl_object_add_trust(ssl_object *self, PyObject *args)
-{
-  x509_object *x509 = NULL;
-  X509 *x = NULL;
-
-  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
-    goto error;
-
-  if (self->ctxset)
-    lose("Cannot be called after setFd()");
-
-  if (self->trusted_certs == NULL &&
-      (self->trusted_certs = sk_X509_new_null()) == NULL)
-    lose("Couldn't allocate trusted certificate stack");
-
-  if ((x = X509_dup(x509->x509)) == NULL)
-    lose("Couldn't duplicate X509 object");
-
-  if (!sk_X509_push(self->trusted_certs, x))
-    lose("Couldn't push cert onto trusted certificate stack");
-
-  x = NULL;
-
-  Py_RETURN_NONE;
-
- error:
-
-  if (x)
-    X509_free(x);
-
-  return NULL;
-}
-
-static char ssl_object_use_key__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>useKey</name>\n"
-"      <parameter>key</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         The parameter <parameter>key</parameter> must be an\n"
-"         instance of the <classname>Asymmetric</classname> class and\n"
-"         must contain the private key.  This function cannot be called\n"
-"         after <function>useKey</function>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_use_key(ssl_object *self, PyObject *args)
-{
-  asymmetric_object *asym = NULL;
-  EVP_PKEY *pkey = NULL;
-
-  if (!PyArg_ParseTuple(args, "O!", &asymmetrictype, &asym))
-    goto error;
-
-  if (self->ctxset)
-    lose("cannot be called after setFd()");
-
-  if ((pkey = EVP_PKEY_new()) == NULL)
-    lose("could not allocate memory");
-
-  if (asym->key_type != RSA_PRIVATE_KEY)
-    lose("cannot use this type of key");
-
-  if (!EVP_PKEY_set1_RSA(pkey, asym->cipher))
-    lose("EVP_PKEY assignment error");
-
-  if (!SSL_CTX_use_PrivateKey(self->ctx, pkey))
-    lose("ctx key assignment error");
-
-  Py_RETURN_NONE;
-
- error:
-
-  if(pkey)
-    EVP_PKEY_free(pkey);
-
-  return NULL;
-}
-
-static char ssl_object_check_key__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>checkKey</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This simple method will return 1 if the public key, contained in\n"
-"         the X509 certificate this <classname>Ssl</classname> instance is using,\n"
-"         matches the private key this <classname>Ssl</classname> instance is using.\n"
-"         Otherwise it will return 0.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_check_key(ssl_object *self, PyObject *args)
-{
-  return PyBool_FromLong(SSL_CTX_check_private_key(self->ctx));
-}
-
-static char ssl_object_set_fd__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>setFd</name>\n"
-"      <parameter>descriptor</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function is used to associate a file descriptor with a\n"
-"         <classname>Ssl</classname> object.  The file descriptor should\n"
-"         belong to an open TCP connection.  Once this function has\n"
-"         been called, calling <function>useKey</function> or\n"
-"         <function>useCertificate</function> will, fail rasing exceptions.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_set_fd(ssl_object *self, PyObject *args)
-{
-  int fd = 0, self_index = 0;
-
-  if (!PyArg_ParseTuple(args, "i", &fd))
-    goto error;
-
-  if ((self->ssl = SSL_new(self->ctx)) == NULL)
-    lose("Unable to create ssl structure");
-
-  SSL_set_mode(self->ssl, (SSL_MODE_ENABLE_PARTIAL_WRITE |
-                           SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER));
-
-  if (!SSL_set_fd(self->ssl, fd))
-    lose("Unable to set file descriptor");
-
-  if ((self_index = SSL_get_ex_new_index(0, "self_index", NULL, NULL, NULL)) != -1)
-    SSL_set_ex_data(self->ssl, self_index, self);
-  else
-    lose("Unable to create ex data index");
-
-  self->ctxset = 1;
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char ssl_object_fileno__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>fileno</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function is used to extract the file descriptor associated\n"
-"         with a <classname>Ssl</classname> object.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_fileno(ssl_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  return Py_BuildValue("i", SSL_get_fd(self->ssl));
-
- error:
-
-  return NULL;
-}
-
-static char ssl_object_accept__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>accept</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function will attempt the SSL level accept with a\n"
-"         client.  The <classname>Ssl</classname> object must have been\n"
-"         created using a <constant>XXXXX_SERVER_METHOD</constant> or\n"
-"         a <constant>XXXXX_METHOD</constant> and this function should only be\n"
-"         called after <function>useKey</function>,\n"
-"         <function>useCertificate</function> and\n"
-"         <function>setFd</function> functions have been called.\n"
-"      </para>\n"
-"\n"
-"      <example>\n"
-"         <title><function>accept</function> function usage</title>\n"
-"         <programlisting>\n"
-"      keyFile = open('test/private.key', 'r')\n"
-"      certFile = open('test/cacert.pem', 'r')\n"
-"\n"
-"      rsa = POW.pemRead(POW.RSA_PRIVATE_KEY, keyFile.read(), 'pass')\n"
-"      x509 = POW.pemRead(POW.X509_CERTIFICATE, certFile.read())\n"
-"\n"
-"      keyFile.close()\n"
-"      certFile.close()\n"
-"\n"
-"      sl = POW.Ssl(POW.SSLV23_SERVER_METHOD)\n"
-"      sl.useCertificate(x509)\n"
-"      sl.useKey(rsa)\n"
-"\n"
-"      s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n"
-"      s.bind(('localhost', 1111))\n"
-"      s.listen(5)\n"
-"      s2, addr = s.accept()\n"
-"\n"
-"      s.close()\n"
-"\n"
-"      sl.setFd(s2.fileno())\n"
-"      sl.accept()\n"
-"      print sl.read(1024)\n"
-"      sl.write('Message from server to client...')\n"
-"\n"
-"      s2.close()\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_accept(ssl_object *self, PyObject *args)
-{
-  int ret = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  Py_BEGIN_ALLOW_THREADS;
-  ret = SSL_accept(self->ssl);
-  Py_END_ALLOW_THREADS;
-
-  if (ret <= 0)
-    lose_ssl_error(self, ret);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char ssl_object_connect__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>connect</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function will attempt the SSL level connection with a\n"
-"         server.  The <classname>Ssl</classname> object must have been\n"
-"         created using a <constant>XXXXX_CLIENT_METHOD</constant> or\n"
-"         a <constant>XXXXX_METHOD</constant> and this function should only be\n"
-"         called after <function>setFd</function> has already been\n"
-"         called.\n"
-"      </para>\n"
-"\n"
-"      <example>\n"
-"         <title><function>connect</function> function usage</title>\n"
-"         <programlisting>\n"
-"      s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n"
-"      s.connect(('localhost', 1111))\n"
-"\n"
-"      sl = POW.Ssl(POW.SSLV23_CLIENT_METHOD)\n"
-"      sl.setFd(s.fileno())\n"
-"      sl.connect()\n"
-"      sl.write('Message from client to server...')\n"
-"      print sl.read(1024)\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_connect(ssl_object *self, PyObject *args)
-{
-  int ret;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  Py_BEGIN_ALLOW_THREADS;
-  ret = SSL_connect(self->ssl);
-  Py_END_ALLOW_THREADS;
-
-  if (ret <= 0)
-    lose_ssl_error(self, ret);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char ssl_object_write__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>write</name>\n"
-"      <parameter>string</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method writes the <parameter>string</parameter> to the\n"
-"         <classname>Ssl</classname> object, to be read by it's peer.  This\n"
-"         function is analogous to the <classname>socket</classname>\n"
-"         classes <function>write</function> function.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_write(ssl_object *self, PyObject *args)
-{
-  char *msg;
-  int length = 0, ret = 0;
-
-  if (!PyArg_ParseTuple(args, "s#", &msg, &length))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  Py_BEGIN_ALLOW_THREADS;
-  ret = SSL_write(self->ssl, msg, length);
-  Py_END_ALLOW_THREADS;
-
-  if (ret <= 0)
-    lose_ssl_error(self, ret);
-
-  return Py_BuildValue("i", ret);
-
- error:
-
-  return NULL;
-}
-
-static char ssl_object_read__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>read</name>\n"
-"      <parameter>amount = 1024</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method reads up to <parameter>amount</parameter> characters from the\n"
-"         <classname>Ssl</classname> object.  This\n"
-"         function is analogous to the <classname>socket</classname>\n"
-"         classes <function>read</function> function.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_read(ssl_object *self, PyObject *args)
-{
-  PyObject *data;
-  char *msg = NULL;
-  int len = 1024, ret = 0;
-
-  if (!PyArg_ParseTuple(args, "|i", &len))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  if ((msg = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  Py_BEGIN_ALLOW_THREADS;
-  ret = SSL_read(self->ssl, msg, len);
-  Py_END_ALLOW_THREADS;
-
-  if (ret <= 0)
-    lose_ssl_error(self, ret);
-
-  data = Py_BuildValue("s#", msg, ret);
-
-  free(msg);
-  return data;
-
- error:
-
-  if (msg)
-    free(msg);
-
-  return NULL;
-}
-
-static char ssl_object_peer_certificate__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>peerCertificate</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns any peer certificate presented in the initial\n"
-"         SSL negotiation or <constant>None</constant>.  If a certificate is\n"
-"         returned, it will be an instance of <classname>X509</classname>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_peer_certificate(ssl_object *self, PyObject *args)
-{
-  X509 *x509 = NULL;
-  x509_object *x509_obj = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  if ((x509_obj = X509_object_new()) == NULL)
-    lose("could not create x509 object");
-
-  x509 = SSL_get_peer_certificate(self->ssl);
-
-  if (x509) {
-    X509_free(x509_obj->x509);
-    x509_obj->x509 = x509;
-    return (PyObject *) x509_obj;
-  }
-  else {
-    Py_XDECREF(x509_obj);
-    Py_RETURN_NONE;
-  }
-
- error:
-
-  if (x509)
-    X509_free(x509);
-
-  Py_XDECREF(x509_obj);
-  return NULL;
-}
-
-static char ssl_object_clear__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>clear</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method will clear the SSL session ready for\n"
-"         a new SSL connection.  It will not effect the underlying socket.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_clear(ssl_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  if (!SSL_clear(self->ssl))
-    lose("failed to clear ssl connection");
-
-  if (self->x509_cb_err) {
-    free(self->x509_cb_err);
-    self->x509_cb_err = NULL;
-  }
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char ssl_object_shutdown__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>shutdown</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method will issue a <constant>shutdown</constant> signal to it's peer.\n"
-"         If this connection's peer has already initiated a shutdown this call\n"
-"         will succeed, otherwise it will raise and exception.  In order to\n"
-"         check the shutdown handshake was successful,\n"
-"         <function>shutdown</function> must be called again.  If no\n"
-"         exception is raised, the handshake is complete.\n"
-"      </para>\n"
-"      <para>\n"
-"         The odd\n"
-"         implementation of this function reflects the underlying OpenSSL\n"
-"         function, which reflects the SSL protocol.  Although rasing an\n"
-"         exception is a bit annoying, the alternative, returning true all\n"
-"         false will not tell you why the call failed and the exception\n"
-"         will, at least that is the theory.  Look up the exact meaning\n"
-"         of the exceptions in the OpenSSL man page SSL_get_error.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_shutdown(ssl_object *self, PyObject *args)
-{
-  int ret = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  ret = SSL_shutdown(self->ssl);
-
-  /*
-   * The original POW behavior here seems nuts to me.  SSL_shutdown()
-   * returns a tristate:
-   *
-   *  1: fully closed
-   *  0: close notification sent, waiting for peer
-   * -1: error, WANT_READ, or WANT_WRITE
-   *
-   * Doc claims the protocol allows us to bail on 0 return if we don't
-   * want to wait.  So the "obvious" thing to do here is return boolean
-   * for 1 or 0 and raise an exception for -1.  Original author's explanation
-   * for why he didn't do that makes no sense to me, so I've changed it.
-   */
-
-  if (ret < 0)
-    lose_ssl_error(self, ret);
-
-  return PyBool_FromLong(ret);
-
- error:
-
-  return NULL;
-}
-
-static char ssl_object_get_shutdown__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>getShutdown</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function returns an integer indicating the state of the\n"
-"         SSL connection. <constant>SSL_RECEIVED_SHUTDOWN</constant>\n"
-"         will be set the if it's peer sends a <constant>shutdown</constant>\n"
-"         signal or the underlying socket\n"
-"         receives a close notify .  The possible values are:\n"
-"      </para>\n"
-"      <simplelist>\n"
-"         <member><constant>SSL_NO_SHUTDOWN</constant></member>\n"
-"         <member><constant>SSL_SENT_SHUTDOWN</constant></member>\n"
-"         <member><constant>SSL_RECEIVED_SHUTDOWN</constant></member>\n"
-"         <member><constant>SSL_SENT_SHUTDOWN</constant> | <constant>SSL_RECEIVED_SHUTDOWN</constant></member>\n"
-"      </simplelist>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_get_shutdown(ssl_object *self, PyObject *args)
-{
-  int state = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  state = SSL_get_shutdown(self->ssl);
-
-  return Py_BuildValue("i", state);
-
- error:
-
-  return NULL;
-}
-
-static char ssl_object_get_ciphers__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>getCiphers</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function returns a list of available ciphers ordered from\n"
-"         most favored to least.  This function must be called after\n"
-"         <function>setFd</function>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_get_ciphers(ssl_object *self, PyObject *args)
-{
-  int i = 0;
-  const char *cipher = NULL;
-  PyObject *list = NULL, *name = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  list = PyList_New(0);
-
-  cipher = SSL_get_cipher_list(self->ssl, 0);
-  while (cipher) {
-    if ((name = PyString_FromString(cipher)) == NULL)
-      goto error;
-    if (PyList_Append(list, name) != 0)
-      goto error;
-    Py_XDECREF(name);
-    name = NULL;
-    cipher = SSL_get_cipher_list(self->ssl, ++i);
-  }
-  return list;
-
- error:
-
-  Py_XDECREF(name);
-  Py_XDECREF(list);
-  return NULL;
-}
-
-static char ssl_object_set_ciphers__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>setCiphers</name>\n"
-"      <parameter>ciphers</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         <function>setCiphers</function>\n"
-"         can help protect against certain types of attacks which try to\n"
-"         coerce the server, client or both to negotiate a weak cipher.\n"
-"         <parameter>ciphers</parameter> should be a list of strings, as\n"
-"         produced by <function>getCiphers</function> and described in the\n"
-"         OpenSSL man page ciphers.   <function>setCiphers</function> should\n"
-"         only be called after <function>setFd</function>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_set_ciphers(ssl_object *self, PyObject *args)
-{
-  PyObject *ciphers = NULL;
-  PyObject *cipher = NULL;
-  int size = 0, cipherstrlen = 0, nextstrlen = 0, i = 0;
-  char *cipherstr = NULL;
-
-  if (!PyArg_ParseTuple(args, "O", &ciphers))
-    goto error;
-
-  if (!PyList_Check(ciphers) && !PyTuple_Check(ciphers))
-    lose_type_error("inapropriate type");
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  cipherstr = malloc(8);        // Very bogus, realloc() dosn't work without some
-                                // previously allocated memory! Really should.
-  memset(cipherstr, 0, 8);
-  size = PySequence_Size(ciphers);
-  for (i = 0; i < size; i++) {
-    if ((cipher = PySequence_GetItem(ciphers, i)) == NULL)
-      goto error;
-
-    if (!PyString_Check(cipher))
-      lose_type_error("inapropriate type");
-
-    cipherstrlen = strlen(cipherstr);
-    nextstrlen = strlen(PyString_AsString(cipher));
-
-    if ((cipherstr = realloc(cipherstr, cipherstrlen + nextstrlen + 2)) == NULL)
-      lose_type_error("could allocate memory");
-
-    if (cipherstrlen)
-      strcat(cipherstr, ":\0");
-
-    strcat(cipherstr, PyString_AsString(cipher));
-    Py_XDECREF(cipher);
-    cipher = NULL;
-  }
-  SSL_set_cipher_list(self->ssl, cipherstr);
-  free(cipherstr);
-  Py_RETURN_NONE;
-
- error:
-
-  if (cipherstr)
-    free(cipherstr);
-
-  Py_XDECREF(cipher);
-
-  return NULL;
-}
-
-static char ssl_object_get_cipher__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>getCipher</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function returns the current cipher in use.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_get_cipher(ssl_object *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if (!self->ctxset)
-    lose("cannot be called before setFd()");
-
-  return Py_BuildValue("s", SSL_get_cipher(self->ssl));
-
- error:
-
-  return NULL;
-}
-
-static int ssl_object_verify_callback(X509_STORE_CTX *ctx, void *arg)
-{
-  ssl_object *self = arg;
-  int ok;
-
-  if (self->trusted_certs)
-    X509_STORE_CTX_trusted_stack(ctx, self->trusted_certs);
-
-  if (self->x509_cb_err) {
-    free(self->x509_cb_err);
-    self->x509_cb_err = NULL;
-  }
-
-  ok = X509_verify_cert(ctx) == 1;
-
-  if (!ok) {
-
-    /*
-     * We probably should be pushing out structured Python data here
-     * rather than a string, but we're pretty deep in the OpenSSL call
-     * chain at this point and I'd rather not risk whacky interactions
-     * with the Python garbage collector.  Try this kludge initially,
-     * rewrite as something better later if it looks worth the effort.
-     */
-
-    BIO *b = BIO_new(BIO_s_mem());
-    char *buf = NULL;
-    int len;
-
-    if (!b)
-      goto fail;
-
-    BIO_puts(b, "TLS validation failure:\n\n");
-
-    if (self->trusted_certs) {
-      int i;
-      BIO_puts(b, "Trusted cert stack\n");
-      for (i = 0; i < sk_X509_num(self->trusted_certs); i++) {
-        X509 *x = sk_X509_value(self->trusted_certs, i);
-        BIO_printf(b, "[%d] ", i);
-        if (x)
-          X509_print(b, x);
-        else
-          BIO_puts(b, "<NULL>!\n");
-      }
-    } else {
-      BIO_puts(b, "No trusted cert stack\n");
-    }
-
-    BIO_printf(b,
-            "\nX509_verify_cert() error: error depth %d error %d current_cert %p current_issuer %p current_crl %p: %s\n",
-            ctx->error_depth,
-            ctx->error,
-            ctx->current_cert,
-            ctx->current_issuer,
-            ctx->current_crl,
-            X509_verify_cert_error_string(ctx->error));
-    if (ctx->current_cert)
-      X509_print(b, ctx->current_cert);
-
-    /* This seems to be returning garbage, don't know why */
-    if (ctx->current_issuer)
-      X509_print(b, ctx->current_issuer);
-
-    if ((len = BIO_ctrl_pending(b)) == 0 || (buf = malloc(len + 1)) == NULL)
-      goto fail;
-
-    if (BIO_read(b, buf, len) == len) {
-      buf[len] = '\0';
-      self->x509_cb_err = buf;
-    } else {
-      free(buf);
-    }
-
-  fail:
-    BIO_free(b);
-  }
-
-  return ok;
-}
-
-static char ssl_object_set_verify_mode__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <name>setVerifyMode</name>\n"
-"      <parameter>mode</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function sets the behavior of the SSL handshake.  The\n"
-"         parameter <parameter>mode</parameter> should be one of the\n"
-"         following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-"         <member><constant>SSL_VERIFY_NONE</constant></member>\n"
-"         <member><constant>SSL_VERIFY_PEER</constant></member>\n"
-"         <member><constant>SSL_VERIFY_PEER</constant> |\n"
-"                 <constant>SSL_VERIFY_FAIL_IF_NO_PEER_CERT</constant></member>\n"
-"      </simplelist>\n"
-"      <para>\n"
-"         See the OpenSSL man page <function>SSL_CTX_set_verify</function>\n"
-"         for details.  This function must be called after <function>setfd</function>\n"
-"         has been called.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-ssl_object_set_verify_mode(ssl_object *self, PyObject *args)
-{
-  int mode = 0;
-
-  if (!PyArg_ParseTuple(args, "i", &mode))
-    goto error;
-
-  if (self->ctxset)
-    lose("cannot be called after setfd()");
-
-  SSL_CTX_set_verify(self->ctx, mode, NULL);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static struct PyMethodDef ssl_object_methods[] = {
-  {"useCertificate",   (PyCFunction)ssl_object_use_certificate,  METH_VARARGS,  NULL},
-  {"addCertificate",   (PyCFunction)ssl_object_add_certificate,  METH_VARARGS,  NULL},
-  {"addTrust",         (PyCFunction)ssl_object_add_trust,        METH_VARARGS,  NULL},
-  {"useKey",           (PyCFunction)ssl_object_use_key,          METH_VARARGS,  NULL},
-  {"checkKey",         (PyCFunction)ssl_object_check_key,        METH_VARARGS,  NULL},
-  {"setFd",            (PyCFunction)ssl_object_set_fd,           METH_VARARGS,  NULL},
-  {"fileno",           (PyCFunction)ssl_object_fileno,           METH_VARARGS,  NULL},
-  {"connect",          (PyCFunction)ssl_object_connect,          METH_VARARGS,  NULL},
-  {"accept",           (PyCFunction)ssl_object_accept,           METH_VARARGS,  NULL},
-  {"write",            (PyCFunction)ssl_object_write,            METH_VARARGS,  NULL},
-  {"read",             (PyCFunction)ssl_object_read,             METH_VARARGS,  NULL},
-  {"peerCertificate",  (PyCFunction)ssl_object_peer_certificate, METH_VARARGS,  NULL},
-  {"clear",            (PyCFunction)ssl_object_clear,            METH_VARARGS,  NULL},
-  {"shutdown",         (PyCFunction)ssl_object_shutdown,         METH_VARARGS,  NULL},
-  {"getShutdown",      (PyCFunction)ssl_object_get_shutdown,     METH_VARARGS,  NULL},
-  {"getCiphers",       (PyCFunction)ssl_object_get_ciphers,      METH_VARARGS,  NULL},
-  {"setCiphers",       (PyCFunction)ssl_object_set_ciphers,      METH_VARARGS,  NULL},
-  {"getCipher",        (PyCFunction)ssl_object_get_cipher,       METH_VARARGS,  NULL},
-  {"setVerifyMode",    (PyCFunction)ssl_object_set_verify_mode,  METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static ssl_object *
-newssl_object(int type)
-{
-  ssl_object *self;
-  const SSL_METHOD *method;
-
-
-  if ((self = PyObject_NEW(ssl_object, &ssltype)) == NULL)
-    goto error;
-
-  self->ctxset = 0;
-  self->ssl = NULL;
-  self->trusted_certs = NULL;
-  self->x509_cb_err = NULL;
-
-  switch (type) {
-  case SSLV2_SERVER_METHOD:  method = SSLv2_server_method();   break;
-  case SSLV2_CLIENT_METHOD:  method = SSLv2_client_method();   break;
-  case SSLV2_METHOD:         method = SSLv2_method();          break;
-  case SSLV3_SERVER_METHOD:  method = SSLv3_server_method();   break;
-  case SSLV3_CLIENT_METHOD:  method = SSLv3_client_method();   break;
-  case SSLV3_METHOD:         method = SSLv3_method();          break;
-  case TLSV1_SERVER_METHOD:  method = TLSv1_server_method();   break;
-  case TLSV1_CLIENT_METHOD:  method = TLSv1_client_method();   break;
-  case TLSV1_METHOD:         method = TLSv1_method();          break;
-  case SSLV23_SERVER_METHOD: method = SSLv23_server_method();  break;
-  case SSLV23_CLIENT_METHOD: method = SSLv23_client_method();  break;
-  case SSLV23_METHOD:        method = SSLv23_method();         break;
-
-  default:
-    lose("unknown ctx method");
-  }
-
-  if ((self->ctx = SSL_CTX_new(method)) == NULL)
-    lose("unable to create new ctx");
-
-  SSL_CTX_set_cert_verify_callback(self->ctx, ssl_object_verify_callback, self);
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static PyObject *
-ssl_object_getattr(ssl_object *self, char *name)
-{
-  return Py_FindMethod(ssl_object_methods, (PyObject *)self, name);
-}
-
-static void
-ssl_object_dealloc(ssl_object *self)
-{
-  SSL_free(self->ssl);
-  SSL_CTX_free(self->ctx);
-  if (self->trusted_certs)
-    sk_X509_pop_free(self->trusted_certs, X509_free);
-  if (self->x509_cb_err)
-    free(self->x509_cb_err);
-  PyObject_Del(self);
-}
-
-static char ssltype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>Ssl</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides access to the Secure Socket Layer\n"
-"         functionality of OpenSSL.  It is designed to be a simple as\n"
-"         possible to use and is not designed for high performance\n"
-"         applications which handle many simultaneous connections.  The\n"
-"         original motivation for writing this library was to provide a\n"
-"         security layer for network agents written in Python, for this\n"
-"         application, good performance with multiple concurrent connections\n"
-"         is not an issue.\n"
-"      </para>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject ssltype = {
-   PyObject_HEAD_INIT(0)
-   0,                               /*ob_size*/
-   "Ssl",                           /*tp_name*/
-   sizeof(ssl_object),               /*tp_basicsize*/
-   0,                               /*tp_itemsize*/
-   (destructor)ssl_object_dealloc,  /*tp_dealloc*/
-   (printfunc)0,                    /*tp_print*/
-   (getattrfunc)ssl_object_getattr, /*tp_getattr*/
-   (setattrfunc)0,                  /*tp_setattr*/
-   (cmpfunc)0,                      /*tp_compare*/
-   (reprfunc)0,                     /*tp_repr*/
-   0,                               /*tp_as_number*/
-   0,                               /*tp_as_sequence*/
-   0,                               /*tp_as_mapping*/
-   (hashfunc)0,                     /*tp_hash*/
-   (ternaryfunc)0,                  /*tp_call*/
-   (reprfunc)0,                     /*tp_str*/
-   0,
-   0,
-   0,
-   0,
-   ssltype__doc__                   /* Documentation string */
-};
-/*========== ssl Object ==========*/
-
-/*========== asymmetric Object ==========*/
-static asymmetric_object *
-asymmetric_object_new(int cipher_type, int key_size)
-{
-  asymmetric_object *self = NULL;
-
-  self = PyObject_New(asymmetric_object, &asymmetrictype);
-  if (self == NULL)
-    goto error;
-
-  if (cipher_type != RSA_CIPHER)
-    lose("unsupported cipher");
-
-  if ((self->cipher = RSA_generate_key(key_size,RSA_F4,NULL,NULL)) == NULL)
-    lose("could not generate key");
-
-  self->key_type = RSA_PRIVATE_KEY;
-  self->cipher_type = RSA_CIPHER;
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static asymmetric_object *
-asymmetric_object_pem_read(int key_type, BIO *in, char *pass)
-{
-  asymmetric_object *self = NULL;
-
-  self = PyObject_New(asymmetric_object, &asymmetrictype);
-  if (self == NULL)
-    goto error;
-
-  switch (key_type) {
-
-  case RSA_PUBLIC_KEY:
-    if ((self->cipher = PEM_read_bio_RSA_PUBKEY(in, NULL, NULL, NULL)) == NULL)
-      lose("could not load public key");
-    self->key_type = RSA_PUBLIC_KEY;
-    self->cipher_type = RSA_CIPHER;
-    break;
-
-  case RSA_PRIVATE_KEY:
-    if ((self->cipher = PEM_read_bio_RSAPrivateKey(in, NULL, NULL, pass)) == NULL)
-      lose("could not load private key");
-    self->key_type = RSA_PRIVATE_KEY;
-    self->cipher_type = RSA_CIPHER;
-    break;
-
-  default:
-    lose("unknown key type");
-  }
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static asymmetric_object *
-asymmetric_object_der_read(int key_type, unsigned char *src, int len)
-{
-  asymmetric_object *self = NULL;
-  unsigned char *ptr = src;
-
-  self = PyObject_New(asymmetric_object, &asymmetrictype);
-  if (self == NULL)
-    goto error;
-
-  switch (key_type) {
-  case RSA_PUBLIC_KEY:
-
-    if ((self->cipher = d2i_RSA_PUBKEY(NULL, (const unsigned char **) &ptr, len)) == NULL)
-      lose("could not load public key");
-
-    self->key_type = RSA_PUBLIC_KEY;
-    self->cipher_type = RSA_CIPHER;
-    break;
-
-  case RSA_PRIVATE_KEY:
-
-    if ((self->cipher = d2i_RSAPrivateKey(NULL, (const unsigned char **) &ptr, len)) == NULL)
-      lose("could not load private key");
-
-    self->key_type = RSA_PRIVATE_KEY;
-    self->cipher_type = RSA_CIPHER;
-    break;
-
-  default:
-    lose("unknown key type");
-  }
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static char asymmetric_object_pem_write__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Asymmetric</memberof>\n"
-"      <name>pemWrite</name>\n"
-"      <parameter>keytype</parameter>\n"
-"      <parameter>ciphertype = None</parameter>\n"
-"      <parameter>passphrase = None</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to write <classname>Asymmetric</classname>\n"
-"         objects out as strings.  The first argument should be either\n"
-"         <constant>RSA_PUBLIC_KEY</constant> or\n"
-"         <constant>RSA_PRIVATE_KEY</constant>.  Private keys are often\n"
-"         saved in encrypted files to offer extra security above access\n"
-"         control mechanisms.  If the <parameter>keytype</parameter> is\n"
-"         <constant>RSA_PRIVATE_KEY</constant> a\n"
-"         <parameter>ciphertype</parameter> and\n"
-"         <parameter>passphrase</parameter> can also be specified.  The\n"
-"         <parameter>ciphertype</parameter> should be one of those listed in\n"
-"         the <classname>Symmetric</classname> class section.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-asymmetric_object_pem_write(asymmetric_object *self, PyObject *args)
-{
-  int key_type = 0, cipher = 0, len = 0, ret = 0;
-  char *kstr = NULL, *buf = NULL;
-  BIO *out_bio = NULL;
-  PyObject *asymmetric = NULL;
-
-  if (!PyArg_ParseTuple(args, "|iis", &key_type, &cipher, &kstr))
-    goto error;
-
-  if (key_type == 0)
-    key_type = self->key_type;
-
-  if ((out_bio = BIO_new(BIO_s_mem())) == NULL)
-    lose("unable to create new BIO");
-
-  if ((kstr && !cipher) || (cipher && !kstr))
-    lose("cipher type and key string must both be supplied");
-
-  switch(key_type) {
-
-  case RSA_PRIVATE_KEY:
-    if (kstr && cipher) {
-      if (!PEM_write_bio_RSAPrivateKey(out_bio, self->cipher, evp_cipher_factory(cipher), NULL, 0, NULL, kstr))
-        lose("unable to write key");
-    }
-    else {
-      if (!PEM_write_bio_RSAPrivateKey(out_bio, self->cipher, NULL, NULL, 0, NULL, NULL))
-        lose("unable to write key");
-    }
-    break;
-
-  case RSA_PUBLIC_KEY:
-    if (kstr && cipher)
-      lose("public keys should not encrypted");
-    else {
-      if (!PEM_write_bio_RSA_PUBKEY(out_bio, self->cipher))
-        lose("unable to write key");
-    }
-    break;
-
-  default:
-    lose("unsupported key type");
-  }
-
-  if ((len = BIO_ctrl_pending(out_bio)) == 0)
-    lose("unable to get number of bytes in bio");
-
-  if ((buf = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  if ((ret = BIO_read(out_bio, buf, len)) != len)
-    lose("unable to write out key");
-
-  asymmetric = Py_BuildValue("s#", buf, len);
-
-  BIO_free(out_bio);
-  free(buf);
-  return asymmetric;
-
- error:
-
-  if (out_bio);
-  BIO_free(out_bio);
-
-  if (buf)
-    free(buf);
-
-  return NULL;
-}
-
-static char asymmetric_object_der_write__doc__[] =
-"<method>"
-"   <header>"
-"      <memberof>Asymmetric</memberof>"
-"      <name>derWrite</name>"
-"      <parameter>keytype</parameter>"
-"   </header>"
-"   <body>"
-"      <para>"
-"         This method is used to write <classname>Asymmetric</classname>"
-"         objects out as strings.  The first argument should be either"
-"         <constant>RSA_PUBLIC_KEY</constant> or "
-"         <constant>RSA_PRIVATE_KEY</constant>."
-"      </para>"
-"   </body>"
-"</method>"
-;
-
-static PyObject *
-asymmetric_object_der_write(asymmetric_object *self, PyObject *args)
-{
-  int len = 0, key_type = 0;
-  unsigned char *buf = NULL, *p = NULL;
-  PyObject *asymmetric = NULL;
-
-  if (!PyArg_ParseTuple(args, "|i", &key_type))
-    goto error;
-
-  if (key_type == 0)
-    key_type = self->key_type;
-
-  switch(key_type) {
-
-  case RSA_PRIVATE_KEY:
-    len = i2d_RSAPrivateKey(self->cipher, NULL);
-    if ((buf = malloc(len)) == NULL)
-      lose("could not allocate memory");
-    p = buf;
-    if (!i2d_RSAPrivateKey(self->cipher, &buf))
-      lose("unable to write key");
-    break;
-
-  case RSA_PUBLIC_KEY:
-    len = i2d_RSA_PUBKEY(self->cipher, NULL);
-    if ((buf = malloc(len)) == NULL)
-      lose("could not allocate memory");
-    p = buf;
-    if (!i2d_RSA_PUBKEY(self->cipher, &buf))
-      lose("unable to write key");
-    break;
-
-  default:
-    lose("unsupported key type");
-  }
-
-  asymmetric = Py_BuildValue("s#", p, len);
-
-  free(p);
-  return asymmetric;
-
- error:
-
-  if (p)
-    free(p);
-
-  return NULL;
-}
-
-static char asymmetric_object_public_encrypt__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Asymmetric</memberof>\n"
-"      <name>publicEncrypt</name>\n"
-"      <parameter>plaintext</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to encrypt the <parameter>plaintext</parameter>\n"
-"         using a public key. It should be noted; in practice this\n"
-"         function would be used almost exclusively to encrypt symmetric cipher\n"
-"         keys and not data since asymmetric cipher operations are very slow.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-asymmetric_object_public_encrypt(asymmetric_object *self, PyObject *args)
-{
-  unsigned char *plain_text = NULL, *cipher_text = NULL;
-  int len = 0, size = 0;
-  PyObject *obj = NULL;
-
-  if (self->cipher_type != RSA_CIPHER)
-    lose("unsupported cipher type");
-
-  if (!PyArg_ParseTuple(args, "s#", &plain_text, &len))
-    goto error;
-
-  size = RSA_size(self->cipher);
-  if (len > size)
-    lose("plain text is too long");
-
-  if ((cipher_text = malloc(size + 16)) == NULL)
-    lose("could not allocate memory");
-
-  if ((len = RSA_public_encrypt(len, plain_text, cipher_text, self->cipher, RSA_PKCS1_PADDING)) < 0)
-    lose("could not encrypt plain text");
-
-  obj = Py_BuildValue("s#", cipher_text, len);
-  free(cipher_text);
-  return obj;
-
- error:
-
-  if (cipher_text)
-    free(cipher_text);
-
-  return NULL;
-}
-
-static char asymmetric_object_private_encrypt__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Asymmetric</memberof>\n"
-"      <name>privateEncrypt</name>\n"
-"      <parameter>plaintext</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to encrypt the <parameter>plaintext</parameter>\n"
-"         using a private key. It should be noted; in practice this\n"
-"         function would be used almost exclusively to encrypt symmetric cipher\n"
-"         keys and not data since asymmetric cipher operations are very slow.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-asymmetric_object_private_encrypt(asymmetric_object *self, PyObject *args)
-{
-  unsigned char *plain_text = NULL, *cipher_text = NULL;
-  int len = 0, size = 0;
-  PyObject *obj = NULL;
-
-  if (self->key_type != RSA_PRIVATE_KEY)
-    lose("cannot perform private encryption with this key");
-
-  if (!PyArg_ParseTuple(args, "s#", &plain_text, &len))
-    goto error;
-
-  size = RSA_size(self->cipher);
-  if (len > size)
-    lose("plain text is too long");
-
-  if ((cipher_text = malloc(size + 16)) == NULL)
-    lose("could not allocate memory");
-
-  if ((len = RSA_private_encrypt(len, plain_text, cipher_text, self->cipher, RSA_PKCS1_PADDING)) < 0)
-    lose("could not encrypt plain text");
-
-  obj = Py_BuildValue("s#", cipher_text, len);
-  free(cipher_text);
-  return obj;
-
- error:
-
-  if (cipher_text)
-    free(cipher_text);
-
-  return NULL;
-}
-
-static char asymmetric_object_public_decrypt__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Asymmetric</memberof>\n"
-"      <name>publicDecrypt</name>\n"
-"      <parameter>ciphertext</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to decrypt the\n"
-"         <parameter>ciphertext</parameter> which has been encrypted\n"
-"         using the corresponding private key and the\n"
-"         <function>privateEncrypt</function> function.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-asymmetric_object_public_decrypt(asymmetric_object *self, PyObject *args)
-{
-  unsigned char *plain_text = NULL, *cipher_text = NULL;
-  int len = 0, size = 0;
-  PyObject *obj = NULL;
-
-  if (self->cipher_type != RSA_CIPHER)
-    lose("unsupported cipher type");
-
-  if (!PyArg_ParseTuple(args, "s#", &cipher_text, &len))
-    goto error;
-
-  size = RSA_size(self->cipher);
-  if (len > size)
-    lose("cipher text is too long");
-
-  if ((plain_text = malloc(size + 16)) == NULL)
-    lose("could not allocate memory");
-
-  if ((len = RSA_public_decrypt(len, cipher_text, plain_text, self->cipher, RSA_PKCS1_PADDING)) < 0)
-    lose("could not decrypt cipher text");
-
-  obj = Py_BuildValue("s#", plain_text, len);
-  free(plain_text);
-  return obj;
-
- error:
-
-  if (plain_text)
-    free(plain_text);
-
-  return NULL;
-}
-
-static char asymmetric_object_private_decrypt__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Asymmetric</memberof>\n"
-"      <name>privateDecrypt</name>\n"
-"      <parameter>ciphertext</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to decrypt ciphertext which has been encrypted\n"
-"         using the corresponding public key and the\n"
-"         <function>publicEncrypt</function> function.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-asymmetric_object_private_decrypt(asymmetric_object *self, PyObject *args)
-{
-  unsigned char *plain_text = NULL, *cipher_text = NULL;
-  int len = 0, size = 0;
-  PyObject *obj = NULL;
-
-  if (self->key_type != RSA_PRIVATE_KEY)
-    lose("cannot perform private decryption with this key");
-
-  if (!PyArg_ParseTuple(args, "s#", &cipher_text, &len))
-    goto error;
-
-  size = RSA_size(self->cipher);
-  if (len > size)
-    lose("cipher text is too long");
-
-  if ((plain_text = malloc(size + 16)) == NULL)
-    lose("could not allocate memory");
-
-  if ((len = RSA_private_decrypt(len, cipher_text, plain_text, self->cipher, RSA_PKCS1_PADDING)) < 0)
-    lose("could not decrypt cipher text");
-
-  obj = Py_BuildValue("s#", plain_text, len);
-  free(plain_text);
-  return obj;
-
- error:
-
-  if (plain_text)
-    free(plain_text);
-  return NULL;
-}
-
-static char asymmetric_object_sign__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Asymmetric</memberof>\n"
-"      <name>sign</name>\n"
-"      <parameter>digesttext</parameter>\n"
-"      <parameter>digesttype</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to produce a signed digest text.\n"
-"         This instance of\n"
-"         <classname>Asymmetric</classname> should be a private key used for\n"
-"         signing.  The parameter\n"
-"         <parameter>digesttext</parameter> should be a digest of the\n"
-"         data to protect against alteration and\n"
-"         finally <parameter>digesttype</parameter> should be one of the\n"
-"         following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-#ifndef OPENSSL_NO_MD2
-"         <member><constant>MD2_DIGEST</constant></member>\n"
-#endif
-"         <member><constant>MD5_DIGEST</constant></member>\n"
-"         <member><constant>SHA_DIGEST</constant></member>\n"
-"         <member><constant>SHA1_DIGEST</constant></member>\n"
-"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
-"         <member><constant>SHA256_DIGEST</constant></member>\n"
-"         <member><constant>SHA384_DIGEST</constant></member>\n"
-"         <member><constant>SHA512_DIGEST</constant></member>\n"
-"      </simplelist>\n"
-"      <para>\n"
-"         If the procedure was successful, a string containing the signed\n"
-"         digest is returned.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-asymmetric_object_sign(asymmetric_object *self, PyObject *args)
-{
-  unsigned char *digest_text = NULL, *signed_text = NULL;
-  unsigned int digest_len = 0, digest_type = 0, digest_nid = 0, signed_len = 0;
-  PyObject *obj = NULL;
-
-  if (!PyArg_ParseTuple(args, "s#i", &digest_text, &digest_len, &digest_type))
-    goto error;
-
-  if (self->key_type != RSA_PRIVATE_KEY)
-    lose("unsupported key type");
-
-  if ((signed_text = malloc(RSA_size(self->cipher))) == NULL)
-    lose("could not allocate memory");
-
-  switch(digest_type) {
-#ifndef OPENSSL_NO_MD2
-  case MD2_DIGEST:
-    digest_nid = NID_md2;
-    digest_len = MD2_DIGEST_LENGTH;
-    break;
-#endif
-  case MD5_DIGEST:
-    digest_nid = NID_md5;
-    digest_len = MD5_DIGEST_LENGTH;
-    break;
-  case SHA_DIGEST:
-    digest_nid = NID_sha;
-    digest_len = SHA_DIGEST_LENGTH;
-    break;
-  case SHA1_DIGEST:
-    digest_nid = NID_sha1;
-    digest_len = SHA_DIGEST_LENGTH;
-    break;
-  case RIPEMD160_DIGEST:
-    digest_nid = NID_ripemd160;
-    digest_len = RIPEMD160_DIGEST_LENGTH;
-    break;
-  case SHA256_DIGEST:
-    digest_nid = NID_sha256;
-    digest_len = SHA256_DIGEST_LENGTH;
-    break;
-  case SHA384_DIGEST:
-    digest_nid = NID_sha384;
-    digest_len = SHA384_DIGEST_LENGTH;
-    break;
-  case SHA512_DIGEST:
-    digest_nid = NID_sha512;
-    digest_len = SHA512_DIGEST_LENGTH;
-    break;
-  default:
-    lose("unsupported digest");
-  }
-
-  if (!RSA_sign(digest_nid, digest_text, digest_len, signed_text, &signed_len, self->cipher))
-    lose("could not sign digest");
-
-  obj = Py_BuildValue("s#", signed_text, signed_len);
-  free(signed_text);
-  return obj;
-
- error:
-
-  if (signed_text)
-    free(signed_text);
-
-  return NULL;
-}
-
-static char asymmetric_object_verify__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Asymmetric</memberof>\n"
-"      <name>verify</name>\n"
-"      <parameter>signedtext</parameter>\n"
-"      <parameter>digesttext</parameter>\n"
-"      <parameter>digesttype</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to verify a signed digest text.\n"
-"      </para>\n"
-"       <example>\n"
-"         <title><function>verify</function> method usage</title>\n"
-"         <programlisting>\n"
-"      plain_text = 'Hello World!'\n"
-"      print '\tPlain text:', plain_text\n"
-"      digest = POW.Digest(POW.RIPEMD160_DIGEST)\n"
-"      digest.update(plain_text)\n"
-"      print '\tDigest text:', digest.digest()\n"
-"\n"
-"      privateFile = open('test/private.key', 'r')\n"
-"      privateKey = POW.pemRead(POW.RSA_PRIVATE_KEY, privateFile.read(), 'pass')\n"
-"      privateFile.close()\n"
-"      signed_text =  privateKey.sign(digest.digest(), POW.RIPEMD160_DIGEST)\n"
-"      print '\tSigned text:', signed_text\n"
-"\n"
-"      digest2 = POW.Digest(POW.RIPEMD160_DIGEST)\n"
-"      digest2.update(plain_text)\n"
-"      publicFile = open('test/public.key', 'r')\n"
-"      publicKey = POW.pemRead(POW.RSA_PUBLIC_KEY, publicFile.read())\n"
-"      publicFile.close()\n"
-"      if publicKey.verify(signed_text, digest2.digest(), POW.RIPEMD160_DIGEST):\n"
-"         print 'Signing verified!'\n"
-"      else:\n"
-"         print 'Signing gone wrong!'\n"
-"         </programlisting>\n"
-"      </example>\n"
-"      <para>\n"
-"         The parameter <parameter>signedtext</parameter> should be a\n"
-"         signed digest text.  This instance of\n"
-"         <classname>Asymmetric</classname> should correspond to the private\n"
-"         key used to sign the digest.  The parameter\n"
-"         <parameter>digesttext</parameter> should be a digest of the same\n"
-"         data used to produce the <parameter>signedtext</parameter> and\n"
-"         finally <parameter>digesttype</parameter> should be one of the\n"
-"         following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-#ifndef OPENSSL_NO_MD2
-"         <member><constant>MD2_DIGEST</constant></member>\n"
-#endif
-"         <member><constant>MD5_DIGEST</constant></member>\n"
-"         <member><constant>SHA_DIGEST</constant></member>\n"
-"         <member><constant>SHA1_DIGEST</constant></member>\n"
-"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
-"         <member><constant>SHA256_DIGEST</constant></member>\n"
-"         <member><constant>SHA384_DIGEST</constant></member>\n"
-"         <member><constant>SHA512_DIGEST</constant></member>\n"
-"      </simplelist>\n"
-"      <para>\n"
-"         If the procedure was successful, 1 is returned, otherwise 0 is\n"
-"         returned.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-asymmetric_object_verify(asymmetric_object *self, PyObject *args)
-{
-  unsigned char *digest_text = NULL, *signed_text = NULL;
-  int digest_len = 0, digest_type = 0, digest_nid = 0, signed_len = 0;
-
-  if (!PyArg_ParseTuple(args, "s#s#i", &signed_text, &signed_len, &digest_text, &digest_len, &digest_type))
-    goto error;
-
-  switch (digest_type) {
-#ifndef OPENSSL_NO_MD2
-  case MD2_DIGEST:
-    digest_len = MD2_DIGEST_LENGTH;
-    digest_nid = NID_md2;
-    break;
-#endif
-  case MD5_DIGEST:
-    digest_len = MD5_DIGEST_LENGTH;
-    digest_nid = NID_md5;
-    break;
-  case SHA_DIGEST:
-    digest_len = SHA_DIGEST_LENGTH;
-    digest_nid = NID_sha;
-    break;
-  case SHA1_DIGEST:
-    digest_len = SHA_DIGEST_LENGTH;
-    digest_nid = NID_sha1;
-    break;
-  case RIPEMD160_DIGEST:
-    digest_len = RIPEMD160_DIGEST_LENGTH;
-    digest_nid = NID_ripemd160;
-    break;
-  case SHA256_DIGEST:
-    digest_len = SHA256_DIGEST_LENGTH;
-    digest_nid = NID_sha256;
-    break;
-  case SHA384_DIGEST:
-    digest_len = SHA384_DIGEST_LENGTH;
-    digest_nid = NID_sha384;
-    break;
-  case SHA512_DIGEST:
-    digest_len = SHA512_DIGEST_LENGTH;
-    digest_nid = NID_sha512;
-    break;
-  default:
-    lose("unsupported digest");
-  }
-
-  return PyBool_FromLong(RSA_verify(digest_nid, digest_text, digest_len, signed_text, signed_len, self->cipher));
-
- error:
-
-  return NULL;
-}
-
-static struct PyMethodDef asymmetric_object_methods[] = {
-  {"pemWrite",          (PyCFunction)asymmetric_object_pem_write,       METH_VARARGS,  NULL},
-  {"derWrite",          (PyCFunction)asymmetric_object_der_write,       METH_VARARGS,  NULL},
-  {"publicEncrypt",     (PyCFunction)asymmetric_object_public_encrypt,  METH_VARARGS,  NULL},
-  {"privateEncrypt",    (PyCFunction)asymmetric_object_private_encrypt, METH_VARARGS,  NULL},
-  {"privateDecrypt",    (PyCFunction)asymmetric_object_private_decrypt, METH_VARARGS,  NULL},
-  {"publicDecrypt",     (PyCFunction)asymmetric_object_public_decrypt,  METH_VARARGS,  NULL},
-  {"sign",              (PyCFunction)asymmetric_object_sign,            METH_VARARGS,  NULL},
-  {"verify",            (PyCFunction)asymmetric_object_verify,          METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-asymmetric_object_getattr(asymmetric_object *self, char *name)
-{
-  return Py_FindMethod(asymmetric_object_methods, (PyObject *)self, name);
-}
-
-static void
-asymmetric_object_dealloc(asymmetric_object *self, char *name)
-{
-  switch(self->cipher_type) {
-  case RSA_CIPHER:
-    RSA_free(self->cipher);
-    break;
-  }
-  PyObject_Del(self);
-}
-
-static char asymmetrictype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>Asymmetric</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides access to RSA asymmetric ciphers in OpenSSL.\n"
-"         Other ciphers will probably be supported in the future but this is\n"
-"         not a priority.\n"
-"      </para>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject asymmetrictype = {
-   PyObject_HEAD_INIT(0)
-   0,                                     /*ob_size*/
-   "Asymmetric",                          /*tp_name*/
-   sizeof(asymmetric_object),             /*tp_basicsize*/
-   0,                                     /*tp_itemsize*/
-   (destructor)asymmetric_object_dealloc, /*tp_dealloc*/
-   (printfunc)0,                          /*tp_print*/
-   (getattrfunc)asymmetric_object_getattr,   /*tp_getattr*/
-   (setattrfunc)0,                        /*tp_setattr*/
-   (cmpfunc)0,                            /*tp_compare*/
-   (reprfunc)0,                           /*tp_repr*/
-   0,                                     /*tp_as_number*/
-   0,                                     /*tp_as_sequence*/
-   0,                                     /*tp_as_mapping*/
-   (hashfunc)0,                           /*tp_hash*/
-   (ternaryfunc)0,                        /*tp_call*/
-   (reprfunc)0,                           /*tp_str*/
-   0,
-   0,
-   0,
-   0,
-   asymmetrictype__doc__                   /* Documentation string */
-};
-/*========== asymmetric Code ==========*/
-
-/*========== symmetric Code ==========*/
-static symmetric_object *
-symmetric_object_new(int cipher_type)
-{
-  symmetric_object *self = NULL;
-
-  if ((self = PyObject_New(symmetric_object, &symmetrictype)) == NULL)
-    goto error;
-
-  self->cipher_type = cipher_type;
-  EVP_CIPHER_CTX_init(&self->cipher_ctx);
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static char symmetric_object_encrypt_init__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Symmetric</memberof>\n"
-"      <name>encryptInit</name>\n"
-"      <parameter>key</parameter>\n"
-"      <parameter>initialvalue = ''</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method sets up the cipher object to start encrypting a stream\n"
-"         of data.  The first parameter is the key used to encrypt the\n"
-"         data.  The second, the <parameter>initialvalue</parameter> serves\n"
-"         a similar purpose the the salt supplied to the Unix\n"
-"         <function>crypt</function> function.\n"
-"         The <parameter>initialvalue</parameter> is normally chosen at random and\n"
-"         often transmitted with the encrypted data, its purpose is to prevent\n"
-"         two identical plain texts resulting in two identical cipher texts.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-symmetric_object_encrypt_init(symmetric_object *self, PyObject *args)
-{
-  unsigned char *key = NULL, *iv = NULL, nulliv [] = "";
-  const EVP_CIPHER *cipher = NULL;
-
-  if (!PyArg_ParseTuple(args, "s|s", &key, &iv))
-    goto error;
-
-  if (!iv)
-    iv = nulliv;
-
-  if ((cipher = evp_cipher_factory(self->cipher_type)) == NULL)
-    lose("unsupported cipher");
-
-  if (!EVP_EncryptInit(&self->cipher_ctx, cipher, key, iv))
-    lose("could not initialise cipher");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char symmetric_object_decrypt_init__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Symmetric</memberof>\n"
-"      <name>decryptInit</name>\n"
-"      <parameter>key</parameter>\n"
-"      <parameter>initialvalue = ''</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method sets up the cipher object to start decrypting a stream\n"
-"         of data.  The first value must be the key used to encrypt the\n"
-"         data.  The second parameter is the <parameter>initialvalue</parameter>\n"
-"         used to encrypt the data.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-symmetric_object_decrypt_init(symmetric_object *self, PyObject *args)
-{
-  unsigned char *key = NULL, *iv = NULL, nulliv [] = "";
-  const EVP_CIPHER *cipher = NULL;
-
-  if (!PyArg_ParseTuple(args, "s|s", &key, &iv))
-    goto error;
-
-  if (!iv)
-    iv = nulliv;
-
-  if ((cipher = evp_cipher_factory(self->cipher_type)) == NULL)
-    lose("unsupported cipher");
-
-  if (!EVP_DecryptInit(&self->cipher_ctx, cipher, key, iv))
-    lose("could not initialise cipher");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char symmetric_object_update__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Symmetric</memberof>\n"
-"      <name>update</name>\n"
-"      <parameter>data</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method is used to process the bulk of data being encrypted\n"
-"         or decrypted by the cipher object.  <parameter>data</parameter>\n"
-"         should be a string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-symmetric_object_update(symmetric_object *self, PyObject *args)
-{
-  int inl = 0, outl = 0;
-  unsigned char *in = NULL, *out = NULL;
-  PyObject *py_out = NULL;
-
-  if (!PyArg_ParseTuple(args, "s#", &in, &inl))
-    goto error;
-
-  if ((out = malloc(inl + EVP_CIPHER_CTX_block_size(&self->cipher_ctx))) == NULL)
-    lose("could not allocate memory");
-
-  if (!EVP_CipherUpdate(&self->cipher_ctx, out, &outl, in, inl))
-    lose("could not update cipher");
-
-  if ((py_out = Py_BuildValue("s#", out, outl)) == NULL)
-    lose("could not allocate memory");
-
-  free(out);
-  return py_out;
-
- error:
-
-  if (out)
-    free(out);
-
-  return NULL;
-}
-
-static char symmetric_object_final__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Symmetric</memberof>\n"
-"      <name>final</name>\n"
-"      <parameter>size = 1024</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         Most ciphers are block ciphers, that is they encrypt or decrypt a block of\n"
-"         data at a time.  Often the data being processed will not fill an\n"
-"         entire block, this method processes these half-empty blocks.  A\n"
-"         string is returned of a maximum length <parameter>size</parameter>.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-symmetric_object_final(symmetric_object *self, PyObject *args)
-{
-  int outl = 0, size = 1024;
-  unsigned char *out = NULL;
-  PyObject *py_out = NULL;
-
-  if (!PyArg_ParseTuple(args, "|i", &size))
-    goto error;
-
-  if ((out = malloc(size + EVP_CIPHER_CTX_block_size(&self->cipher_ctx))) == NULL)
-    lose("could not allocate memory");
-
-  if (!EVP_CipherFinal(&self->cipher_ctx, out, &outl))
-    lose("could not update cipher");
-
-  if ((py_out = Py_BuildValue("s#", out, outl)) == NULL)
-    lose("could not allocate memory");
-
-  free(out);
-  return py_out;
-
- error:
-
-  if (out)
-    free(out);
-
-  return NULL;
-}
-
-static struct PyMethodDef symmetric_object_methods[] = {
-  {"encryptInit",   (PyCFunction)symmetric_object_encrypt_init,  METH_VARARGS,  NULL},
-  {"decryptInit",   (PyCFunction)symmetric_object_decrypt_init,  METH_VARARGS,  NULL},
-  {"update",        (PyCFunction)symmetric_object_update,        METH_VARARGS,  NULL},
-  {"final",         (PyCFunction)symmetric_object_final,         METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-symmetric_object_getattr(symmetric_object *self, char *name)
-{
-  return Py_FindMethod(symmetric_object_methods, (PyObject *)self, name);
-}
-
-static void
-symmetric_object_dealloc(symmetric_object *self, char *name)
-{
-  PyObject_Del(self);
-}
-
-static char symmetrictype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>Symmetric</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides access to all the symmetric ciphers in OpenSSL.\n"
-"         Initialisation of the cipher structures is performed late, only\n"
-"         when <function>encryptInit</function> or\n"
-"         <function>decryptInit</function> is called, the\n"
-"         constructor only records the cipher type.  It is possible to reuse\n"
-"         the <classname>Symmetric</classname> objects by calling\n"
-"         <function>encryptInit</function> or <function>decryptInit</function>\n"
-"         again.\n"
-"      </para>\n"
-"      <example>\n"
-"         <title><classname>Symmetric</classname> class usage</title>\n"
-"         <programlisting>\n"
-"      passphrase = 'my silly passphrase'\n"
-"      md5 = POW.Digest(POW.MD5_DIGEST)\n"
-"      md5.update(passphrase)\n"
-"      password = md5.digest()[:8]\n"
-"\n"
-"      plaintext = 'cast test message'\n"
-"      cast = POW.Symmetric(POW.CAST5_CFB)\n"
-"      cast.encryptInit(password)\n"
-"      ciphertext = cast.update(plaintext) + cast.final()\n"
-"      print 'Cipher text:', ciphertext\n"
-"\n"
-"      cast.decryptInit(password)\n"
-"      out = cast.update(ciphertext) + cast.final()\n"
-"      print 'Deciphered text:', out\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject symmetrictype = {
-  PyObject_HEAD_INIT(0)
-  0,                                     /*ob_size*/
-  "Symmetric",                              /*tp_name*/
-  sizeof(symmetric_object),              /*tp_basicsize*/
-  0,                                     /*tp_itemsize*/
-  (destructor)symmetric_object_dealloc,  /*tp_dealloc*/
-  (printfunc)0,                          /*tp_print*/
-  (getattrfunc)symmetric_object_getattr, /*tp_getattr*/
-  (setattrfunc)0,                        /*tp_setattr*/
-  (cmpfunc)0,                            /*tp_compare*/
-  (reprfunc)0,                           /*tp_repr*/
-  0,                                     /*tp_as_number*/
-  0,                                     /*tp_as_sequence*/
-  0,                                     /*tp_as_mapping*/
-  (hashfunc)0,                           /*tp_hash*/
-  (ternaryfunc)0,                        /*tp_call*/
-  (reprfunc)0,                           /*tp_str*/
-  0,
-  0,
-  0,
-  0,
-  symmetrictype__doc__                    /* Documentation string */
-};
-/*========== symmetric Code ==========*/
-
-/*========== digest Code ==========*/
-static digest_object *
-digest_object_new(int digest_type)
-{
-  digest_object *self = NULL;
-
-  if ((self = PyObject_New(digest_object, &digesttype)) == NULL)
-    goto error;
-
-  switch(digest_type) {
-#ifndef OPENSSL_NO_MD2
-  case MD2_DIGEST:
-    self->digest_type = MD2_DIGEST;
-    EVP_DigestInit(&self->digest_ctx, EVP_md2());
-    break;
-#endif
-  case MD5_DIGEST:
-    self->digest_type = MD5_DIGEST;
-    EVP_DigestInit(&self->digest_ctx, EVP_md5());
-    break;
-  case SHA_DIGEST:
-    self->digest_type = SHA_DIGEST;
-    EVP_DigestInit(&self->digest_ctx, EVP_sha());
-    break;
-  case SHA1_DIGEST:
-    self->digest_type = SHA1_DIGEST;
-    EVP_DigestInit(&self->digest_ctx, EVP_sha1());
-    break;
-  case RIPEMD160_DIGEST:
-    self->digest_type = RIPEMD160_DIGEST;
-    EVP_DigestInit(&self->digest_ctx, EVP_ripemd160());
-    break;
-  case SHA256_DIGEST:
-    self->digest_type = SHA256_DIGEST;
-    EVP_DigestInit(&self->digest_ctx, EVP_sha256());
-    break;
-  case SHA384_DIGEST:
-    self->digest_type = SHA384_DIGEST;
-    EVP_DigestInit(&self->digest_ctx, EVP_sha384());
-    break;
-  case SHA512_DIGEST:
-    self->digest_type = SHA512_DIGEST;
-    EVP_DigestInit(&self->digest_ctx, EVP_sha512());
-    break;
-  default:
-    lose("unsupported digest");
-  }
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static char digest_object_update__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Digest</memberof>\n"
-"      <name>update</name>\n"
-"      <parameter>data</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method updates the internal structures of the\n"
-"         <classname>Digest</classname> object with <parameter>data</parameter>.\n"
-"         <parameter>data</parameter> should be a string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-digest_object_update(digest_object *self, PyObject *args)
-{
-  char *data = NULL;
-  int len = 0;
-
-  if (!PyArg_ParseTuple(args, "s#", &data, &len))
-    goto error;
-
-  EVP_DigestUpdate(&self->digest_ctx, data, len);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char digest_object_copy__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Digest</memberof>\n"
-"      <name>copy</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a copy of the <classname>Digest</classname>\n"
-"         object.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-digest_object_copy(digest_object *self, PyObject *args)
-{
-  digest_object *new = NULL;
-
-  if ((new = PyObject_New(digest_object, &digesttype)) == NULL)
-    lose("could not allocate memory");
-
-  new->digest_type = self->digest_type;
-  if (!EVP_MD_CTX_copy(&new->digest_ctx, &self->digest_ctx))
-    lose("could not copy digest");
-
-  return (PyObject*)new;
-
- error:
-
-  Py_XDECREF(new);
-  return NULL;
-}
-
-static char digest_object_digest__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Digest</memberof>\n"
-"      <name>digest</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the digest of all the data which has been\n"
-"         processed.  This function can be called at any time and will not\n"
-"         effect the internal structure of the <classname>digest</classname>\n"
-"         object.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-digest_object_digest(digest_object *self, PyObject *args)
-{
-  unsigned char digest_text[EVP_MAX_MD_SIZE];
-  void *md_copy = NULL;
-  unsigned digest_len = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((md_copy = malloc(sizeof(EVP_MD_CTX))) == NULL)
-    lose("could not allocate memory");
-
-  if (!EVP_MD_CTX_copy(md_copy, &self->digest_ctx))
-    lose("could not copy digest");
-
-  EVP_DigestFinal(md_copy, digest_text, &digest_len);
-
-  free(md_copy);
-
-  return Py_BuildValue("s#", digest_text, digest_len);
-
- error:
-
-  if (md_copy)
-    free(md_copy);
-
-  return NULL;
-}
-
-static struct PyMethodDef digest_object_methods[] = {
-  {"update",           (PyCFunction)digest_object_update,  METH_VARARGS, NULL},
-  {"digest",           (PyCFunction)digest_object_digest,  METH_VARARGS, NULL},
-  {"copy",             (PyCFunction)digest_object_copy,    METH_VARARGS, NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-digest_object_getattr(digest_object *self, char *name)
-{
-  return Py_FindMethod(digest_object_methods, (PyObject *)self, name);
-}
-
-static void
-digest_object_dealloc(digest_object *self, char *name)
-{
-  EVP_MD_CTX_cleanup(&self->digest_ctx);
-  PyObject_Del(self);
-}
-
-static char digesttype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>Digest</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides access to the digest functionality of OpenSSL.\n"
-"         It emulates the digest modules in the Python Standard Library but\n"
-"         does not currently support the <function>hexdigest</function>\n"
-"         function.\n"
-"      </para>\n"
-"      <example>\n"
-"         <title><classname>digest</classname> class usage</title>\n"
-"         <programlisting>\n"
-"      plain_text = 'Hello World!'\n"
-"      sha1 = POW.Digest(POW.SHA1_DIGEST)\n"
-"      sha1.update(plain_text)\n"
-"      print '\tPlain text: Hello World! =>', sha1.digest()\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject digesttype = {
-  PyObject_HEAD_INIT(0)
-  0,                                  /*ob_size*/
-  "Digest",                           /*tp_name*/
-  sizeof(digest_object),              /*tp_basicsize*/
-  0,                                  /*tp_itemsize*/
-  (destructor)digest_object_dealloc,  /*tp_dealloc*/
-  (printfunc)0,                       /*tp_print*/
-  (getattrfunc)digest_object_getattr, /*tp_getattr*/
-  (setattrfunc)0,                     /*tp_setattr*/
-  (cmpfunc)0,                         /*tp_compare*/
-  (reprfunc)0,                        /*tp_repr*/
-  0,                                  /*tp_as_number*/
-  0,                                  /*tp_as_sequence*/
-  0,                                  /*tp_as_mapping*/
-  (hashfunc)0,                        /*tp_hash*/
-  (ternaryfunc)0,                     /*tp_call*/
-  (reprfunc)0,                        /*tp_str*/
-  0,
-  0,
-  0,
-  0,
-  digesttype__doc__                   /* Documentation string */
-};
-/*========== digest Code ==========*/
-
-/*========== hmac Code ==========*/
-static hmac_object *
-hmac_object_new(int digest_type, char *key, int key_len)
-{
-  hmac_object *self = NULL;
-  const EVP_MD *md = NULL;
-
-  if ((self = PyObject_New(hmac_object, &hmactype)) == NULL)
-    goto error;
-
-  switch (digest_type) {
-#ifndef OPENSSL_NO_MD2
-  case MD2_DIGEST:
-    md = EVP_md2();
-    break;
-#endif
-  case MD5_DIGEST:
-    md = EVP_md5();
-    break;
-  case SHA_DIGEST:
-    md = EVP_sha();
-    break;
-  case SHA1_DIGEST:
-    md = EVP_sha1();
-    break;
-  case RIPEMD160_DIGEST:
-    md = EVP_ripemd160();
-    break;
-  case SHA256_DIGEST:
-    md = EVP_sha256();
-    break;
-  case SHA384_DIGEST:
-    md = EVP_sha384();
-    break;
-  case SHA512_DIGEST:
-    md = EVP_sha512();
-    break;
-  default:
-    lose("unsupported digest");
-  }
-
-  HMAC_Init(&self->hmac_ctx, key, key_len, md);
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static char hmac_object_update__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Hmac</memberof>\n"
-"      <name>update</name>\n"
-"      <parameter>data</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method updates the internal structures of the\n"
-"         <classname>Hmac</classname> object with <parameter>data</parameter>.\n"
-"         <parameter>data</parameter> should be a string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-hmac_object_update(hmac_object *self, PyObject *args)
-{
-  unsigned char *data = NULL;
-  int len = 0;
-
-  if (!PyArg_ParseTuple(args, "s#", &data, &len))
-    goto error;
-
-  HMAC_Update(&self->hmac_ctx, data, len);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char hmac_object_copy__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Hmac</memberof>\n"
-"      <name>copy</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a copy of the <classname>Hmac</classname>\n"
-"         object.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-hmac_object_copy(hmac_object *self, PyObject *args)
-{
-  hmac_object *new = NULL;
-
-  if ((new = PyObject_New(hmac_object, &hmactype)) == NULL)
-    lose("could not allocate memory");
-
-  memcpy(&new->hmac_ctx, &self->hmac_ctx, sizeof(HMAC_CTX));
-
-  return (PyObject*) new;
-
- error:
-
-  Py_XDECREF(new);
-  return NULL;
-}
-
-static char hmac_object_mac__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>Hmac</memberof>\n"
-"      <name>mac</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the MAC of all the data which has been\n"
-"         processed.  This function can be called at any time and will not\n"
-"         effect the internal structure of the <classname>Hmac</classname>\n"
-"         object.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-hmac_object_mac(hmac_object *self, PyObject *args)
-{
-  unsigned char hmac_text[EVP_MAX_MD_SIZE];
-  void *hmac_copy = NULL;
-  unsigned int hmac_len = 0;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((hmac_copy = malloc(sizeof(HMAC_CTX))) == NULL)
-    lose("could not allocate memory");
-
-  memcpy(hmac_copy, &self->hmac_ctx, sizeof(HMAC_CTX));
-  HMAC_Final(hmac_copy, hmac_text, &hmac_len);
-
-  free(hmac_copy);
-  return Py_BuildValue("s#", hmac_text, hmac_len);
-
- error:
-
-  if (hmac_copy)
-    free(hmac_copy);
-
-  return NULL;
-}
-
-
-static struct PyMethodDef hmac_object_methods[] = {
-  {"update",           (PyCFunction)hmac_object_update, METH_VARARGS,  NULL},
-  {"mac",              (PyCFunction)hmac_object_mac,    METH_VARARGS,  NULL},
-  {"copy",             (PyCFunction)hmac_object_copy,   METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-hmac_object_getattr(hmac_object *self, char *name)
-{
-  return Py_FindMethod(hmac_object_methods, (PyObject *)self, name);
-}
-
-static void
-hmac_object_dealloc(hmac_object *self, char *name)
-{
-  PyObject_Del(self);
-}
-
-static char hmactype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>Hmac</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides access to the HMAC functionality of OpenSSL.\n"
-"         HMAC's are a variant on digest based MACs, which have the\n"
-"         interesting property of a provable level of security.  HMAC is\n"
-"         discussed further in RFC 2104.\n"
-"      </para>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject hmactype = {
-   PyObject_HEAD_INIT(0)
-   0,                                  /*ob_size*/
-   "Hmac",                             /*tp_name*/
-   sizeof(hmac_object),                /*tp_basicsize*/
-   0,                                  /*tp_itemsize*/
-   (destructor)hmac_object_dealloc,    /*tp_dealloc*/
-   (printfunc)0,                       /*tp_print*/
-   (getattrfunc)hmac_object_getattr,   /*tp_getattr*/
-   (setattrfunc)0,                     /*tp_setattr*/
-   (cmpfunc)0,                         /*tp_compare*/
-   (reprfunc)0,                        /*tp_repr*/
-   0,                                  /*tp_as_number*/
-   0,                                  /*tp_as_sequence*/
-   0,                                  /*tp_as_mapping*/
-   (hashfunc)0,                        /*tp_hash*/
-   (ternaryfunc)0,                     /*tp_call*/
-   (reprfunc)0,                        /*tp_str*/
-   0,
-   0,
-   0,
-   0,
-   hmactype__doc__                     /* Documentation string */
-};
-/*========== hmac Code ==========*/
-
-/*========== CMS code ==========*/
-static cms_object *
-CMS_object_new(void)
-{
-  cms_object *self;
-
-  if ((self = PyObject_New(cms_object, &cmstype)) == NULL)
-    goto error;
-
-  self->cms = NULL;
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static cms_object *
-CMS_object_pem_read(BIO *in)
-{
-  cms_object *self;
-
-  if ((self = PyObject_New(cms_object, &cmstype)) == NULL)
-    goto error;
-
-  if ((self->cms = PEM_read_bio_CMS(in, NULL, NULL, NULL)) == NULL)
-    lose("could not load PEM encoded CMS message");
-
-  return self;
-
- error:
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static cms_object *
-CMS_object_der_read(char *src, int len)
-{
-  cms_object *self;
-  BIO *bio = NULL;
-
-  if ((self = PyObject_New(cms_object, &cmstype)) == NULL)
-    goto error;
-
-  self->cms = CMS_ContentInfo_new();
-
-  if ((bio = BIO_new_mem_buf(src, len)) == NULL)
-    goto error;
-
-  if (!d2i_CMS_bio(bio, &self->cms))
-    lose("could not load DER encoded CMS message");
-
-  BIO_free(bio);
-
-  return self;
-
- error:
-
-  if (bio)
-    BIO_free(bio);
-
-  Py_XDECREF(self);
-  return NULL;
-}
-
-static PyObject *
-CMS_object_write_helper(cms_object *self, PyObject *args, int format)
-{
-  int len = 0;
-  char *buf = NULL;
-  BIO *out_bio = NULL;
-  PyObject *cert = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    return NULL;
-
-  out_bio = BIO_new(BIO_s_mem());
-
-  switch (format) {
-
-  case DER_FORMAT:
-    if (!i2d_CMS_bio(out_bio, self->cms))
-      lose("unable to write certificate");
-    break;
-
-  case PEM_FORMAT:
-    if (!PEM_write_bio_CMS(out_bio, self->cms))
-      lose("unable to write certificate");
-    break;
-
-  default:
-    lose("internal error, unknown output format");
-  }
-
-  if ((len = BIO_ctrl_pending(out_bio)) == 0)
-    lose("unable to get bytes stored in bio");
-
-  if ((buf = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  if (BIO_read(out_bio, buf, len) != len)
-    lose("unable to write out cert");
-
-  cert = Py_BuildValue("s#", buf, len);
-
-  BIO_free(out_bio);
-  free(buf);
-  return cert;
-
- error:
-
-  if (out_bio)
-    BIO_free(out_bio);
-
-  if (buf)
-    free(buf);
-
-  Py_XDECREF(cert);
-  return NULL;
-}
-
-static char CMS_object_pem_write__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>pemWrite</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a PEM encoded CMS message as a\n"
-"         string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_pem_write(cms_object *self, PyObject *args)
-{
-  return CMS_object_write_helper(self, args, PEM_FORMAT);
-}
-
-static char CMS_object_der_write__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>derWrite</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a DER encoded CMS message as a\n"
-"         string.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_der_write(cms_object *self, PyObject *args)
-{
-  return CMS_object_write_helper(self, args, DER_FORMAT);
-}
-
-static char CMS_object_sign__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>sign</name>\n"
-"      <parameter>signcert</parameter>\n"
-"      <parameter>key</parameter>\n"
-"      <parameter>data</parameter>\n"
-"      <optional>\n"
-"        <parameter>certs</parameter>\n"
-"        <parameter>crls</parameter>\n"
-"        <parameter>eContentType</parameter>\n"
-"        <parameter>flags</parameter>\n"
-"      </optional>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method signs a message with a private key.\n"
-"         Supported flags: CMS_NOCERTS, CMS_NOATTR.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_sign(cms_object *self, PyObject *args)
-{
-  asymmetric_object *signkey = NULL;
-  x509_object *signcert = NULL;
-  x509_crl_object *crlobj = NULL;
-  PyObject *x509_sequence = Py_None, *crl_sequence = Py_None, *result = NULL;
-  STACK_OF(X509) *x509_stack = NULL;
-  EVP_PKEY *pkey = NULL;
-  char *buf = NULL, *oid = NULL;
-  int i, n, len;
-  unsigned flags = 0;
-  BIO *bio = NULL;
-  CMS_ContentInfo *cms = NULL;
-  ASN1_OBJECT *econtent_type = NULL;
-
-  if (!PyArg_ParseTuple(args, "O!O!s#|OOsI",
-                        &x509type, &signcert,
-                        &asymmetrictype, &signkey,
-                        &buf, &len,
-                        &x509_sequence,
-                        &crl_sequence,
-                        &oid,
-                        &flags))
-    goto error;
-
-  assert_no_unhandled_openssl_errors();
-
-  flags &= CMS_NOCERTS | CMS_NOATTR;
-  flags |= CMS_BINARY | CMS_NOSMIMECAP | CMS_PARTIAL | CMS_USE_KEYID;
-
-  if (signkey->key_type != RSA_PRIVATE_KEY)
-    lose("unsupported key type");
-
-  if ((x509_stack = x509_helper_sequence_to_stack(x509_sequence)) == NULL)
-    goto error;
-
-  assert_no_unhandled_openssl_errors();
-
-  if ((pkey = EVP_PKEY_new()) == NULL)
-    lose_openssl_error("Could not allocate memory");
-
-  assert_no_unhandled_openssl_errors();
-
-  if (!EVP_PKEY_assign_RSA(pkey, signkey->cipher))
-    lose_openssl_error("EVP_PKEY assignment error");
-
-  assert_no_unhandled_openssl_errors();
-
-  if ((bio = BIO_new_mem_buf(buf, len)) == NULL)
-    goto error;
-
-  assert_no_unhandled_openssl_errors();
-
-  if (oid && (econtent_type = OBJ_txt2obj(oid, 0)) == NULL)
-    lose_openssl_error("Could not parse OID");
-
-  assert_no_unhandled_openssl_errors();
-
-  if ((cms = CMS_sign(NULL, NULL, x509_stack, bio, flags)) == NULL)
-    lose_openssl_error("Could not create CMS message");
-
-  assert_no_unhandled_openssl_errors();
-
-  if (econtent_type)
-    CMS_set1_eContentType(cms, econtent_type);
-
-  assert_no_unhandled_openssl_errors();
-
-  if (!CMS_add1_signer(cms, signcert->x509, pkey, EVP_sha256(), flags))
-    lose_openssl_error("Could not sign CMS message");
-
-  pkey = NULL;                 /* CMS_add1_signer() now owns pkey */
-
-  assert_no_unhandled_openssl_errors();
-
-  if (crl_sequence != Py_None) {
-
-    if (!PyTuple_Check(crl_sequence) && !PyList_Check(crl_sequence))
-      lose_type_error("inapropriate type");
-
-    n = PySequence_Size(crl_sequence);
-
-    for (i = 0; i < n; i++) {
-
-      if ((crlobj = (x509_crl_object *) PySequence_GetItem(crl_sequence, i)) == NULL)
-        goto error;
-
-      if (!X_X509_crl_Check(crlobj))
-        lose_type_error("inappropriate type");
-
-      if (!crlobj->crl)
-        lose("CRL object with null crl field!");
-
-      if (!CMS_add1_crl(cms, crlobj->crl))
-        lose_openssl_error("Could not add CRL to CMS");
-
-      assert_no_unhandled_openssl_errors();
-
-      Py_XDECREF(crlobj);
-      crlobj = NULL;
-    }
-  }
-
-  if (!CMS_final(cms, bio, NULL, flags))
-    lose_openssl_error("Could not finalize CMS signatures");
-
-  assert_no_unhandled_openssl_errors();
-
-  if (self->cms)
-    CMS_ContentInfo_free(self->cms);
-  self->cms = cms;
-  cms = NULL;
-
-  result = Py_BuildValue("");
-
- error:                          /* fall through */
-
-  assert_no_unhandled_openssl_errors();
-
-  if (cms)
-    CMS_ContentInfo_free(cms);
-
-  if (bio)
-    BIO_free(bio);
-
-  if (x509_stack)
-    sk_X509_free(x509_stack);
-
-  if (pkey)
-    EVP_PKEY_free(pkey);
-
-  if (econtent_type)
-    ASN1_OBJECT_free(econtent_type);
-
-  if (crlobj) {
-    Py_XDECREF(crlobj);
-  }
-
-  return result;
-}
-
-static char CMS_object_verify__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>verify</name>\n"
-"      <parameter>store</parameter>\n"
-"      <optional>\n"
-"        <parameter>certs</parameter>\n"
-"        <parameter>flags</parameter>\n"
-"      </optional>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method verifies a message against a trusted store.\n"
-"         The optional certs parameter is a set of certificates to search\n"
-"         for the signer's certificate.\n"
-"         Supported flags: CMS_NOINTERN, CMS_NOCRL,\n"
-"         CMS_NO_SIGNER_CERT_VERIFY, CMS_NO_ATTR_VERIFY,\n"
-"         CMS_NO_CONTENT_VERIFY.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_verify(cms_object *self, PyObject *args)
-{
-  x509_store_object *store = NULL;
-  PyObject *result = NULL, *certs_sequence = Py_None;
-  STACK_OF(X509) *certs_stack = NULL;
-  unsigned flags = 0;
-  char *buf = NULL;
-  BIO *bio = NULL;
-  int len;
-
-  if (!PyArg_ParseTuple(args, "O!|OI", &x509_storetype, &store, &certs_sequence, &flags))
-    goto error;
-
-  if ((bio = BIO_new(BIO_s_mem())) == NULL)
-    goto error;
-
-  assert_no_unhandled_openssl_errors();
-
-  flags &= CMS_NOINTERN | CMS_NOCRL | CMS_NO_SIGNER_CERT_VERIFY | CMS_NO_ATTR_VERIFY | CMS_NO_CONTENT_VERIFY;
-
-  if (certs_sequence != Py_None && (certs_stack = x509_helper_sequence_to_stack(certs_sequence)) == NULL)
-    goto error;
-
-  assert_no_unhandled_openssl_errors();
-
-  if (CMS_verify(self->cms, certs_stack, store->store, NULL, bio, flags) <= 0)
-    lose_openssl_error("Could not verify CMS message");
-
-  assert_no_unhandled_openssl_errors();
-
-  if ((len = BIO_ctrl_pending(bio)) == 0)
-    lose("unable to get bytes stored in bio");
-
-  assert_no_unhandled_openssl_errors();
-
-  if ((buf = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  assert_no_unhandled_openssl_errors();
-
-  if (BIO_read(bio, buf, len) != len)
-    lose("unable to write out CMS content");
-
-  assert_no_unhandled_openssl_errors();
-
-  result = Py_BuildValue("s#", buf, len);
-
- error:                          /* fall through */
-
-  assert_no_unhandled_openssl_errors();
-
-  if (certs_stack)
-    sk_X509_free(certs_stack);
-
-  if (bio)
-    BIO_free(bio);
-
-  if (buf)
-    free(buf);
-
-  return result;
-}
-
-static char CMS_object_eContentType__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>get_eContentType</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the eContentType of a CMS message.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_eContentType(cms_object *self, PyObject *args)
-{
-  const ASN1_OBJECT *oid = NULL;
-  PyObject *result = NULL;
-  char buf[512];
-
-  if (!PyArg_ParseTuple(args, ""))
-    return NULL;
-
-  if ((oid = CMS_get0_eContentType(self->cms)) == NULL)
-    lose_openssl_error("Could not extract eContentType from CMS message");
-
-  OBJ_obj2txt(buf, sizeof(buf), oid, 1);
-
-  result = Py_BuildValue("s", buf);
-
- error:
-
-  assert_no_unhandled_openssl_errors();
-
-  return result;
-}
-
-static char CMS_object_signingTime__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>get_signingTime</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns the signingTime of a CMS message.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_signingTime(cms_object *self, PyObject *args)
-{
-  PyObject *result = NULL;
-  STACK_OF(CMS_SignerInfo) *sis = NULL;
-  CMS_SignerInfo *si = NULL;
-  X509_ATTRIBUTE *xa = NULL;
-  ASN1_TYPE *so = NULL;
-  int i;
-
-  if (!PyArg_ParseTuple(args, ""))
-    return NULL;
-
-  if ((sis = CMS_get0_SignerInfos(self->cms)) == NULL)
-    lose("Could not extract signerInfos from CMS message[1]");
-
-  if (sk_CMS_SignerInfo_num(sis) != 1)
-    lose("Could not extract signerInfos from CMS message[2]");
-
-  si = sk_CMS_SignerInfo_value(sis, 0);
-
-  if ((i = CMS_signed_get_attr_by_NID(si, NID_pkcs9_signingTime, -1)) < 0)
-    lose("Could not extract signerInfos from CMS message[3]");
-
-  if ((xa = CMS_signed_get_attr(si, i)) == NULL)
-    lose("Could not extract signerInfos from CMS message[4]");
-
-  if (xa->single)
-    lose("Could not extract signerInfos from CMS message[5]");
-
-  if (sk_ASN1_TYPE_num(xa->value.set) != 1)
-    lose("Could not extract signerInfos from CMS message[6]");
-
-  if ((so = sk_ASN1_TYPE_value(xa->value.set, 0)) == NULL)
-    lose("Could not extract signerInfos from CMS message[7]");
-
-  switch (so->type) {
-  case V_ASN1_UTCTIME:
-    result = ASN1_TIME_to_Python(so->value.utctime);
-    break;
-  case V_ASN1_GENERALIZEDTIME:
-    result = ASN1_TIME_to_Python(so->value.generalizedtime);
-    break;
-  default:
-    lose("Could not extract signerInfos from CMS message[8]");
-  }
-
- error:
-
-  assert_no_unhandled_openssl_errors();
-
-  return result;
-}
-
-static char CMS_object_pprint__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>pprint</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns a formatted string showing the information\n"
-"         held in the certificate.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_pprint(cms_object *self, PyObject *args)
-{
-  int len = 0, ret = 0;
-  char *buf = NULL;
-  BIO *bio = NULL;
-  PyObject *result = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  bio = BIO_new(BIO_s_mem());
-
-  if (!CMS_ContentInfo_print_ctx(bio, self->cms, 0, NULL))
-    lose("unable to pprint CMS");
-
-  if ((len = BIO_ctrl_pending(bio)) == 0)
-    lose("unable to get bytes stored in bio");
-
-  if ((buf = malloc(len)) == NULL)
-    lose("unable to allocate memory");
-
-  if ((ret = BIO_read(bio, buf, len)) != len)
-    lose("unable to pprint CMS");
-
-  result = Py_BuildValue("s#", buf, len);
-
- error:                          /* fall through */
-
-  assert_no_unhandled_openssl_errors();
-
-  if (bio)
-    BIO_free(bio);
-
-  if (buf)
-    free(buf);
-
-  return result;
-}
-
-
-static PyObject *
-cms_object_helper_get_cert(void *cert)
-{
-  x509_object *obj = PyObject_New(x509_object, &x509type);
-
-  if (obj)
-    obj->x509 = cert;
-
-  return (PyObject *) obj;
-}
-
-static char CMS_object_certs__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>certs</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns any certs embedded in a CMS message.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_certs(cms_object *self, PyObject *args)
-{
-  STACK_OF(X509) *certs = NULL;
-  PyObject *result = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((certs = CMS_get1_certs(self->cms)) != NULL)
-    result = stack_to_tuple_helper(CHECKED_PTR_OF(STACK_OF(X509), certs),
-                                   cms_object_helper_get_cert);
-  else if (!ERR_peek_error())
-    result = Py_BuildValue("()");
-  else
-    lose_openssl_error("Could not extract certs from CMS message");
-
- error:                          /* fall through */
-
-  if (certs)
-    sk_X509_pop_free(certs, X509_free);
-
-  return result;
-}
-
-static PyObject *
-cms_object_helper_get_crl(void *crl)
-{
-  x509_crl_object *obj = PyObject_New(x509_crl_object, &x509_crltype);
-
-  if (obj)
-    obj->crl = crl;
-
-  return (PyObject *) obj;
-}
-
-static char CMS_object_crls__doc__[] =
-"<method>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"      <name>crls</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This method returns any CRLs embedded in a CMS message.\n"
-"      </para>\n"
-"   </body>\n"
-"</method>\n"
-;
-
-static PyObject *
-CMS_object_crls(cms_object *self, PyObject *args)
-{
-  STACK_OF(X509_CRL) *crls = NULL;
-  PyObject *result = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((crls = CMS_get1_crls(self->cms)) != NULL)
-    result = stack_to_tuple_helper(CHECKED_PTR_OF(STACK_OF(X509_CRL), crls),
-                                   cms_object_helper_get_crl);
-  else if (!ERR_peek_error())
-    result = Py_BuildValue("()");
-  else
-    lose_openssl_error("Could not extract CRLs from CMS message");
-
- error:                          /* fall through */
-
-  if (crls)
-    sk_X509_CRL_pop_free(crls, X509_CRL_free);
-
-  return result;
-}
-
-static struct PyMethodDef CMS_object_methods[] = {
-  {"pemWrite",     (PyCFunction)CMS_object_pem_write,    METH_VARARGS,  NULL},
-  {"derWrite",     (PyCFunction)CMS_object_der_write,    METH_VARARGS,  NULL},
-  {"sign",         (PyCFunction)CMS_object_sign,         METH_VARARGS,  NULL},
-  {"verify",       (PyCFunction)CMS_object_verify,       METH_VARARGS,  NULL},
-  {"eContentType", (PyCFunction)CMS_object_eContentType, METH_VARARGS,  NULL},
-  {"signingTime",  (PyCFunction)CMS_object_signingTime,  METH_VARARGS,  NULL},
-  {"pprint",       (PyCFunction)CMS_object_pprint,       METH_VARARGS,  NULL},
-  {"certs",        (PyCFunction)CMS_object_certs,        METH_VARARGS,  NULL},
-  {"crls",         (PyCFunction)CMS_object_crls,         METH_VARARGS,  NULL},
-
-  {NULL}    /* sentinel */
-};
-
-static PyObject *
-CMS_object_getattr(cms_object *self, char *name)
-{
-  return Py_FindMethod(CMS_object_methods, (PyObject *)self, name);
-}
-
-static void
-CMS_object_dealloc(cms_object *self, char *name)
-{
-  CMS_ContentInfo_free(self->cms);
-  PyObject_Del(self);
-}
-
-static char cmstype__doc__[] =
-"<class>\n"
-"   <header>\n"
-"      <name>CMS</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This class provides basic access OpenSSL's CMS functionality.\n"
-"      </para>\n"
-"   </body>\n"
-"</class>\n"
-;
-
-static PyTypeObject cmstype = {
-   PyObject_HEAD_INIT(0)
-   0,                                  /*ob_size*/
-   "CMS",                              /*tp_name*/
-   sizeof(cms_object),                 /*tp_basicsize*/
-   0,                                  /*tp_itemsize*/
-   (destructor)CMS_object_dealloc,     /*tp_dealloc*/
-   (printfunc)0,                       /*tp_print*/
-   (getattrfunc)CMS_object_getattr,    /*tp_getattr*/
-   (setattrfunc)0,                     /*tp_setattr*/
-   (cmpfunc)0,                         /*tp_compare*/
-   (reprfunc)0,                        /*tp_repr*/
-   0,                                  /*tp_as_number*/
-   0,                                  /*tp_as_sequence*/
-   0,                                  /*tp_as_mapping*/
-   (hashfunc)0,                        /*tp_hash*/
-   (ternaryfunc)0,                     /*tp_call*/
-   (reprfunc)0,                        /*tp_str*/
-   0,
-   0,
-   0,
-   0,
-   cmstype__doc__                    /* Documentation string */
-};
-/*========== CMS Code ==========*/
-
-/*========== module functions ==========*/
-static char pow_module_new_ssl__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>Ssl</memberof>\n"
-"      <parameter>protocol = SSLV23METHOD</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor creates a new <classname>Ssl</classname> object which will behave as a client\n"
-"         or server, depending on the <parameter>protocol</parameter> value passed.  The\n"
-"         <parameter>protocol</parameter> also determines the protocol type\n"
-"         and version and should be one of the following:\n"
-"      </para>\n"
-"\n"
-"      <simplelist>\n"
-"         <member><constant>SSLV2_SERVER_METHOD</constant></member>\n"
-"         <member><constant>SSLV2_CLIENT_METHOD</constant></member>\n"
-"         <member><constant>SSLV2_METHOD</constant></member>\n"
-"         <member><constant>SSLV3_SERVER_METHOD</constant></member>\n"
-"         <member><constant>SSLV3_CLIENT_METHOD</constant></member>\n"
-"         <member><constant>SSLV3_METHOD</constant></member>\n"
-"         <member><constant>TLSV1_SERVER_METHOD</constant></member>\n"
-"         <member><constant>TLSV1_CLIENT_METHOD</constant></member>\n"
-"         <member><constant>TLSV1_METHOD</constant></member>\n"
-"         <member><constant>SSLV23_SERVER_METHOD</constant></member>\n"
-"         <member><constant>SSLV23_CLIENT_METHOD</constant></member>\n"
-"         <member><constant>SSLV23_METHOD</constant></member>\n"
-"      </simplelist>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_ssl (PyObject *self, PyObject *args)
-{
-  ssl_object *ssl = NULL;
-  int ctxtype = SSLV23_METHOD;
-
-  if (!PyArg_ParseTuple(args, "|i", &ctxtype))
-    goto error;
-
-  if ((ssl = newssl_object(ctxtype)) == NULL)
-    goto error;
-
-  return (PyObject*) ssl;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_x509__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>X509</memberof>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor creates a skeletal X509 certificate object.\n"
-"         It won't be any use at all until several structures\n"
-"         have been created using it's member functions.\n"
-"      </para>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_x509 (PyObject *self, PyObject *args)
-{
-  x509_object *x509 = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((x509 = X509_object_new()) == NULL)
-    lose("could not create new x509 object");
-
-  return (PyObject*)x509;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_asymmetric__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>Asymmetric</memberof>\n"
-"      <parameter>ciphertype = RSA_CIPHER</parameter>\n"
-"      <parameter>keylength = 1024</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor builds a new cipher object.  Only RSA ciphers\n"
-"         are currently support, so the first argument should always be\n"
-"         <constant>RSA_CIPHER</constant>.  The second argument,\n"
-"         <parameter>keylength</parameter>,\n"
-"         is normally 512, 768, 1024 or 2048.  Key lengths as short as 512\n"
-"         bits are generally considered weak, and can be cracked by\n"
-"         determined attackers without tremendous expense.\n"
-"      </para>\n"
-"      <example>\n"
-"         <title><classname>asymmetric</classname> class usage</title>\n"
-"         <programlisting>\n"
-"      privateFile = open('test/private.key', 'w')\n"
-"      publicFile = open('test/public.key', 'w')\n"
-"\n"
-"      passphrase = 'my silly passphrase'\n"
-"      md5 = POW.Digest(POW.MD5_DIGEST)\n"
-"      md5.update(passphrase)\n"
-"      password = md5.digest()\n"
-"\n"
-"      rsa = POW.Asymmetric(POW.RSA_CIPHER, 1024)\n"
-"      privateFile.write(rsa.pemWrite(\n"
-"               POW.RSA_PRIVATE_KEY, POW.DES_EDE3_CFB, password))\n"
-"      publicFile.write(rsa.pemWrite(POW.RSA_PUBLIC_KEY))\n"
-"\n"
-"      privateFile.close()\n"
-"      publicFile.close()\n"
-"         </programlisting>\n"
-"      </example>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_asymmetric (PyObject *self, PyObject *args)
-{
-  int cipher_type = RSA_CIPHER, key_size = 1024;
-
-  if (!PyArg_ParseTuple(args, "|ii", &cipher_type, &key_size))
-    goto error;
-
-  return (PyObject*) asymmetric_object_new(cipher_type, key_size);
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_digest__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>Digest</memberof>\n"
-"      <parameter>type</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor creates a new <classname>Digest</classname>\n"
-"         object.  The parameter <parameter>type</parameter> specifies what kind\n"
-"         of digest to create and should be one of the following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-#ifndef OPENSSL_NO_MD2
-"         <member><constant>MD2_DIGEST</constant></member>\n"
-#endif
-"         <member><constant>MD5_DIGEST</constant></member>\n"
-"         <member><constant>SHA_DIGEST</constant></member>\n"
-"         <member><constant>SHA1_DIGEST</constant></member>\n"
-"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
-"         <member><constant>SHA256_DIGEST</constant></member>\n"
-"         <member><constant>SHA384_DIGEST</constant></member>\n"
-"         <member><constant>SHA512_DIGEST</constant></member>\n"
-"      </simplelist>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_digest (PyObject *self, PyObject *args)
-{
-  int digest_type = 0;
-
-  if (!PyArg_ParseTuple(args, "i", &digest_type))
-    goto error;
-
-  return (PyObject*) digest_object_new(digest_type);
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_hmac__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>Hmac</memberof>\n"
-"      <parameter>type</parameter>\n"
-"      <parameter>key</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor creates a new <classname>Hmac</classname>\n"
-"         object.  The parameter <parameter>key</parameter> should be a\n"
-"         string and <parameter>type</parameter> should be one of the following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-#ifndef OPENSSL_NO_MD2
-"         <member><constant>MD2_DIGEST</constant></member>\n"
-#endif
-"         <member><constant>MD5_DIGEST</constant></member>\n"
-"         <member><constant>SHA_DIGEST</constant></member>\n"
-"         <member><constant>SHA1_DIGEST</constant></member>\n"
-"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
-"         <member><constant>SHA256_DIGEST</constant></member>\n"
-"         <member><constant>SHA384_DIGEST</constant></member>\n"
-"         <member><constant>SHA512_DIGEST</constant></member>\n"
-"      </simplelist>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_hmac (PyObject *self, PyObject *args)
-{
-  int digest_type = 0, key_len = 0;
-  char *key = NULL;
-
-  if (!PyArg_ParseTuple(args, "is#", &digest_type, &key, &key_len))
-    goto error;
-
-  return (PyObject*) hmac_object_new(digest_type, key, key_len);
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_cms__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>CMS</memberof>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor creates a skeletal CMS object.\n"
-"      </para>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_cms (PyObject *self, PyObject *args)
-{
-  cms_object *cms = NULL;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  if ((cms = CMS_object_new()) == NULL)
-    lose("could not create new CMS object");
-
-  return (PyObject*)cms;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_pem_read__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>pemRead</name>\n"
-"      <parameter>type</parameter>\n"
-"      <parameter>string</parameter>\n"
-"      <parameter>pass = None</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function attempts to parse the <parameter>string</parameter> according to the PEM\n"
-"         type passed. <parameter>type</parameter> should be one of the\n"
-"         following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-"         <member><constant>RSA_PUBLIC_KEY</constant></member>\n"
-"         <member><constant>RSA_PRIVATE_KEY</constant></member>\n"
-"         <member><constant>X509_CERTIFICATE</constant></member>\n"
-"         <member><constant>X509_CRL</constant></member>\n"
-"         <member><constant>CMS_MESSAGE</constant></member>\n"
-"      </simplelist>\n"
-"      <para>\n"
-"         <parameter>pass</parameter> should only be provided if an encrypted\n"
-"         <classname>Asymmetric</classname> is being loaded.  If the password\n"
-"         is incorrect an exception will be raised, if no password is provided\n"
-"         and the PEM file is encrypted the user will be prompted.  If this is\n"
-"         not desirable, always supply a password.  The object returned will be\n"
-"         and instance of <classname>Asymmetric</classname>,\n"
-"         <classname>X509</classname>, <classname>X509Crl</classname>,\n"
-"         or <classname>CMS</classname>.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_pem_read (PyObject *self, PyObject *args)
-{
-  BIO *in = NULL;
-  PyObject *obj = NULL;
-  int object_type = 0, len = 0;
-  char *pass = NULL, *src = NULL;
-
-  if (!PyArg_ParseTuple(args, "is#|s", &object_type, &src, &len, &pass))
-    goto error;
-
-  if ((in = BIO_new_mem_buf(src, len)) == NULL)
-    lose("unable to create new BIO");
-
-  switch(object_type) {
-  case RSA_PRIVATE_KEY:
-    obj = (PyObject*)asymmetric_object_pem_read(object_type, in, pass);
-    break;
-  case RSA_PUBLIC_KEY:
-    obj = (PyObject*)asymmetric_object_pem_read(object_type, in, pass);
-    break;
-  case X509_CERTIFICATE:
-    obj = (PyObject*)X509_object_pem_read(in);
-    break;
-  case X_X509_CRL:
-    obj = (PyObject*)x509_crl_object_pem_read(in);
-    break;
-  case CMS_MESSAGE:
-    obj = (PyObject*)CMS_object_pem_read(in);
-    break;
-  default:
-    lose("unknown pem encoding");
-  }
-
-  BIO_free(in);
-
-  if (obj)
-    return obj;
-
- error:
-
-  return NULL;
-}
-
-
-static char pow_module_der_read__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>derRead</name>\n"
-"      <parameter>type</parameter>\n"
-"      <parameter>string</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function attempts to parse the <parameter>string</parameter> according to the PEM\n"
-"         type passed. <parameter>type</parameter> should be one of the\n"
-"         following:\n"
-"      </para>\n"
-"      <simplelist>\n"
-"         <member><constant>RSA_PUBLIC_KEY</constant></member>\n"
-"         <member><constant>RSA_PRIVATE_KEY</constant></member>\n"
-"         <member><constant>X509_CERTIFICATE</constant></member>\n"
-"         <member><constant>X509_CRL</constant></member>\n"
-"         <member><constant>CMS_MESSAGE</constant></member>\n"
-"      </simplelist>\n"
-"      <para>\n"
-"         As with the PEM operations, the object returned will be and instance\n"
-"         of <classname>Asymmetric</classname>, <classname>X509</classname>,\n"
-"         <classname>X509Crl</classname>, or <classname>CMS</classname>.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_der_read (PyObject *self, PyObject *args)
-{
-  PyObject *obj = NULL;
-  int object_type = 0, len = 0;
-  unsigned char *src = NULL;
-
-  if (!PyArg_ParseTuple(args, "is#", &object_type, &src, &len))
-    goto error;
-
-  switch(object_type) {
-  case RSA_PRIVATE_KEY:
-    obj = (PyObject*) asymmetric_object_der_read(object_type, src, len);
-    break;
-  case RSA_PUBLIC_KEY:
-    obj = (PyObject*) asymmetric_object_der_read(object_type, src, len);
-    break;
-  case X509_CERTIFICATE:
-    obj = (PyObject*)X509_object_der_read(src, len);
-    break;
-  case X_X509_CRL:
-    obj = (PyObject*)x509_crl_object_der_read(src, len);
-    break;
-  case CMS_MESSAGE:
-    obj = (PyObject*)CMS_object_der_read((char *) src, len);
-    break;
-  default:
-    lose("unknown der encoding");
-  }
-
-  if (obj)
-    return obj;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_x509_store__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>X509Store</memberof>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor takes no arguments.  The\n"
-"         <classname>X509Store</classname> returned cannot be used for\n"
-"         verifying certificates until at least one trusted certificate has been\n"
-"         added.\n"
-"      </para>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_x509_store (PyObject *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  return (PyObject *) x509_store_object_new();
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_symmetric__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>Symmetric</memberof>\n"
-"      <parameter>type</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor creates a new <classname>Symmetric</classname>\n"
-"         object.  The parameter <parameter>type</parameter> specifies which kind\n"
-"         of cipher to create. <constant>type</constant> should be one of the following:\n"
-"      </para>\n"
-"      <simplelist columns = \"2\">\n"
-"         <member><constant>DES_ECB</constant></member>\n"
-"         <member><constant>DES_EDE</constant></member>\n"
-"         <member><constant>DES_EDE3</constant></member>\n"
-"         <member><constant>DES_CFB</constant></member>\n"
-"         <member><constant>DES_EDE_CFB</constant></member>\n"
-"         <member><constant>DES_EDE3_CFB</constant></member>\n"
-"         <member><constant>DES_OFB</constant></member>\n"
-"         <member><constant>DES_EDE_OFB</constant></member>\n"
-"         <member><constant>DES_EDE3_OFB</constant></member>\n"
-"         <member><constant>DES_CBC</constant></member>\n"
-"         <member><constant>DES_EDE_CBC</constant></member>\n"
-"         <member><constant>DES_EDE3_CBC</constant></member>\n"
-"         <member><constant>DESX_CBC</constant></member>\n"
-"         <member><constant>RC4</constant></member>\n"
-"         <member><constant>RC4_40</constant></member>\n"
-"         <member><constant>IDEA_ECB</constant></member>\n"
-"         <member><constant>IDEA_CFB</constant></member>\n"
-"         <member><constant>IDEA_OFB</constant></member>\n"
-"         <member><constant>IDEA_CBC</constant></member>\n"
-"         <member><constant>RC2_ECB</constant></member>\n"
-"         <member><constant>RC2_CBC</constant></member>\n"
-"         <member><constant>RC2_40_CBC</constant></member>\n"
-"         <member><constant>RC2_CFB</constant></member>\n"
-"         <member><constant>RC2_OFB</constant></member>\n"
-"         <member><constant>BF_ECB</constant></member>\n"
-"         <member><constant>BF_CBC</constant></member>\n"
-"         <member><constant>BF_CFB</constant></member>\n"
-"         <member><constant>BF_OFB</constant></member>\n"
-"         <member><constant>CAST5_ECB</constant></member>\n"
-"         <member><constant>CAST5_CBC</constant></member>\n"
-"         <member><constant>CAST5_CFB</constant></member>\n"
-"         <member><constant>CAST5_OFB</constant></member>\n"
-"         <member><constant>RC5_32_12_16_CBC</constant></member>\n"
-"         <member><constant>RC5_32_12_16_CFB</constant></member>\n"
-"         <member><constant>RC5_32_12_16_ECB</constant></member>\n"
-"         <member><constant>RC5_32_12_16_OFB</constant></member>\n"
-"      </simplelist>\n"
-"      <para>\n"
-"         Please note your version of OpenSSL might not have been compiled with\n"
-"         all the ciphers listed above.  If that is the case, which is very\n"
-"         likely if you are using a stock binary, the unsuported ciphers will not even\n"
-"         be in the module namespace.\n"
-"      </para>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_symmetric (PyObject *self, PyObject *args)
-{
-  int cipher_type = 0;
-
-  if (!PyArg_ParseTuple(args, "i", &cipher_type))
-    goto error;
-
-  return (PyObject *) symmetric_object_new(cipher_type);
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_x509_crl__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>x509_crl</memberof>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor builds an empty CRL.\n"
-"      </para>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_x509_crl (PyObject *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  return (PyObject *) x509_crl_object_new();
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_new_x509_revoked__doc__[] =
-"<constructor>\n"
-"   <header>\n"
-"      <memberof>X509Revoked</memberof>\n"
-"      <parameter>serial</parameter>\n"
-"      <parameter>date</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This constructor builds a X509 Revoked structure.  <parameter>serial</parameter>\n"
-"         should be an integer and <parameter>date</parameter> should be and\n"
-"         UTCTime string.\n"
-"      </para>\n"
-"   </body>\n"
-"</constructor>\n"
-;
-
-static PyObject *
-pow_module_new_x509_revoked (PyObject *self, PyObject *args)
-{
-  int serial = -1;
-  char *date = NULL;
-  x509_revoked_object *revoke = NULL;
-
-  if (!PyArg_ParseTuple(args, "|is", &serial, &date))
-    goto error;
-
-  revoke = x509_revoked_object_new();
-  if (serial != -1 && !ASN1_INTEGER_set(revoke->revoked->serialNumber, serial))
-    lose("unable to set serial number");
-
-  if (date != NULL && !python_ASN1_TIME_set_string(revoke->revoked->revocationDate, date))
-    lose_type_error("Could not set revocationDate");
-
-  return (PyObject*) revoke;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_add_object__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>addObject</name>\n"
-"      <parameter>oid</parameter>\n"
-"      <parameter>shortName</parameter>\n"
-"      <parameter>longName</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function can be used to dynamically add new objects to\n"
-"         OpenSSL.  The <parameter>oid</parameter> should be a string of space separated numbers\n"
-"         and <parameter>shortName</parameter> and\n"
-"         <parameter>longName</parameter> are the names of the object, ie\n"
-"         'cn' and 'commonName'.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_add_object(PyObject *self, PyObject *args)
-{
-  char *oid = NULL, *sn = NULL, *ln = NULL;
-
-  if (!PyArg_ParseTuple(args, "sss", &oid, &sn, &ln))
-    goto error;
-
-  if (!OBJ_create(oid, sn, ln))
-    lose("unable to add object");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_get_error__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>getError</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         Pops an error off the global error stack and returns it as a string.\n"
-"         Returns None if the global error stack is empty.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_get_error(PyObject *self, PyObject *args)
-{
-  unsigned long error;
-  char buf[256];
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  error = ERR_get_error();
-
-  if (!error)
-    Py_RETURN_NONE;
-
-  ERR_error_string_n(error, buf, sizeof(buf));
-
-  return Py_BuildValue("s", buf);
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_clear_error__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>clearError</name>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         Removes all errors from the global error stack.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_clear_error(PyObject *self, PyObject *args)
-{
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  ERR_clear_error();
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_seed__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>seed</name>\n"
-"      <parameter>data</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         The <function>seed</function> function adds data to OpenSSLs PRNG\n"
-"         state.  It is often said the hardest part of cryptography is\n"
-"         getting good random data, after all if you don't have good random\n"
-"         data, a 1024 bit key is no better than a 512 bit key and neither\n"
-"         would provide protection from a targeted brute force attack.\n"
-"         The <function>seed</function> and <function>add</function> are very\n"
-"         similar, except the entropy of the data is assumed to be equal to\n"
-"         the length for <function>seed</function>.  One final point to be aware\n"
-"         of, only systems which support /dev/urandom are automatically seeded.\n"
-"         If your system does not support /dev/urandom it is your responsibility\n"
-"         to seed OpenSSL's PRNG.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_seed(PyObject *self, PyObject *args)
-{
-  char *in = NULL;
-  int inl = 0;
-
-  if (!PyArg_ParseTuple(args, "s#", &in, &inl))
-    goto error;
-
-  RAND_seed(in, inl);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_add__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>add</name>\n"
-"      <parameter>data</parameter>\n"
-"      <parameter>entropy</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         The <function>add</function> function adds data to OpenSSLs PRNG\n"
-"         state.  <parameter>data</parameter> should be data obtained from a\n"
-"         random source and <parameter>entropy</parameter> is an estimation of the number of random\n"
-"         bytes in <parameter>data</parameter>.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_add(PyObject *self, PyObject *args)
-{
-  char *in = NULL;
-  int inl = 0;
-  double entropy = 0;
-
-  if (!PyArg_ParseTuple(args, "s#d", &in, &inl, &entropy))
-    goto error;
-
-  RAND_add(in, inl, entropy);
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_write_random_file__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>writeRandomFile</name>\n"
-"      <parameter>filename</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function writes the current random state to a file.  Clearly\n"
-"         this function should be used in conjunction with\n"
-"         <function>readRandomFile</function>.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_write_random_file(PyObject *self, PyObject *args)
-{
-  char *file = NULL;
-
-  if (!PyArg_ParseTuple(args, "s", &file))
-    goto error;
-
-  if (RAND_write_file(file) == -1)
-    lose("could not write random file");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static char pow_module_read_random_file__doc__[] =
-"<modulefunction>\n"
-"   <header>\n"
-"      <name>readRandomFile</name>\n"
-"      <parameter>filename</parameter>\n"
-"   </header>\n"
-"   <body>\n"
-"      <para>\n"
-"         This function reads a previously saved random state.  It can be very\n"
-"         useful to improve the quality of random data used by an application.\n"
-"         The random data should be added to, using the\n"
-"         <function>add</function> function, with data from other\n"
-"         suitable random sources.\n"
-"      </para>\n"
-"   </body>\n"
-"</modulefunction>\n"
-;
-
-static PyObject *
-pow_module_read_random_file(PyObject *self, PyObject *args)
-{
-  char *file = NULL;
-  int len = -1;
-
-  if (!PyArg_ParseTuple(args, "s|i", &file, &len))
-    goto error;
-
-  if (!RAND_load_file(file, len))
-    lose("could not load random file");
-
-  Py_RETURN_NONE;
-
- error:
-
-  return NULL;
-}
-
-static PyObject *
-pow_module_docset(PyObject *self, PyObject *args)
-{
-  PyObject *docset;
-
-  if (!PyArg_ParseTuple(args, ""))
-    goto error;
-
-  docset = PyList_New(0);
-
-  // module documentation
-  docset_helper_add(docset, pow_module__doc__);
-
-  // constructors
-  docset_helper_add(docset, pow_module_new_symmetric__doc__);
-  docset_helper_add(docset, pow_module_new_asymmetric__doc__);
-  docset_helper_add(docset, pow_module_new_digest__doc__);
-  docset_helper_add(docset, pow_module_new_hmac__doc__);
-  docset_helper_add(docset, pow_module_new_ssl__doc__);
-  docset_helper_add(docset, pow_module_new_x509__doc__);
-  docset_helper_add(docset, pow_module_new_x509_store__doc__);
-  docset_helper_add(docset, pow_module_new_x509_crl__doc__);
-  docset_helper_add(docset, pow_module_new_x509_revoked__doc__);
-  docset_helper_add(docset, pow_module_new_cms__doc__);
-
-  // functions
-  docset_helper_add(docset, pow_module_pem_read__doc__);
-  docset_helper_add(docset, pow_module_der_read__doc__);
-  docset_helper_add(docset, pow_module_seed__doc__);
-  docset_helper_add(docset, pow_module_add__doc__);
-  docset_helper_add(docset, pow_module_read_random_file__doc__);
-  docset_helper_add(docset, pow_module_write_random_file__doc__);
-  docset_helper_add(docset, pow_module_get_error__doc__);
-  docset_helper_add(docset, pow_module_clear_error__doc__);
-  docset_helper_add(docset, pow_module_add_object__doc__);
-
-  // ssl documentation
-  docset_helper_add(docset, ssltype__doc__);
-  docset_helper_add(docset, ssl_object_set_fd__doc__);
-  docset_helper_add(docset, ssl_object_fileno__doc__);
-  docset_helper_add(docset, ssl_object_accept__doc__);
-  docset_helper_add(docset, ssl_object_connect__doc__);
-  docset_helper_add(docset, ssl_object_write__doc__);
-  docset_helper_add(docset, ssl_object_read__doc__);
-  docset_helper_add(docset, ssl_object_peer_certificate__doc__);
-  docset_helper_add(docset, ssl_object_use_certificate__doc__);
-  docset_helper_add(docset, ssl_object_use_key__doc__);
-  docset_helper_add(docset, ssl_object_check_key__doc__);
-  docset_helper_add(docset, ssl_object_clear__doc__);
-  docset_helper_add(docset, ssl_object_shutdown__doc__);
-  docset_helper_add(docset, ssl_object_get_shutdown__doc__);
-  docset_helper_add(docset, ssl_object_get_ciphers__doc__);
-  docset_helper_add(docset, ssl_object_set_ciphers__doc__);
-  docset_helper_add(docset, ssl_object_get_cipher__doc__);
-  docset_helper_add(docset, ssl_object_set_verify_mode__doc__);
-
-  // x509 documentation
-  docset_helper_add(docset, x509type__doc__);
-  docset_helper_add(docset, X509_object_pem_write__doc__);
-  docset_helper_add(docset, X509_object_der_write__doc__);
-  docset_helper_add(docset, X509_object_sign__doc__);
-  docset_helper_add(docset, X509_object_set_public_key__doc__);
-  docset_helper_add(docset, X509_object_get_version__doc__);
-  docset_helper_add(docset, X509_object_set_version__doc__);
-  docset_helper_add(docset, X509_object_get_serial__doc__);
-  docset_helper_add(docset, X509_object_set_serial__doc__);
-  docset_helper_add(docset, X509_object_get_issuer__doc__);
-  docset_helper_add(docset, X509_object_set_issuer__doc__);
-  docset_helper_add(docset, X509_object_get_subject__doc__);
-  docset_helper_add(docset, X509_object_set_subject__doc__);
-  docset_helper_add(docset, X509_object_get_not_before__doc__);
-  docset_helper_add(docset, X509_object_set_not_before__doc__);
-  docset_helper_add(docset, X509_object_get_not_after__doc__);
-  docset_helper_add(docset, X509_object_set_not_after__doc__);
-  docset_helper_add(docset, X509_object_add_extension__doc__);
-  docset_helper_add(docset, X509_object_clear_extensions__doc__);
-  docset_helper_add(docset, X509_object_count_extensions__doc__);
-  docset_helper_add(docset, X509_object_get_extension__doc__);
-  docset_helper_add(docset, x509_object_pprint__doc__);
-
-  // x509_crl documentation
-  docset_helper_add(docset, x509_crltype__doc__);
-  docset_helper_add(docset, x509_crl_object_pem_write__doc__);
-  docset_helper_add(docset, x509_crl_object_der_write__doc__);
-  docset_helper_add(docset, x509_crl_object_get_version__doc__);
-  docset_helper_add(docset, x509_crl_object_set_version__doc__);
-  docset_helper_add(docset, x509_crl_object_get_issuer__doc__);
-  docset_helper_add(docset, x509_crl_object_set_issuer__doc__);
-  docset_helper_add(docset, x509_crl_object_get_this_update__doc__);
-  docset_helper_add(docset, x509_crl_object_set_this_update__doc__);
-  docset_helper_add(docset, x509_crl_object_get_next_update__doc__);
-  docset_helper_add(docset, x509_crl_object_set_next_update__doc__);
-  docset_helper_add(docset, x509_crl_object_get_revoked__doc__);
-  docset_helper_add(docset, x509_crl_object_set_revoked__doc__);
-  docset_helper_add(docset, x509_crl_object_verify__doc__);
-  docset_helper_add(docset, x509_crl_object_sign__doc__);
-  docset_helper_add(docset, X509_crl_object_add_extension__doc__);
-  docset_helper_add(docset, X509_crl_object_clear_extensions__doc__);
-  docset_helper_add(docset, X509_crl_object_count_extensions__doc__);
-  docset_helper_add(docset, X509_crl_object_get_extension__doc__);
-  docset_helper_add(docset, x509_crl_object_pprint__doc__);
-
-  // x509_revoked documentation
-  docset_helper_add(docset, x509_revokedtype__doc__);
-  docset_helper_add(docset, x509_revoked_object_get_date__doc__);
-  docset_helper_add(docset, x509_revoked_object_set_date__doc__);
-  docset_helper_add(docset, x509_revoked_object_get_serial__doc__);
-  docset_helper_add(docset, x509_revoked_object_set_serial__doc__);
-  docset_helper_add(docset, X509_revoked_object_add_extension__doc__);
-  docset_helper_add(docset, X509_revoked_object_clear_extensions__doc__);
-  docset_helper_add(docset, X509_revoked_object_count_extensions__doc__);
-  docset_helper_add(docset, X509_revoked_object_get_extension__doc__);
-
-  // x509_store documentation
-  docset_helper_add(docset, x509_storetype__doc__);
-  docset_helper_add(docset, x509_store_object_verify__doc__);
-  docset_helper_add(docset, x509_store_object_verify_chain__doc__);
-  docset_helper_add(docset, x509_store_object_verify_detailed__doc__);
-  docset_helper_add(docset, x509_store_object_add_trust__doc__);
-  docset_helper_add(docset, x509_store_object_add_crl__doc__);
-
-  // digest documentation
-  docset_helper_add(docset, digesttype__doc__);
-  docset_helper_add(docset, digest_object_update__doc__);
-  docset_helper_add(docset, digest_object_copy__doc__);
-  docset_helper_add(docset, digest_object_digest__doc__);
-
-  // hmac documentation
-  docset_helper_add(docset, hmactype__doc__);
-  docset_helper_add(docset, hmac_object_update__doc__);
-  docset_helper_add(docset, hmac_object_copy__doc__);
-  docset_helper_add(docset, hmac_object_mac__doc__);
-
-  // cms documentation
-  docset_helper_add(docset, CMS_object_pem_write__doc__);
-  docset_helper_add(docset, CMS_object_der_write__doc__);
-  docset_helper_add(docset, CMS_object_sign__doc__);
-  docset_helper_add(docset, CMS_object_verify__doc__);
-  docset_helper_add(docset, CMS_object_eContentType__doc__);
-  docset_helper_add(docset, CMS_object_signingTime__doc__);
-  docset_helper_add(docset, CMS_object_pprint__doc__);
-  docset_helper_add(docset, CMS_object_certs__doc__);
-  docset_helper_add(docset, CMS_object_crls__doc__);
-
-  // symmetric documentation
-  docset_helper_add(docset, symmetrictype__doc__);
-  docset_helper_add(docset, symmetric_object_encrypt_init__doc__);
-  docset_helper_add(docset, symmetric_object_decrypt_init__doc__);
-  docset_helper_add(docset, symmetric_object_update__doc__);
-  docset_helper_add(docset, symmetric_object_final__doc__);
-
-  // asymmetric documentation
-  docset_helper_add(docset, asymmetrictype__doc__);
-  docset_helper_add(docset, asymmetric_object_pem_write__doc__);
-  docset_helper_add(docset, asymmetric_object_der_write__doc__);
-  docset_helper_add(docset, asymmetric_object_public_encrypt__doc__);
-  docset_helper_add(docset, asymmetric_object_public_decrypt__doc__);
-  docset_helper_add(docset, asymmetric_object_private_encrypt__doc__);
-  docset_helper_add(docset, asymmetric_object_private_decrypt__doc__);
-  docset_helper_add(docset, asymmetric_object_sign__doc__);
-  docset_helper_add(docset, asymmetric_object_verify__doc__);
-
-  return docset;
-
- error:
-
-  return NULL;
-}
-
-static struct PyMethodDef pow_module_methods[] = {
-  {"Ssl",               (PyCFunction)pow_module_new_ssl,           METH_VARARGS,  NULL},
-  {"X509",              (PyCFunction)pow_module_new_x509,          METH_VARARGS,  NULL},
-  {"pemRead",           (PyCFunction)pow_module_pem_read,          METH_VARARGS,  NULL},
-  {"derRead",           (PyCFunction)pow_module_der_read,          METH_VARARGS,  NULL},
-  {"Digest",            (PyCFunction)pow_module_new_digest,        METH_VARARGS,  NULL},
-  {"Hmac",              (PyCFunction)pow_module_new_hmac,          METH_VARARGS,  NULL},
-  {"CMS",               (PyCFunction)pow_module_new_cms,           METH_VARARGS,  NULL},
-  {"Asymmetric",        (PyCFunction)pow_module_new_asymmetric,    METH_VARARGS,  NULL},
-  {"Symmetric",         (PyCFunction)pow_module_new_symmetric,     METH_VARARGS,  NULL},
-  {"X509Store",         (PyCFunction)pow_module_new_x509_store,    METH_VARARGS,  NULL},
-  {"X509Crl",           (PyCFunction)pow_module_new_x509_crl,      METH_VARARGS,  NULL},
-  {"X509Revoked",       (PyCFunction)pow_module_new_x509_revoked,  METH_VARARGS,  NULL},
-  {"getError",          (PyCFunction)pow_module_get_error,         METH_VARARGS,  NULL},
-  {"clearError",        (PyCFunction)pow_module_clear_error,       METH_VARARGS,  NULL},
-  {"seed",              (PyCFunction)pow_module_seed,              METH_VARARGS,  NULL},
-  {"add",               (PyCFunction)pow_module_add,               METH_VARARGS,  NULL},
-  {"readRandomFile",    (PyCFunction)pow_module_read_random_file,  METH_VARARGS,  NULL},
-  {"writeRandomFile",   (PyCFunction)pow_module_write_random_file, METH_VARARGS,  NULL},
-  {"addObject",         (PyCFunction)pow_module_add_object,        METH_VARARGS,  NULL},
-
-  {"_docset",           (PyCFunction)pow_module_docset,            METH_VARARGS,  NULL},
-
-  {NULL}     /* sentinel */
-};
-/*========== module functions ==========*/
-
-
-/*==========================================================================*/
-void
-init_POW(void)
-{
-  PyObject *m;
-
-  x509type.ob_type         = &PyType_Type;
-  x509_storetype.ob_type   = &PyType_Type;
-  x509_crltype.ob_type     = &PyType_Type;
-  x509_revokedtype.ob_type = &PyType_Type;
-  ssltype.ob_type          = &PyType_Type;
-  asymmetrictype.ob_type   = &PyType_Type;
-  symmetrictype.ob_type    = &PyType_Type;
-  digesttype.ob_type       = &PyType_Type;
-  hmactype.ob_type         = &PyType_Type;
-  cmstype.ob_type          = &PyType_Type;
-
-  m = Py_InitModule3("_POW", pow_module_methods, pow_module__doc__);
-
-#define Define_Exception(__name__, __parent__) \
-  PyModule_AddObject(m, #__name__, ((__name__##Object) = PyErr_NewException("POW." #__name__, __parent__, NULL)))
-
-  Define_Exception(Error,                NULL);
-  Define_Exception(SSLError,             ErrorObject);
-  Define_Exception(ZeroReturnError,      SSLErrorObject);
-  Define_Exception(WantReadError,        SSLErrorObject);
-  Define_Exception(WantWriteError,       SSLErrorObject);
-  Define_Exception(SSLSyscallError,      SSLErrorObject);
-  Define_Exception(SSLErrorSSLError,     SSLErrorObject);
-  Define_Exception(SSLSyscallSSLError,   SSLErrorObject);
-  Define_Exception(SSLUnexpectedEOFError,SSLErrorObject);
-  Define_Exception(SSLOtherError,        SSLErrorObject);
-
-#undef Define_Exception
-
-#define Define_Integer_Constant(__name__) \
-  PyModule_AddIntConstant(m, #__name__, __name__)
-
-  // constants for SSL_get_error()
-  Define_Integer_Constant(SSL_ERROR_NONE);
-  Define_Integer_Constant(SSL_ERROR_ZERO_RETURN);
-  Define_Integer_Constant(SSL_ERROR_WANT_READ);
-  Define_Integer_Constant(SSL_ERROR_WANT_WRITE);
-  Define_Integer_Constant(SSL_ERROR_WANT_X509_LOOKUP);
-  Define_Integer_Constant(SSL_ERROR_SYSCALL);
-  Define_Integer_Constant(SSL_ERROR_SSL);
-  Define_Integer_Constant(SSL_ERROR_WANT_CONNECT);
-  Define_Integer_Constant(SSL_ERROR_WANT_ACCEPT);
-
-  // constants for different types of connection methods
-  Define_Integer_Constant(SSLV2_SERVER_METHOD);
-  Define_Integer_Constant(SSLV2_CLIENT_METHOD);
-  Define_Integer_Constant(SSLV2_METHOD);
-  Define_Integer_Constant(SSLV3_SERVER_METHOD);
-  Define_Integer_Constant(SSLV3_CLIENT_METHOD);
-  Define_Integer_Constant(SSLV3_METHOD);
-  Define_Integer_Constant(SSLV23_SERVER_METHOD);
-  Define_Integer_Constant(SSLV23_CLIENT_METHOD);
-  Define_Integer_Constant(SSLV23_METHOD);
-  Define_Integer_Constant(TLSV1_SERVER_METHOD);
-  Define_Integer_Constant(TLSV1_CLIENT_METHOD);
-  Define_Integer_Constant(TLSV1_METHOD);
-
-  Define_Integer_Constant(SSL_NO_SHUTDOWN);
-  Define_Integer_Constant(SSL_SENT_SHUTDOWN);
-  Define_Integer_Constant(SSL_RECEIVED_SHUTDOWN);
-
-  // ssl verification mode
-  Define_Integer_Constant(SSL_VERIFY_NONE);
-  Define_Integer_Constant(SSL_VERIFY_PEER);
-  Define_Integer_Constant(SSL_VERIFY_FAIL_IF_NO_PEER_CERT);
-  Define_Integer_Constant(SSL_VERIFY_CLIENT_ONCE);
-
-  // object format types
-  Define_Integer_Constant(LONGNAME_FORMAT);
-  Define_Integer_Constant(SHORTNAME_FORMAT);
-
-  // PEM encoded types
-#ifndef OPENSSL_NO_RSA
-  Define_Integer_Constant(RSA_PUBLIC_KEY);
-  Define_Integer_Constant(RSA_PRIVATE_KEY);
-#endif
-#ifndef OPENSSL_NO_DSA
-  Define_Integer_Constant(DSA_PUBLIC_KEY);
-  Define_Integer_Constant(DSA_PRIVATE_KEY);
-#endif
-#ifndef OPENSSL_NO_DH
-  Define_Integer_Constant(DH_PUBLIC_KEY);
-  Define_Integer_Constant(DH_PRIVATE_KEY);
-#endif
-  Define_Integer_Constant(X509_CERTIFICATE);
-  PyModule_AddIntConstant(m, "X509_CRL", X_X509_CRL);
-  Define_Integer_Constant(CMS_MESSAGE);
-
-  // asymmetric ciphers
-#ifndef OPENSSL_NO_RSA
-  Define_Integer_Constant(RSA_CIPHER);
-#endif
-#ifndef OPENSSL_NO_DSA
-  Define_Integer_Constant(DSA_CIPHER);
-#endif
-#ifndef OPENSSL_NO_DH
-  Define_Integer_Constant(DH_CIPHER);
-#endif
-
-  // symmetric ciphers
-#ifndef OPENSSL_NO_DES
-  Define_Integer_Constant(DES_ECB);
-  Define_Integer_Constant(DES_EDE);
-  Define_Integer_Constant(DES_EDE3);
-  Define_Integer_Constant(DES_CFB);
-  Define_Integer_Constant(DES_EDE_CFB);
-  Define_Integer_Constant(DES_EDE3_CFB);
-  Define_Integer_Constant(DES_OFB);
-  Define_Integer_Constant(DES_EDE_OFB);
-  Define_Integer_Constant(DES_EDE3_OFB);
-  Define_Integer_Constant(DES_CBC);
-  Define_Integer_Constant(DES_EDE_CBC);
-  Define_Integer_Constant(DES_EDE3_CBC);
-  Define_Integer_Constant(DESX_CBC);
-#endif
-#ifndef OPENSSL_NO_RC4
-  Define_Integer_Constant(RC4);
-  Define_Integer_Constant(RC4_40);
-#endif
-#ifndef OPENSSL_NO_IDEA
-  Define_Integer_Constant(IDEA_ECB);
-  Define_Integer_Constant(IDEA_CFB);
-  Define_Integer_Constant(IDEA_OFB);
-  Define_Integer_Constant(IDEA_CBC);
-#endif
-#ifndef OPENSSL_NO_RC2
-  Define_Integer_Constant(RC2_ECB);
-  Define_Integer_Constant(RC2_CBC);
-  Define_Integer_Constant(RC2_40_CBC);
-  Define_Integer_Constant(RC2_CFB);
-  Define_Integer_Constant(RC2_OFB);
-#endif
-#ifndef OPENSSL_NO_BF
-  Define_Integer_Constant(BF_ECB);
-  Define_Integer_Constant(BF_CBC);
-  Define_Integer_Constant(BF_CFB);
-  Define_Integer_Constant(BF_OFB);
-#endif
-  Define_Integer_Constant(CAST5_ECB);
-  Define_Integer_Constant(CAST5_CBC);
-  Define_Integer_Constant(CAST5_CFB);
-  Define_Integer_Constant(CAST5_OFB);
-#ifndef OPENSSL_NO_RC5
-  Define_Integer_Constant(RC5_32_12_16_CBC);
-  Define_Integer_Constant(RC5_32_12_16_CFB);
-  Define_Integer_Constant(RC5_32_12_16_ECB);
-  Define_Integer_Constant(RC5_32_12_16_OFB);
-#endif
-
-  // message digests
-#ifndef OPENSSL_NO_MD2
-  Define_Integer_Constant(MD2_DIGEST);
-#endif
-  Define_Integer_Constant(MD5_DIGEST);
-  Define_Integer_Constant(SHA_DIGEST);
-  Define_Integer_Constant(SHA1_DIGEST);
-  Define_Integer_Constant(RIPEMD160_DIGEST);
-  Define_Integer_Constant(SHA256_DIGEST);
-  Define_Integer_Constant(SHA384_DIGEST);
-  Define_Integer_Constant(SHA512_DIGEST);
-
-  // general name
-  Define_Integer_Constant(GEN_OTHERNAME);
-  Define_Integer_Constant(GEN_EMAIL);
-  Define_Integer_Constant(GEN_DNS);
-  Define_Integer_Constant(GEN_X400);
-  Define_Integer_Constant(GEN_DIRNAME);
-  Define_Integer_Constant(GEN_EDIPARTY);
-  Define_Integer_Constant(GEN_URI);
-  Define_Integer_Constant(GEN_IPADD);
-  Define_Integer_Constant(GEN_RID);
-
-  // CMS flags
-  Define_Integer_Constant(CMS_NOCERTS);
-  Define_Integer_Constant(CMS_NOATTR);
-  Define_Integer_Constant(CMS_NOINTERN);
-  Define_Integer_Constant(CMS_NOCRL);
-  Define_Integer_Constant(CMS_NO_SIGNER_CERT_VERIFY);
-  Define_Integer_Constant(CMS_NO_ATTR_VERIFY);
-  Define_Integer_Constant(CMS_NO_CONTENT_VERIFY);
-
-#undef Define_Integer_Constant
-
-  // initialise library
-  SSL_library_init();
-  OpenSSL_add_all_algorithms();
-  OpenSSL_add_all_ciphers();
-  OpenSSL_add_all_digests();
-
-  // load error strings
-  SSL_load_error_strings();
-
-  if (PyErr_Occurred())
-    Py_FatalError("Can't initialize module POW");
-}
-/*==========================================================================*/
-
-/*
- * Local Variables:
- * indent-tabs-mode: nil
- * End:
- */