/*****************************************************************************/
/*                                                                           */
/*  Copyright (c) 2001, 2002, Peter Shannon                                  */
/*  All rights reserved.                                                     */
/*                                                                           */
/*  Redistribution and use in source and binary forms, with or without       */
/*  modification, are permitted provided that the following conditions       */
/*  are met:                                                                 */
/*                                                                           */
/*      * Redistributions of source code must retain the above               */
/*        copyright notice, this list of conditions and the following        */
/*        disclaimer.                                                        */
/*                                                                           */
/*      * Redistributions in binary form must reproduce the above            */
/*        copyright notice, this list of conditions and the following        */
/*        disclaimer in the documentation and/or other materials             */
/*        provided with the distribution.                                    */
/*                                                                           */
/*      * The name of the contributors may be used to endorse or promote     */
/*        products derived from this software without specific prior         */
/*        written permission.                                                */
/*                                                                           */
/*  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS      */
/*  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT        */
/*  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS        */
/*  FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS   */
/*  OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,          */
/*  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT         */
/*  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,    */
/*  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY    */
/*  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT      */
/*  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE    */
/*  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.     */
/*                                                                           */
/*****************************************************************************/

#include <Python.h>

#include <openssl/opensslconf.h>
#include <openssl/crypto.h>
#include <openssl/rand.h>
#include <openssl/asn1.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/pem.h>
#include <openssl/ssl.h>
#include <openssl/evp.h>
#include <openssl/err.h>
#include <openssl/md5.h>
#ifndef OPENSSL_NO_MD2
#include <openssl/md2.h>
#endif
#include <openssl/sha.h>
#include <openssl/hmac.h>
#include <openssl/ripemd.h>
#include <openssl/cms.h>

#include <time.h>

// Symmetric ciphers
#define DES_ECB               1
#define DES_EDE               2
#define DES_EDE3              3
#define DES_CFB               4
#define DES_EDE_CFB           5
#define DES_EDE3_CFB          6
#define DES_OFB               7
#define DES_EDE_OFB           8
#define DES_EDE3_OFB          9
#define DES_CBC               10
#define DES_EDE_CBC           11
#define DES_EDE3_CBC          12
#define DESX_CBC              13
#define RC4                   14
#define RC4_40                15
#define IDEA_ECB              16
#define IDEA_CFB              17
#define IDEA_OFB              18
#define IDEA_CBC              19
#define RC2_ECB               20
#define RC2_CBC               21
#define RC2_40_CBC            22
#define RC2_CFB               23
#define RC2_OFB               24
#define BF_ECB                25
#define BF_CBC                26
#define BF_CFB                27
#define BF_OFB                28
#define CAST5_ECB             29
#define CAST5_CBC             30
#define CAST5_CFB             31
#define CAST5_OFB             32
#define RC5_32_12_16_CBC      33
#define RC5_32_12_16_CFB      34
#define RC5_32_12_16_ECB      35
#define RC5_32_12_16_OFB      36

// SSL connection methods
#define SSLV2_SERVER_METHOD   1
#define SSLV2_CLIENT_METHOD   2
#define SSLV2_METHOD          3
#define SSLV3_SERVER_METHOD   4
#define SSLV3_CLIENT_METHOD   5
#define SSLV3_METHOD          6
#define TLSV1_SERVER_METHOD   7
#define TLSV1_CLIENT_METHOD   8
#define TLSV1_METHOD          9
#define SSLV23_SERVER_METHOD  10
#define SSLV23_CLIENT_METHOD  11
#define SSLV23_METHOD         12

// SSL connection states

// PEM encoded data types
#define RSA_PUBLIC_KEY        1
#define RSA_PRIVATE_KEY       2
#define DSA_PUBLIC_KEY        3
#define DSA_PRIVATE_KEY       4
#define DH_PUBLIC_KEY         5
#define DH_PRIVATE_KEY        6
#define X509_CERTIFICATE      7
#define X_X509_CRL            8     // X509_CRL already used by OpenSSL library
#define CMS_MESSAGE           9

// Asymmetric ciphers
#define RSA_CIPHER            1
#define DSA_CIPHER            2
#define DH_CIPHER             3
//#define NO_DSA
//#define NO_DH

// Digests
#ifndef OPENSSL_NO_MD2
#define MD2_DIGEST            1
#endif
#define MD5_DIGEST            2
#define SHA_DIGEST            3
#define SHA1_DIGEST           4
#define RIPEMD160_DIGEST      5
#define SHA256_DIGEST         6
#define SHA384_DIGEST         7
#define SHA512_DIGEST         8

// Object format
#define SHORTNAME_FORMAT      1
#define LONGNAME_FORMAT       2

// Output format
#define PEM_FORMAT            1
#define DER_FORMAT            2

// Object check functions
#define X_X509_Check(op)         ((op)->ob_type == &x509type)
#define X_X509_store_Check(op)   ((op)->ob_type == &x509_storetype)
#define X_X509_crl_Check(op)     ((op)->ob_type == &x509_crltype)
#define X_X509_revoked_Check(op) ((op)->ob_type == &x509_revokedtype)
#define X_asymmetric_Check(op)   ((op)->ob_type == &asymmetrictype)
#define X_symmetric_Check(op)    ((op)->ob_type == &symmetrictype)
#define X_digest_Check(op)       ((op)->ob_type == &digesttype)
#define X_hmac_Check(op)         ((op)->ob_type == &hmactype)
#define X_ssl_Check(op)          ((op)->ob_type == &ssltype)
#define X_cms_Check(op)          ((op)->ob_type == &cmstype)

// Symbolic representation of "no SSL shutdown mode requested"
#define SSL_NO_SHUTDOWN       0

static char pow_module__doc__ [] =
"<moduleDescription>\n"
"   <header>\n"
"      <name>POW</name>\n"
"      <author>Peter Shannon</author>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This third major release of POW addresses the most critical missing\n"
"         parts of functionality, X509v3 support.  Initially I thought adding\n"
"         support via the OpenSSL code would be the easiest option but this\n"
"         proved to be incorrect mainly due to the way I have chosen to handle\n"
"         the complex data such as <classname>directoryNames</classname> and\n"
"         <classname>generalNames</classname>.  It is easier in python to\n"
"         construct complex sets of data using lists and dictionaries than\n"
"         coordinate large numbers of objects and method calls.  This is no\n"
"         criticism, it is just extremely easy.  Coding complex data such as the\n"
"         <classname>certificatePolicies</classname> coding coding routines in C\n"
"         to handle the data proved laborous and ultimately error prone.\n"
"      </para>\n"
"      <para>\n"
"         PKIX structures are supported by a few operations on the relevant POW\n"
"         objects and through a Python library which is modelled on the DER\n"
"         encoding rules.  Modeling DER does expose some of the complexities of\n"
"         the ASN1 specifications but avoids coding many assumptions into the\n"
"         data structures and the interface for the objects.  For an example of\n"
"         overly complex definitions take a look at the\n"
"         <classname>Name</classname> object in RFC3280.  It is equally\n"
"         important that modeling DER in the way leads to a library which is\n"
"         trivial to extend to support new objects - simple objects are one\n"
"         liners and complex objects only require the definition of a new\n"
"         constructor.\n"
"      </para>\n"
"      <para>\n"
"         functionality have been plugged.  The <classname>Ssl</classname> class has received\n"
"         several new features relating to security.  Other areas have been\n"
"         improved: PRNG support, certificate and CRL signing, certificate chain\n"
"         and client verification.  Many bugs have been fixed, and certain\n"
"         parts of code re-written where necessary.  I hope you enjoy using POW\n"
"         and please feel free to send me feature requests and bug reports.\n"
"      </para>\n"
"   </body>\n"
"</moduleDescription>\n"
;

/*========== Pre-definitions ==========*/
static PyObject
  *ErrorObject,
  *SSLErrorObject,
  *ZeroReturnErrorObject,
  *WantReadErrorObject,
  *WantWriteErrorObject,
  *SSLSyscallErrorObject,
  *SSLErrorSSLErrorObject,
  *SSLSyscallSSLErrorObject,
  *SSLUnexpectedEOFErrorObject,
  *SSLOtherErrorObject;

static PyTypeObject
  x509type,
  x509_storetype,
  x509_crltype,
  x509_revokedtype,
  asymmetrictype,
  symmetrictype,
  digesttype,
  hmactype,
  ssltype,
  cmstype;
/*========== Pre-definitions ==========*/

/*========== C structs ==========*/
typedef struct {
  PyObject_HEAD
  X509 *x509;
} x509_object;

typedef struct {
  PyObject_HEAD
  X509_STORE *store;
} x509_store_object;

typedef struct {
  PyObject_HEAD
  X509_CRL *crl;
} x509_crl_object;

typedef struct {
  PyObject_HEAD
  X509_REVOKED *revoked;
} x509_revoked_object;

typedef struct {
  PyObject_HEAD
  void *cipher;
  int key_type;
  int cipher_type;
} asymmetric_object;

typedef struct {
  PyObject_HEAD
  EVP_CIPHER_CTX cipher_ctx;
  int cipher_type;
} symmetric_object;

typedef struct {
  PyObject_HEAD
  EVP_MD_CTX digest_ctx;
  int digest_type;
} digest_object;

typedef struct {
  PyObject_HEAD
  HMAC_CTX hmac_ctx;
} hmac_object;

typedef struct {
  PyObject_HEAD
  int ctxset;
  SSL *ssl;
  SSL_CTX *ctx;
  STACK_OF(X509) *trusted_certs;
  char *x509_cb_err;
} ssl_object;

typedef struct {
  PyObject_HEAD
  CMS_ContentInfo *cms;
} cms_object;

/*========== C structs ==========*/

/*========== helper functions ==========*/

/*
 * Minimal intervention debug-by-printf() hack, use only for good.
 */

#if 0
#define KVETCH(_msg_)   write(2, _msg_ "\n", sizeof(_msg_))
#else
#define KVETCH(_msg_)
#endif

/*
 * Error handling macros.  These macros make two assumptions:
 *
 * 1) All the macros assume that there's a cleanup label named
 *    "error" which these macros can use as a goto target.
 *
 * 2) assert_no_unhandled_openssl_errors() assumes that the return
 *    value is stored in a PyObject* variable named "result".
 *
 * These are icky assumptions, but they make it easier to provide
 * uniform error handling and make the code easier to read, not to
 * mention making it easier to track down obscure OpenSSL errors.
 */

#define lose(_msg_)                                                     \
  do {                                                                  \
    PyErr_SetString(ErrorObject, (_msg_));                              \
    goto error;                                                         \
  } while (0)

#define lose_type_error(_msg_)                                          \
  do {                                                                  \
    PyErr_SetString(PyExc_TypeError, (_msg_));                          \
    goto error;                                                         \
  } while (0)

#define lose_openssl_error(_msg_)                                       \
  do {                                                                  \
    set_openssl_exception(ErrorObject, (_msg_));                        \
    goto error;                                                         \
  } while (0)

#define lose_ssl_error(_self_, _code_)                                  \
  do {                                                                  \
    set_openssl_ssl_exception(_self_, _code_);                          \
    goto error;                                                         \
  } while (0)

#define assert_no_unhandled_openssl_errors()                            \
  do {                                                                  \
    if (ERR_peek_error()) {                                             \
      if (result) {                                                     \
        Py_XDECREF(result);                                             \
        result = NULL;                                                  \
      }                                                                 \
      lose_openssl_error(assert_helper(__LINE__));                      \
    }                                                                   \
  } while (0)

static char *
assert_helper(int line)
{
  static const char fmt[] = "Unhandled OpenSSL error at " __FILE__ ":%d!";
  static char msg[sizeof(fmt) + 10];

  snprintf(msg, sizeof(msg), fmt, line);
  return msg;
}

static int
docset_helper_add(PyObject *set, char *v)
{
  PyObject *value = NULL;

  if ((value = PyString_FromString(v)) == NULL)
    lose("could not allocate memory");

  if (PyList_Append(set, value) != 0)
    goto error;

  Py_XDECREF(value);
  return 1;

 error:

  Py_XDECREF(value);
  return 0;
}

/*
 * Generate an encrypion envelope.  Saves a lot of space having this case
 * statement in one place.
 */
static const EVP_CIPHER *
evp_cipher_factory(int cipher_type)
{
  switch(cipher_type) {
#ifndef OPENSSL_NO_DES
  case DES_ECB:           return EVP_des_ecb();
  case DES_EDE:           return EVP_des_ede();
  case DES_EDE3:          return EVP_des_ede3();
  case DES_CFB:           return EVP_des_cfb();
  case DES_EDE_CFB:       return EVP_des_ede_cfb();
  case DES_EDE3_CFB:      return EVP_des_ede3_cfb();
  case DES_OFB:           return EVP_des_ofb();
  case DES_EDE_OFB:       return EVP_des_ede_ofb();
  case DES_EDE3_OFB:      return EVP_des_ede3_ofb();
  case DES_CBC:           return EVP_des_cbc();
  case DES_EDE_CBC:       return EVP_des_ede_cbc();
  case DES_EDE3_CBC:      return EVP_des_ede3_cbc();
  case DESX_CBC:          return EVP_desx_cbc();
#endif
#ifndef OPENSSL_NO_RC4
  case RC4:               return EVP_rc4();
  case RC4_40:            return EVP_rc4_40();
#endif
#ifndef OPENSSL_NO_IDEA
  case IDEA_ECB:          return EVP_idea_ecb();
  case IDEA_CFB:          return EVP_idea_cfb();
  case IDEA_OFB:          return EVP_idea_ofb();
  case IDEA_CBC:          return EVP_idea_cbc();
#endif
#ifndef OPENSSL_NO_RC2
  case RC2_ECB:           return EVP_rc2_ecb();
  case RC2_CBC:           return EVP_rc2_cbc();
  case RC2_40_CBC:        return EVP_rc2_40_cbc();
  case RC2_CFB:           return EVP_rc2_cfb();
  case RC2_OFB:           return EVP_rc2_ofb();
#endif
#ifndef OPENSSL_NO_BF
  case BF_ECB:            return EVP_bf_ecb();
  case BF_CBC:            return EVP_bf_cbc();
  case BF_CFB:            return EVP_bf_cfb();
  case BF_OFB:            return EVP_bf_ofb();
#endif
#ifndef OPENSSL_NO_CAST5
  case CAST5_ECB:         return EVP_cast5_ecb();
  case CAST5_CBC:         return EVP_cast5_cbc();
  case CAST5_CFB:         return EVP_cast5_cfb();
  case CAST5_OFB:         return EVP_cast5_ofb();
#endif
#ifndef OPENSSL_NO_RC5
  case RC5_32_12_16_CBC:  return EVP_rc5_32_12_16_cbc();
  case RC5_32_12_16_CFB:  return EVP_rc5_32_12_16_cfb();
  case RC5_32_12_16_ECB:  return EVP_rc5_32_12_16_ecb();
  case RC5_32_12_16_OFB:  return EVP_rc5_32_12_16_ofb();
#endif
  default:                return NULL;
  }
}

/*
 * Raise an exception with data pulled from the OpenSSL error stack.
 * Exception value is a tuple with some internal structure.  If a
 * string error message is supplied, that string is the first element
 * of the exception value tuple.  Remainder of exception value tuple
 * is zero or more tuples, each representing one error from the stack.
 * Each error tuple contains six slots:
 * - the numeric error code
 * - string translation of numeric error code ("reason")
 * - name of library in which error occurred
 * - name of function in which error occurred
 * - name of file in which error occurred
 * - line number in file where error occurred
 */

static void
set_openssl_exception(PyObject *error_class, const char *msg)
{
  PyObject *errors;
  unsigned long err;
  const char *file;
  int line;

  errors = PyList_New(0);

  if (msg) {
    PyObject *s = Py_BuildValue("s", msg);
    (void) PyList_Append(errors, s);
    Py_XDECREF(s);
  }

  while ((err = ERR_get_error_line(&file, &line)) != 0) {
    PyObject *t = Py_BuildValue("(issssi)",
                                err,
                                ERR_reason_error_string(err),
                                ERR_lib_error_string(err),
                                ERR_func_error_string(err),
                                file,
                                line);
    (void) PyList_Append(errors, t);
    Py_XDECREF(t);
  }

  PyErr_SetObject(error_class, PyList_AsTuple(errors));
  Py_XDECREF(errors);
}

static void
set_openssl_ssl_exception(const ssl_object *self, const int ret)
{
  int err = SSL_get_error(self->ssl, ret);
  const char *s = NULL;

  switch(err) {

    /*
     * These three get their own exceptions.
     */

  case SSL_ERROR_ZERO_RETURN:
    PyErr_SetNone(ZeroReturnErrorObject);
    break;
  case SSL_ERROR_WANT_READ:
    PyErr_SetNone(WantReadErrorObject);
    break;
  case SSL_ERROR_WANT_WRITE:
    PyErr_SetNone(WantWriteErrorObject);
    break;

  case SSL_ERROR_SYSCALL:
    /*
     * Horrible jumbled mess of I/O related errors.  I'd ask what they
     * were thinking, except that it's pretty clear that they weren't.
     */
    if (ERR_peek_error())
      set_openssl_exception(SSLSyscallSSLErrorObject, NULL);
    else if (ret)
      PyErr_SetFromErrno(SSLSyscallErrorObject);
    else
      PyErr_SetNone(SSLUnexpectedEOFErrorObject);
    break;

  case SSL_ERROR_SSL:
    /*
     * Generic OpenSSL error during an SSL call.  I think.
     */
    set_openssl_exception(SSLErrorSSLErrorObject, self->x509_cb_err);
    break;

    /*
     * All other SSL errors are returned as a (number, string) tuple.
     */

  case SSL_ERROR_NONE:
    s = "SSL_ERROR_NONE";
    break;
  case SSL_ERROR_WANT_X509_LOOKUP:
    s = "SSL_ERROR_WANT_X509_LOOKUP";
    break;
  case SSL_ERROR_WANT_CONNECT:
    s = "SSL_ERROR_WANT_CONNECT";
    break;
  case SSL_ERROR_WANT_ACCEPT:
    s = "SSL_ERROR_WANT_ACCEPT";
    break;
  default:
    s = "UNKNOWN_SSL_ERROR";
  }

  if (s)
    PyErr_SetObject(SSLOtherErrorObject, Py_BuildValue("(is)", err, s));
}

static PyObject *
X509_object_helper_set_name(X509_NAME *name, PyObject *name_sequence)
{
  PyObject *pair = NULL; PyObject *type = NULL; PyObject *value = NULL;
  int no_pairs = 0, i = 0, str_type = 0, nid;
  unsigned char *valueptr = NULL;
  char *typeptr = NULL;

  no_pairs = PySequence_Size(name_sequence);
  for (i = 0; i < no_pairs; i++) {
    if ((pair = PySequence_GetItem(name_sequence, i)) == NULL)
      return NULL;

    if (!PyTuple_Check(pair) && !PyList_Check(pair))
      lose_type_error("inapropriate type");

    if (PySequence_Size(pair) != 2)
      lose("each name entry must have 2 elements");

    if ((type = PySequence_GetItem(pair, 0)) == NULL)
      lose_type_error("could not get type string");

    if (!PyString_Check(type))
      lose_type_error("inapropriate type");

    if ((value = PySequence_GetItem(pair, 1)) == NULL)
      lose_type_error("could not get value string");

    if (!PyString_Check(value))
      lose_type_error("inapropriate type");

    typeptr = PyString_AsString(type);
    valueptr = (unsigned char *) PyString_AsString(value);

    str_type = ASN1_PRINTABLE_type(valueptr, -1);
    if ((nid = OBJ_ln2nid(typeptr)) == 0 &&
        (nid = OBJ_sn2nid(typeptr)) == 0)
      lose("unknown ASN1 object");

    if (!X509_NAME_add_entry_by_NID(name, nid, str_type, valueptr,
                                    strlen((char *) valueptr), -1, 0))
      lose("unable to add name entry");

    Py_XDECREF(pair);
    Py_XDECREF(type);
    Py_XDECREF(value);
    pair = NULL;
    type = NULL;
    value = NULL;
  }
  return name_sequence;

 error:

  Py_XDECREF(pair);
  Py_XDECREF(type);
  Py_XDECREF(value);

  return NULL;
}

static PyObject *
X509_object_helper_get_name(X509_NAME *name, int format)
{
  int no_entries = 0, no_pairs = 0, i = 0, j = 0, value_len = 0, nid = 0;
  X509_NAME_ENTRY *entry = NULL;
  char *value = NULL, long_name[512];
  const char *short_name;

  PyObject *result_list = NULL;
  PyObject *pair = NULL;
  PyObject *py_type = NULL;
  PyObject *py_value = NULL;

  no_entries = X509_NAME_entry_count(name);

  if ((result_list = PyTuple_New(no_entries)) == NULL)
    lose("could not allocate memory");

  for(i = 0; i < no_entries; i++) {
    if ((entry = X509_NAME_get_entry(name, i)) == NULL)
      lose("could not get certificate name");

    if (entry->value->length + 1 > value_len) {
      if (value)
        free(value);

      if ((value = malloc(entry->value->length + 1)) == NULL)
        lose("could not allocate memory");

      value_len = entry->value->length + 1;
    }
    memcpy(value, entry->value->data, entry->value->length);
    value[entry->value->length] = 0;

    if (!i2t_ASN1_OBJECT(long_name, sizeof(long_name), entry->object))
      lose("could not find object name");

    switch (format) {
    case SHORTNAME_FORMAT:
      nid = OBJ_ln2nid(long_name);
      short_name = OBJ_nid2sn(nid);
      py_type = PyString_FromString(short_name);
      break;
    case LONGNAME_FORMAT:
      py_type = PyString_FromString(long_name);
      break;
    default:
      lose("unknown name format");
    }

    py_value = PyString_FromString(value);

    if ((pair = PyTuple_New(2)) == NULL)
      lose("could not allocate memory");

    PyTuple_SetItem(pair, 0, py_type);
    PyTuple_SetItem(pair, 1, py_value);
    PyTuple_SetItem(result_list, i, pair);
  }

  if (value)
    free(value);

  return result_list;

 error:

  if (value)
    free(value);

  if (result_list) {
    no_pairs = PyTuple_Size(result_list);
    for (i = 0; i < no_pairs; i++) {
      pair = PyTuple_GetItem(result_list, i);
      no_entries = PyTuple_Size(result_list);
      for (j = 0; j < no_entries; j++) {
        py_value = PyTuple_GetItem(pair, i);
        Py_XDECREF(py_value);
      }
    }
  }

  Py_XDECREF(py_type);
  Py_XDECREF(py_value);
  Py_XDECREF(result_list);
  return NULL;
}

static STACK_OF(X509) *
x509_helper_sequence_to_stack(PyObject *x509_sequence)
{
  x509_object *x509obj = NULL;
  STACK_OF(X509) *x509_stack = NULL;
  int size = 0, i = 0;

  if (x509_sequence != Py_None && !PyTuple_Check(x509_sequence) && !PyList_Check(x509_sequence))
    lose_type_error("Inapropriate type");

  if ((x509_stack = sk_X509_new_null()) == NULL)
    lose("Couldn't create new X509 stack");

  if (x509_sequence != Py_None) {
    size = PySequence_Size(x509_sequence);

    for (i = 0; i < size; i++) {
      if ((x509obj = (x509_object*) PySequence_GetItem(x509_sequence, i)) == NULL)
        goto error;

      if (!X_X509_Check(x509obj))
        lose_type_error("Inapropriate type");

      if (!sk_X509_push(x509_stack, x509obj->x509))
        lose("Couldn't add X509 object to stack");

      Py_XDECREF(x509obj);
      x509obj = NULL;
    }
  }

  return x509_stack;

 error:

  if (x509_stack)
    sk_X509_free(x509_stack);

  Py_XDECREF(x509obj);

  return NULL;
}

static PyObject *
stack_to_tuple_helper(_STACK *sk, PyObject *(*handler)(void *))
{
  PyObject *result_list = NULL, *result_tuple = NULL, *obj = NULL;

  if ((result_list = PyList_New(0)) == NULL)
    lose("could not allocate memory");

  while (sk_num(sk)) {

    if ((obj = handler(sk_value(sk, 0))) == NULL)
      lose("could not allocate memory");

    sk_shift(sk);

    if (PyList_Append(result_list, obj) != 0)
      goto error;

    Py_XDECREF(obj);
    obj = NULL;
  }

  result_tuple = PyList_AsTuple(result_list);
  Py_XDECREF(result_list);

  return result_tuple;

 error:

  Py_XDECREF(obj);
  Py_XDECREF(result_list);
  return NULL;
}

/*
 * Time conversion functions.  These follow RFC 5280, but use a single
 * text encoding that looks like GeneralizedTime as restricted by RFC
 * 5280; conversion to and from UTCTime is handled internally
 * according to the RFC 5280 rules.  The intent is to hide the
 * horrible short-sighted mess from Python code entirely.
 */

static PyObject *
ASN1_TIME_to_Python(ASN1_TIME *t)
{
  ASN1_GENERALIZEDTIME *g = ASN1_TIME_to_generalizedtime(t, NULL);
  PyObject *result = NULL;
  if (g) {
    result = Py_BuildValue("s", g->data);
    ASN1_GENERALIZEDTIME_free(g);
  }
  return result;
}

static int
python_ASN1_TIME_set_string(ASN1_TIME *t, const char *s)
{
  if (t == NULL || s == NULL || strlen(s) < 10)
    return 0;
  if ((s[0] == '1' && s[1] == '9' && s[2] > '4') ||
      (s[0] == '2' && s[1] == '0' && s[2] < '5'))
    return ASN1_UTCTIME_set_string(t, s + 2);
  else
    return ASN1_GENERALIZEDTIME_set_string(t, s);
}

/*========== helper funcitons ==========*/

/*========== X509 code ==========*/
static x509_object *
X509_object_new(void)
{
  x509_object *self;

  self = PyObject_New(x509_object, &x509type);
  if (self == NULL)
    goto error;

  self->x509 = X509_new();
  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

/*
 * This function is pretty dumb.  Most of the work is done by the module
 * function pow_module_pem_read().
 */
static x509_object *
X509_object_pem_read(BIO *in)
{
  x509_object *self;

  if ((self = PyObject_New(x509_object, &x509type)) == NULL)
    goto error;

  if ((self->x509 = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL)
    lose("could not load PEM encoded certificate");

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static x509_object *
X509_object_der_read(unsigned char *src, int len)
{
  x509_object *self;
  unsigned char *ptr = src;

  if ((self = PyObject_New(x509_object, &x509type)) == NULL)
    goto error;

  self->x509 = X509_new();

  if(!d2i_X509(&self->x509, (const unsigned char **) &ptr, len))
    lose("could not load PEM encoded certificate");

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

/*
 * Unlike the previous function this creates the BIO itself.  The BIO_s_mem
 * is used as a buffer which the certificate is read into, from this buffer
 * it is read into a char[] and returned as a string.
 */
static PyObject *
X509_object_write_helper(x509_object *self, PyObject *args, int format)
{
  int len = 0;
  char *buf = NULL;
  BIO *out_bio = NULL;
  PyObject *cert = NULL;

  if (!PyArg_ParseTuple(args, ""))
    return NULL;

  out_bio = BIO_new(BIO_s_mem());

  switch (format) {

  case DER_FORMAT:
    if (!i2d_X509_bio(out_bio, self->x509))
      lose("unable to write certificate");
    break;

  case PEM_FORMAT:
    if (!PEM_write_bio_X509(out_bio, self->x509))
      lose("unable to write certificate");
    break;

  default:
    lose("internal error, unknown output format");
  }

  if ((len = BIO_ctrl_pending(out_bio)) == 0)
    lose("unable to get bytes stored in bio");

  if ((buf = malloc(len)) == NULL)
    lose("unable to allocate memory");

  if (BIO_read(out_bio, buf, len) != len)
    lose("unable to write out cert");

  cert = Py_BuildValue("s#", buf, len);

  BIO_free(out_bio);
  free(buf);
  return cert;

 error:

  if (out_bio)
    BIO_free(out_bio);

  if (buf)
    free(buf);

  Py_XDECREF(cert);
  return NULL;
}

static char X509_object_pem_write__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>pemWrite</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a PEM encoded certificate as a\n"
"         string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_pem_write(x509_object *self, PyObject *args)
{
  return X509_object_write_helper(self, args, PEM_FORMAT);
}

static char X509_object_der_write__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>derWrite</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a DER encoded certificate as a\n"
"         string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_der_write(x509_object *self, PyObject *args)
{
  return X509_object_write_helper(self, args, DER_FORMAT);
}

/*
 * Currently this function only supports RSA keys.
 */
static char X509_object_set_public_key__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>setPublicKey</name>\n"
"      <parameter>key</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method sets the public key for this certificate object.  The\n"
"         parameter <parameter>key</parameter> should be an instance of\n"
"         <classname>Asymmetric</classname> containing a public key.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;


static PyObject *
X509_object_set_public_key(x509_object *self, PyObject *args)
{
  EVP_PKEY *pkey = NULL;
  asymmetric_object *asym;

  if (!PyArg_ParseTuple(args, "O!", &asymmetrictype, &asym))
    goto error;

  if ((pkey = EVP_PKEY_new()) == NULL)
    lose("could not allocate memory");

  if (!EVP_PKEY_assign_RSA(pkey, asym->cipher))
    lose("EVP_PKEY assignment error");

  if (!X509_set_pubkey(self->x509,pkey))
    lose("could not set certificate's public key");

  Py_RETURN_NONE;

 error:

  if (pkey)
    EVP_PKEY_free(pkey);

  return NULL;

}

static char X509_object_sign__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>sign</name>\n"
"      <parameter>key</parameter>\n"
"      <optional><parameter>digest = MD5_DIGEST</parameter></optional>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method signs a certificate with a private key.  See the\n"
"         example for the methods which should be invoked before signing a\n"
"         certificate.  <parameter>key</parameter> should be an instance of\n"
"         <classname>Asymmetric</classname> containing a private key.\n"
"         The optional parameter <parameter>digest</parameter> indicates\n"
"         which digest function should be used to compute the hash to be\n"
"         signed, it should be one of the following:\n"
"      </para>\n"
"      <simplelist>\n"
#ifndef OPENSSL_NO_MD2
"         <member><constant>MD2_DIGEST</constant></member>\n"
#endif
"         <member><constant>MD5_DIGEST</constant></member>\n"
"         <member><constant>SHA_DIGEST</constant></member>\n"
"         <member><constant>SHA1_DIGEST</constant></member>\n"
"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
"         <member><constant>SHA256_DIGEST</constant></member>\n"
"         <member><constant>SHA384_DIGEST</constant></member>\n"
"         <member><constant>SHA512_DIGEST</constant></member>\n"
"     </simplelist>\n"
"   </body>\n"
"</method>\n"
;


static PyObject *
X509_object_sign(x509_object *self, PyObject *args)
{
  EVP_PKEY *pkey = NULL;
  asymmetric_object *asym;
  int digest = MD5_DIGEST;

  if (!PyArg_ParseTuple(args, "O!|i", &asymmetrictype, &asym, &digest))
    goto error;

  if ((pkey = EVP_PKEY_new()) == NULL)
    lose("could not allocate memory");

  if (asym->key_type != RSA_PRIVATE_KEY)
    lose("cannot use this type of key");

  if (!EVP_PKEY_assign_RSA(pkey, asym->cipher))
    lose("EVP_PKEY assignment error");

  switch (digest) {
  case MD5_DIGEST:
    if (!X509_sign(self->x509, pkey, EVP_md5()))
      lose("could not sign certificate");
    break;

#ifndef OPENSSL_NO_MD2
  case MD2_DIGEST:
    if (!X509_sign(self->x509, pkey, EVP_md2()))
      lose("could not sign certificate");
    break;
#endif

  case SHA_DIGEST:
    if (!X509_sign(self->x509, pkey, EVP_sha()))
      lose("could not sign certificate");
    break;

  case SHA1_DIGEST:
    if (!X509_sign(self->x509, pkey, EVP_sha1()))
      lose("could not sign certificate");
    break;

  case RIPEMD160_DIGEST:
    if (!X509_sign(self->x509, pkey, EVP_ripemd160()))
      lose("could not sign certificate");
    break;

  case SHA256_DIGEST:
    if (!X509_sign(self->x509, pkey, EVP_sha256()))
      lose("could not sign certificate");
    break;

  case SHA384_DIGEST:
    if (!X509_sign(self->x509, pkey, EVP_sha384()))
      lose("could not sign certificate");
    break;

  case SHA512_DIGEST:
    if (!X509_sign(self->x509, pkey, EVP_sha512()))
      lose("could not sign certificate");
    break;
  }

  Py_RETURN_NONE;

 error:

  if (pkey)
    EVP_PKEY_free(pkey);

  return NULL;

}

static char X509_object_get_version__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>getVersion</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the version number from the version field of\n"
"         this certificate.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;


static PyObject *
X509_object_get_version(x509_object *self, PyObject *args)
{
  long version = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  version = X509_get_version(self->x509);

  return Py_BuildValue("l", version);

 error:

  return NULL;
}

static char X509_object_set_version__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>setVersion</name>\n"
"      <parameter>version</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method sets the version number in the version field of\n"
"         this certificate.  <parameter>version</parameter> should be an\n"
"         integer.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_set_version(x509_object *self, PyObject *args)
{
  long version = 0;

  if (!PyArg_ParseTuple(args, "l", &version))
    goto error;

  if (!X509_set_version(self->x509, version))
    lose("could not set certificate version");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char X509_object_get_serial__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>getSerial</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method get the serial number in the serial field of\n"
"         this certificate.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_get_serial(x509_object *self, PyObject *args)
{
  long serial = 0;
  ASN1_INTEGER *asn1i = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((asn1i = X509_get_serialNumber(self->x509)) == NULL)
    lose("could not get serial number");

  if ((serial = ASN1_INTEGER_get(asn1i)) == -1)
    lose("could not convert ASN1 Integer to long");

  return Py_BuildValue("l", serial);

 error:

  return NULL;
}

static char X509_object_set_serial__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>setSerial</name>\n"
"      <parameter>serial</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method sets the serial number in the serial field of\n"
"         this certificate.  <parameter>serial</parameter> should ba an\n"
"         integer.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_set_serial(x509_object *self, PyObject *args)
{
  long serial = 0;
  ASN1_INTEGER *asn1i = NULL;

  if (!PyArg_ParseTuple(args, "l", &serial))
    goto error;

  if ((asn1i = ASN1_INTEGER_new()) == NULL)
    lose("could not allocate memory");

  if (!ASN1_INTEGER_set(asn1i, serial))
    lose("could not set ASN1 integer");

  if (!X509_set_serialNumber(self->x509, asn1i))
    lose("could not set certificate serial");

  ASN1_INTEGER_free(asn1i);

  Py_RETURN_NONE;

 error:

  if (asn1i)
    ASN1_INTEGER_free(asn1i);

  return NULL;
}

static char X509_object_get_issuer__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>getIssuer</name>\n"
"      <parameter>format = SHORTNAME_FORMAT</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a tuple containing the issuers name.  Each\n"
"         element of the tuple is a tuple with 2 elements.  The first tuple\n"
"         is an object name and the second is it's value.  Both issuer and\n"
"         subject are names distinguished normally composed of a small\n"
"         number of objects:\n"
"      </para>\n"
"      <simplelist>\n"
"         <member><constant>c</constant> or <constant>countryName</constant></member>\n"
"         <member><constant>st</constant> or <constant>stateOrProvinceName</constant></member>\n"
"         <member><constant>o</constant> or <constant>organizationName</constant></member>\n"
"         <member><constant>l</constant> or <constant>localityName</constant></member>\n"
"         <member><constant>ou</constant> or <constant>organizationalUnitName</constant></member>\n"
"         <member><constant>cn</constant> or <constant>commonName</constant></member>\n"
"      </simplelist>\n"
"      <para>\n"
"         The data type varies from one object to another, however, all the\n"
"         common objects are strings.  It would be possible to specify any\n"
"         kind of object but that would certainly adversely effect\n"
"         portability and is not recommended.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_get_issuer(x509_object *self, PyObject *args)
{
  PyObject *result_list = NULL;
  X509_NAME *name = NULL;
  int format = SHORTNAME_FORMAT;

  if (!PyArg_ParseTuple(args, "|i", &format))
    goto error;

  if ((name = X509_get_issuer_name(self->x509)) == NULL)
    lose("could not get issuers name");

  if ((result_list = X509_object_helper_get_name(name, format)) == NULL)
    lose("failed to produce name list");

  return result_list;

 error:

  return NULL;
}

static char X509_object_get_subject__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>getSubject</name>\n"
"      <parameter>format = SHORTNAME_FORMAT</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a tuple containing the subjects name.  See\n"
"         <function>getIssuer</function> for a description of the returned\n"
"         object's format.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_get_subject(x509_object *self, PyObject *args)
{
  PyObject *result_list = NULL;
  X509_NAME *name = NULL;
  int format = SHORTNAME_FORMAT;

  if (!PyArg_ParseTuple(args, "|i", &format))
    goto error;

  if ((name = X509_get_subject_name(self->x509)) == NULL)
    lose("could not get issuers name");

  if ((result_list = X509_object_helper_get_name(name, format)) == NULL)
    lose("failed to produce name list");

  return result_list;

 error:

  return NULL;
}

static char X509_object_set_subject__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>setSubject</name>\n"
"      <parameter>name</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to set the subjects name.\n"
"         <parameter>name</parameter> can be comprised of lists or tuples in\n"
"         the format described in the <function>getIssuer</function> method.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_set_subject(x509_object *self, PyObject *args)
{
  PyObject *name_sequence = NULL;
  X509_NAME *name = NULL;

  if (!PyArg_ParseTuple(args, "O", &name_sequence))
    goto error;

  if (!PyTuple_Check(name_sequence) && !PyList_Check(name_sequence))
    lose_type_error("Inapropriate type");

  if ((name = X509_NAME_new()) == NULL)
    lose("could not allocate memory");

  if (!X509_object_helper_set_name(name, name_sequence))
    lose("unable to set new name");

  if (!X509_set_subject_name(self->x509, name))
    lose("unable to set name");

  X509_NAME_free(name);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char X509_object_set_issuer__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>setIssuer</name>\n"
"      <parameter>name</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to set the issuers name.\n"
"         <parameter>name</parameter> can be comprised of lists or tuples in\n"
"         the format described in the <function>getissuer</function> method.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_set_issuer(x509_object *self, PyObject *args)
{
  PyObject *name_sequence = NULL;
  X509_NAME *name = NULL;

  if (!PyArg_ParseTuple(args, "O", &name_sequence))
    goto error;

  if (!PyTuple_Check(name_sequence) && !PyList_Check(name_sequence))
    lose_type_error("Inapropriate type");

  if ((name = X509_NAME_new()) == NULL)
    lose("could not allocate memory");

  if (!X509_object_helper_set_name(name, name_sequence))
    lose("unable to set new name");

  if (!X509_set_issuer_name(self->x509,name))
    lose("unable to set name");

  X509_NAME_free(name);

  Py_RETURN_NONE;

 error:

  if (name)
    X509_NAME_free(name);

  return  NULL;
}

static char X509_object_get_not_before__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>getNotBefore</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this function returns a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"

;

static PyObject *
X509_object_get_not_before (x509_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  return ASN1_TIME_to_Python(self->x509->cert_info->validity->notBefore);

 error:

  return NULL;
}

static char X509_object_get_not_after__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>getNotAfter</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this function returns a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_get_not_after (x509_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  return ASN1_TIME_to_Python(self->x509->cert_info->validity->notAfter);

 error:

  return NULL;
}

static char X509_object_set_not_after__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>setNotAfter</name>\n"
"      <parameter>time</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this accepts one parameter, a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_set_not_after (x509_object *self, PyObject *args)
{
  char *new_time = NULL;

  if (!PyArg_ParseTuple(args, "s", &new_time))
    goto error;

  if (!python_ASN1_TIME_set_string(self->x509->cert_info->validity->notAfter, new_time))
    lose("Could not set notAfter");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char X509_object_set_not_before__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>setNotBefore</name>\n"
"      <parameter>time</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this accepts one parameter, a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_set_not_before (x509_object *self, PyObject *args)
{
  char *new_time = NULL;

  if (!PyArg_ParseTuple(args, "s", &new_time))
    goto error;

  if (!python_ASN1_TIME_set_string(self->x509->cert_info->validity->notBefore, new_time))
    lose("Could not set notBefore");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char X509_object_add_extension__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>addExtension</name>\n"
"      <parameter>extensionName</parameter>\n"
"      <parameter>critical</parameter>\n"
"      <parameter>extensionValue</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method adds an extension to this certificate.\n"
"         <parameter>extensionName</parameter> should be the of the\n"
"         extension.  <parameter>critical</parameter> should an integer, 1\n"
"         for true and 0 for false.  <parameter>extensionValue</parameter>\n"
"         should be a string, DER encoded value of the extension.  The name\n"
"         of the extension must be correct according to OpenSSL and can be\n"
"         checked in the <constant>objects.h</constant> header file, part of\n"
"         the OpenSSL source distribution.  In the majority of cases they\n"
"         are the same as those defined in <constant>POW._oids</constant>\n"
"         but if you do encounter problems is may be worth checking.\n"
"      </para>\n"
"      <example>\n"
"         <title><function>addExtension</function> method usage</title>\n"
"         <programlisting>\n"
"      basic = POW.pkix.BasicConstraints()\n"
"      basic.set([1,5])\n"
"      serverCert.addExtension('basicConstraints', 0, basic.toString())\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_add_extension(x509_object *self, PyObject *args)
{
  int critical = 0, nid = 0, len = 0;
  char *name = NULL;
  unsigned char *buf = NULL;
  ASN1_OCTET_STRING *octetString = NULL;
  X509_EXTENSION *extn = NULL;

  if (!PyArg_ParseTuple(args, "sis#", &name, &critical, &buf, &len))
    goto error;

  if ((octetString = M_ASN1_OCTET_STRING_new()) == NULL)
    lose("could not allocate memory");

  if (!ASN1_OCTET_STRING_set(octetString, buf, len))
    lose("could not set ASN1 Octect string");

  if ((nid = OBJ_txt2nid(name)) == NID_undef)
    lose("extension has unknown object identifier");

  if ((extn = X509_EXTENSION_create_by_NID(NULL, nid, critical, octetString)) == NULL)
    lose("unable to create ASN1 X509 Extension object");

  if (!self->x509->cert_info->extensions &&
      (self->x509->cert_info->extensions = sk_X509_EXTENSION_new_null()) == NULL)
    lose("unable to allocate memory");

  if (!sk_X509_EXTENSION_push(self->x509->cert_info->extensions, extn))
    lose("unable to add extension");

  Py_RETURN_NONE;

 error:

  if (extn)
    X509_EXTENSION_free(extn);

  return NULL;
}

static char X509_object_clear_extensions__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>clearExtensions</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method clears the structure which holds the extension for\n"
"         this certificate.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_clear_extensions(x509_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (self->x509->cert_info->extensions) {
    sk_X509_EXTENSION_free(self->x509->cert_info->extensions);
    self->x509->cert_info->extensions = NULL;
  }

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char X509_object_count_extensions__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>countExtensions</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the size of the structure which holds the\n"
"         extension for this certificate.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_count_extensions(x509_object *self, PyObject *args)
{
  int num = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (self->x509->cert_info->extensions)
    num = sk_X509_EXTENSION_num(self->x509->cert_info->extensions);

  return Py_BuildValue("i", num);

 error:

  return NULL;
}

static char X509_object_get_extension__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>getExtension</name>\n"
"      <parameter>index</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a tuple equivalent the parameters of\n"
"         <function>addExtension</function>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_object_get_extension(x509_object *self, PyObject *args)
{
  int num = 0, index = 0, ext_nid = 0;
  char const *ext_ln = NULL;
  char unknown_ext [] = "unknown";
  X509_EXTENSION *ext;

  if (!PyArg_ParseTuple(args, "i", &index))
    goto error;

  if (self->x509->cert_info->extensions)
    num = sk_X509_EXTENSION_num(self->x509->cert_info->extensions);

  if (index >= num)
    lose("certificate does not have that many extensions");

  if ((ext = sk_X509_EXTENSION_value(self->x509->cert_info->extensions, index)) == NULL)
    lose("could not get extension");

  if ((ext_nid = OBJ_obj2nid(ext->object)) == NID_undef)
    lose("extension has unknown object identifier");

  if ((ext_ln = OBJ_nid2sn(ext_nid)) == NULL)
    ext_ln = unknown_ext;

  return Py_BuildValue("sis#", ext_ln, ext->critical, ext->value->data, ext->value->length);

 error:

  return NULL;
}

static char x509_object_pprint__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"      <name>pprint</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a formatted string showing the information\n"
"         held in the certificate.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_object_pprint(x509_object *self, PyObject *args)
{
  int len = 0, ret = 0;
  char *buf = NULL;
  BIO *out_bio = NULL;
  PyObject *cert = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  out_bio = BIO_new(BIO_s_mem());

  if (!X509_print(out_bio, self->x509))
    lose("unable to write crl");

  if ((len = BIO_ctrl_pending(out_bio)) == 0)
    lose("unable to get bytes stored in bio");

  if ((buf = malloc(len)) == NULL)
    lose("unable to allocate memory");

  if ((ret = BIO_read(out_bio, buf, len)) != len)
    lose("unable to write out cert");

  cert = Py_BuildValue("s#", buf, len);

  BIO_free(out_bio);
  free(buf);
  return cert;

 error:

  if (out_bio)
    BIO_free(out_bio);

  if (buf)
    free(buf);

  return NULL;

}

static struct PyMethodDef X509_object_methods[] = {
  {"pemWrite",          (PyCFunction)X509_object_pem_write,        METH_VARARGS,  NULL},
  {"derWrite",          (PyCFunction)X509_object_der_write,        METH_VARARGS,  NULL},
  {"sign",              (PyCFunction)X509_object_sign,             METH_VARARGS,  NULL},
  {"setPublicKey",      (PyCFunction)X509_object_set_public_key,   METH_VARARGS,  NULL},
  {"getVersion",        (PyCFunction)X509_object_get_version,      METH_VARARGS,  NULL},
  {"setVersion",        (PyCFunction)X509_object_set_version,      METH_VARARGS,  NULL},
  {"getSerial",         (PyCFunction)X509_object_get_serial,       METH_VARARGS,  NULL},
  {"setSerial",         (PyCFunction)X509_object_set_serial,       METH_VARARGS,  NULL},
  {"getIssuer",         (PyCFunction)X509_object_get_issuer,       METH_VARARGS,  NULL},
  {"setIssuer",         (PyCFunction)X509_object_set_issuer,       METH_VARARGS,  NULL},
  {"getSubject",        (PyCFunction)X509_object_get_subject,      METH_VARARGS,  NULL},
  {"setSubject",        (PyCFunction)X509_object_set_subject,      METH_VARARGS,  NULL},
  {"getNotBefore",      (PyCFunction)X509_object_get_not_before,   METH_VARARGS,  NULL},
  {"getNotAfter",       (PyCFunction)X509_object_get_not_after,    METH_VARARGS,  NULL},
  {"setNotAfter",       (PyCFunction)X509_object_set_not_after,    METH_VARARGS,  NULL},
  {"setNotBefore",      (PyCFunction)X509_object_set_not_before,   METH_VARARGS,  NULL},
  {"addExtension",      (PyCFunction)X509_object_add_extension,    METH_VARARGS,  NULL},
  {"clearExtensions",   (PyCFunction)X509_object_clear_extensions, METH_VARARGS,  NULL},
  {"countExtensions",   (PyCFunction)X509_object_count_extensions, METH_VARARGS,  NULL},
  {"getExtension",      (PyCFunction)X509_object_get_extension,    METH_VARARGS,  NULL},
  {"pprint",            (PyCFunction)x509_object_pprint,           METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static PyObject *
X509_object_getattr(x509_object *self, char *name)
{
  return Py_FindMethod(X509_object_methods, (PyObject *)self, name);
}

static void
X509_object_dealloc(x509_object *self, char *name)
{
  X509_free(self->x509);
  PyObject_Del(self);
}

static char x509type__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>X509</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides access to a significant proportion of X509\n"
"         functionality of OpenSSL.\n"
"      </para>\n"
"\n"
"      <example>\n"
"         <title><classname>x509</classname> class usage</title>\n"
"         <programlisting>\n"
"      privateFile = open('test/private.key', 'r')\n"
"      publicFile = open('test/public.key', 'r')\n"
"      certFile = open('test/cacert.pem', 'w')\n"
"\n"
"      publicKey = POW.pemRead(POW.RSA_PUBLIC_KEY, publicFile.read())\n"
"      privateKey = POW.pemRead(POW.RSA_PRIVATE_KEY, privateFile.read(), 'pass')\n"
"\n"
"      c = POW.X509()\n"
"\n"
"      name = [  ['C', 'GB'], ['ST', 'Hertfordshire'],\n"
"                ['O','The House'], ['CN', 'Peter Shannon'] ]\n"
"\n"
"      c.setIssuer(name)\n"
"      c.setSubject(name)\n"
"      c.setSerial(0)\n"
"      t1 = POW.pkix.time2utc(time.time())\n"
"      t2 = POW.pkix.time2utc(time.time() + 60*60*24*365)\n"
"      c.setNotBefore(t1)\n"
"      c.setNotAfter(t2)\n"
"      c.setPublicKey(publicKey)\n"
"      c.sign(privateKey)\n"
"\n"
"      certFile.write(c.pemWrite())\n"
"\n"
"      privateFile.close()\n"
"      publicFile.close()\n"
"      certFile.close()\n"
"         </programlisting>\n"
"      </example>\n"
"\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject x509type = {
   PyObject_HEAD_INIT(0)
   0,                                  /*ob_size*/
   "X509",                             /*tp_name*/
   sizeof(x509_object),                /*tp_basicsize*/
   0,                                  /*tp_itemsize*/
   (destructor)X509_object_dealloc,    /*tp_dealloc*/
   (printfunc)0,                       /*tp_print*/
   (getattrfunc)X509_object_getattr,   /*tp_getattr*/
   (setattrfunc)0,                     /*tp_setattr*/
   (cmpfunc)0,                         /*tp_compare*/
   (reprfunc)0,                        /*tp_repr*/
   0,                                  /*tp_as_number*/
   0,                                  /*tp_as_sequence*/
   0,                                  /*tp_as_mapping*/
   (hashfunc)0,                        /*tp_hash*/
   (ternaryfunc)0,                     /*tp_call*/
   (reprfunc)0,                        /*tp_str*/
   0,
   0,
   0,
   0,
   x509type__doc__                     /* Documentation string */
};
/*========== X509 Code ==========*/

/*========== x509 store Code ==========*/
static x509_store_object *
x509_store_object_new(void)
{
  x509_store_object *self = NULL;

  if ((self = PyObject_New(x509_store_object, &x509_storetype)) == NULL)
    goto error;

  self->store = X509_STORE_new();

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static char x509_store_object_verify__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Store</memberof>\n"
"      <name>verify</name>\n"
"      <parameter>certificate</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         The <classname>X509Store</classname> method\n"
"         <function>verify</function> is based on the\n"
"         <function>X509_verify_cert</function>.  It handles certain aspects\n"
"         of verification but not others.  The certificate will be verified\n"
"         against <constant>notBefore</constant>,\n"
"         <constant>notAfter</constant> and trusted certificates.\n"
"         It crucially will not handle checking the certificate against\n"
"         CRLs.  This functionality will probably make it into OpenSSL\n"
"         0.9.7.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_store_object_verify(x509_store_object *self, PyObject *args)
{
  X509_STORE_CTX csc;
  x509_object *x509 = NULL;
  int ok;

  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
    goto error;

  X509_STORE_CTX_init(&csc, self->store, x509->x509, NULL);
  ok = X509_verify_cert(&csc) == 1;
  X509_STORE_CTX_cleanup(&csc);

  return PyBool_FromLong(ok);

 error:

  return NULL;
}

static char x509_store_object_verify_chain__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Store</memberof>\n"
"      <name>verifyChain</name>\n"
"      <parameter>certificate</parameter>\n"
"      <parameter>chain</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         The <classname>X509Store</classname> method <function>verifyChain</function>\n"
"         is based on the <function>X509_verify_cert</function> but is initialised\n"
"         with a <classname>X509</classname> object to verify and list of\n"
"         <classname>X509</classname> objects which form a chain to a trusted\n"
"         certificate.  Certain aspects of the verification are handled but not others.\n"
"         The certificates will be verified against <constant>notBefore</constant>,\n"
"         <constant>notAfter</constant> and trusted certificates.  It crucially will\n"
"         not handle checking the certificate against CRLs.  This functionality will\n"
"         probably make it into OpenSSL 0.9.7.\n"
"      </para>\n"
"      <para>\n"
"         This may all sound quite straight forward but determining the\n"
"         certificate associated with the signature on another certificate\n"
"         can be very time consuming.  The management aspects of\n"
"         certificates are addressed by various V3 extensions which are not\n"
"         currently supported.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_store_object_verify_chain(x509_store_object *self, PyObject *args)
{
  PyObject *x509_sequence = NULL;
  X509_STORE_CTX csc;
  x509_object *x509 = NULL;
  STACK_OF(X509) *x509_stack = NULL;
  int ok;

  if (!PyArg_ParseTuple(args, "O!O", &x509type, &x509, &x509_sequence))
    goto error;

  if ((x509_stack = x509_helper_sequence_to_stack(x509_sequence)) == NULL)
    goto error;

  X509_STORE_CTX_init(&csc, self->store, x509->x509, x509_stack);

  ok = X509_verify_cert(&csc) == 1;

  X509_STORE_CTX_cleanup(&csc);
  sk_X509_free(x509_stack);

  return PyBool_FromLong(ok);

 error:

  if (x509_stack)
    sk_X509_free(x509_stack);

  return NULL;
}

static char x509_store_object_verify_detailed__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Store</memberof>\n"
"      <name>verifyDetailed</name>\n"
"      <parameter>certificate</parameter>\n"
"      <optional>\n"
"        <parameter>chain</parameter>\n"
"      </optional>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         The <classname>X509Store</classname> method <function>verifyDetailed</function>\n"
"         is based on the <function>X509_verify_cert</function> but is initialised\n"
"         with a <classname>X509</classname> object to verify and list of\n"
"         <classname>X509</classname> objects which form a chain to a trusted\n"
"         certificate.  Certain aspects of the verification are handled but not others.\n"
"         The certificates will be verified against <constant>notBefore</constant>,\n"
"         <constant>notAfter</constant> and trusted certificates.  It crucially will\n"
"         not handle checking the certificate against CRLs.  This functionality will\n"
"         probably make it into OpenSSL 0.9.7.\n"
"      </para>\n"
"      <para>\n"
"         This may all sound quite straight forward but determining the\n"
"         certificate associated with the signature on another certificate\n"
"         can be very time consuming.  The management aspects of\n"
"         certificates are addressed by various V3 extensions which are not\n"
"         currently supported.\n"
"      </para>\n"
"      <para>\n"
"         Unlike the <function>verify</function> and <function>verifyChain</function>\n"
"         methods, <function>verifyDetailed</function> returns some information about\n"
"         what went wrong when verification fails.  The return value is currently a 3-tuple:\n"
"         the first value is the return value from X509_verify_cert(), the second and third\n"
"         are the error and error_depth values from the X509_STORE_CTX.\n"
"         Other values may added to this tuple later.\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_store_object_verify_detailed(x509_store_object *self, PyObject *args)
{
  PyObject *x509_sequence = Py_None;
  X509_STORE_CTX csc;
  x509_object *x509 = NULL;
  STACK_OF(X509) *x509_stack = NULL;
  PyObject *result = NULL;
  int ok;

  if (!PyArg_ParseTuple(args, "O!|O", &x509type, &x509, &x509_sequence))
    goto error;

  if (x509_sequence && !(x509_stack = x509_helper_sequence_to_stack(x509_sequence)))
    goto error;

  X509_STORE_CTX_init(&csc, self->store, x509->x509, x509_stack);

  ok = X509_verify_cert(&csc) == 1;

  result = Py_BuildValue("(iii)", ok, csc.error, csc.error_depth);

  X509_STORE_CTX_cleanup(&csc);

 error:                          /* fall through */

  if (x509_stack)
    sk_X509_free(x509_stack);

  return result;
}

static char x509_store_object_add_trust__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Store</memberof>\n"
"      <name>addTrust</name>\n"
"      <parameter>cert</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method adds a new certificate to the store to be used in the\n"
"         verification process.  <parameter>cert</parameter> should be an\n"
"         instance of <classname>X509</classname>.  Using trusted certificates to manage\n"
"         verification is relatively primitive, more sophisticated systems\n"
"         can be constructed at an application level by by constructing\n"
"         certificate chains to verify.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_store_object_add_trust(x509_store_object *self, PyObject *args)
{
  x509_object *x509 = NULL;

  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
    goto error;

  X509_STORE_add_cert(self->store, x509->x509);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char x509_store_object_add_crl__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Store</memberof>\n"
"      <name>addCrl</name>\n"
"      <parameter>crl</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method adds a CRL to a store to be used for verification.\n"
"         <parameter>crl</parameter> should be an instance of\n"
"         <classname>X509Crl</classname>.\n"
"         Unfortunately, the current stable release of OpenSSL does not\n"
"         support CRL checking for certificate verification.\n"
"         This functionality will probably make it into OpenSSL 0.9.7, until\n"
"         it does this function is useless and CRL verification must be\n"
"         implemented by the application.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_store_object_add_crl(x509_store_object *self, PyObject *args)
{
  x509_crl_object *crl = NULL;

  if (!PyArg_ParseTuple(args, "O!", &x509_crltype, &crl))
    goto error;

  X509_STORE_add_crl(self->store, crl->crl);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static struct PyMethodDef x509_store_object_methods[] = {
  {"verify",         (PyCFunction)x509_store_object_verify,          METH_VARARGS,  NULL},
  {"verifyChain",    (PyCFunction)x509_store_object_verify_chain,    METH_VARARGS,  NULL},
  {"verifyDetailed", (PyCFunction)x509_store_object_verify_detailed, METH_VARARGS,  NULL},
  {"addTrust",       (PyCFunction)x509_store_object_add_trust,       METH_VARARGS,  NULL},
  {"addCrl",         (PyCFunction)x509_store_object_add_crl,         METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static PyObject *
x509_store_object_getattr(x509_store_object *self, char *name)
{
  return Py_FindMethod(x509_store_object_methods, (PyObject *)self, name);
}

static void
x509_store_object_dealloc(x509_store_object *self, char *name)
{
  X509_STORE_free(self->store);
  PyObject_Del(self);
}

static char x509_storetype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>X509Store</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides preliminary access to OpenSSL X509 verification\n"
"         facilities.\n"
"      </para>\n"
"\n"
"      <example>\n"
"         <title><classname>x509_store</classname> class usage</title>\n"
"         <programlisting>\n"
"      store = POW.X509Store()\n"
"\n"
"      caFile = open('test/cacert.pem', 'r')\n"
"      ca = POW.pemRead(POW.X509_CERTIFICATE, caFile.read())\n"
"      caFile.close()\n"
"\n"
"      store.addTrust(ca)\n"
"\n"
"      certFile = open('test/foocom.cert', 'r')\n"
"      x509 = POW.pemRead(POW.X509_CERTIFICATE, certFile.read())\n"
"      certFile.close()\n"
"\n"
"      print x509.pprint()\n"
"\n"
"      if store.verify(x509):\n"
"         print 'Verified certificate!.'\n"
"      else:\n"
"         print 'Failed to verify certificate!.'\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject x509_storetype = {
   PyObject_HEAD_INIT(0)
   0,                                        /*ob_size*/
   "X509Store",                              /*tp_name*/
   sizeof(x509_store_object),                /*tp_basicsize*/
   0,                                        /*tp_itemsize*/
   (destructor)x509_store_object_dealloc,    /*tp_dealloc*/
   (printfunc)0,                             /*tp_print*/
   (getattrfunc)x509_store_object_getattr,   /*tp_getattr*/
   (setattrfunc)0,                           /*tp_setattr*/
   (cmpfunc)0,                               /*tp_compare*/
   (reprfunc)0,                              /*tp_repr*/
   0,                                        /*tp_as_number*/
   0,                                        /*tp_as_sequence*/
   0,                                        /*tp_as_mapping*/
   (hashfunc)0,                              /*tp_hash*/
   (ternaryfunc)0,                           /*tp_call*/
   (reprfunc)0,                              /*tp_str*/
   0,
   0,
   0,
   0,
   x509_storetype__doc__                    /* Documentation string */
};
/*========== x509 store Code ==========*/

/*========== x509 crl Code ==========*/
static x509_crl_object *
x509_crl_object_new(void)
{
  x509_crl_object *self = NULL;

  self = PyObject_New(x509_crl_object, &x509_crltype);
  if (self == NULL)
    goto error;

  self->crl = X509_CRL_new();

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static x509_crl_object *
x509_crl_object_pem_read(BIO *in)
{
  x509_crl_object *self;

  if ((self = PyObject_New(x509_crl_object, &x509_crltype)) == NULL)
    goto error;

  if ((self->crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL)) == NULL)
    lose("could not load certificate");

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static x509_crl_object *
x509_crl_object_der_read(unsigned char *src, int len)
{
  x509_crl_object *self;
  unsigned char* ptr = src;

  if ((self = PyObject_New(x509_crl_object, &x509_crltype)) == NULL)
    goto error;

  self->crl = X509_CRL_new();

  if (!d2i_X509_CRL(&self->crl, (const unsigned char **) &ptr, len))
    lose("could not load PEM encoded CRL");

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static char x509_crl_object_get_version__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>getVersion</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the version number from the version field of\n"
"         this CRL.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_get_version(x509_crl_object *self, PyObject *args)
{
  long version = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((version = ASN1_INTEGER_get(self->crl->crl->version)) == -1)
    lose("could not get crl version");

  return Py_BuildValue("l", version);

 error:

  return NULL;
}

static char x509_crl_object_set_version__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>setVersion</name>\n"
"      <parameter>version</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method sets the version number in the version field of\n"
"         this CRL.  <parameter>version</parameter> should be an\n"
"         integer.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_set_version(x509_crl_object *self, PyObject *args)
{
  long version = 0;
  ASN1_INTEGER *asn1_version = NULL;

  if (!PyArg_ParseTuple(args, "i", &version))
    goto error;

  if ((asn1_version = ASN1_INTEGER_new()) == NULL)
    lose("could not allocate memory");

  if (!ASN1_INTEGER_set(asn1_version, version))
    lose("could not get set version");

  self->crl->crl->version = asn1_version;

  Py_RETURN_NONE;

 error:

  if (asn1_version)
    ASN1_INTEGER_free(asn1_version);

  return NULL;
}

static char x509_crl_object_get_issuer__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>getIssuer</name>\n"
"      <parameter>format = SHORTNAME_FORMAT</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a tuple containing the issuers name.  See the\n"
"         <function>getIssuer</function> method of\n"
"         <classname>X509</classname> for more details.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_get_issuer(x509_crl_object *self, PyObject *args)
{
  PyObject *result_list = NULL;
  int format = SHORTNAME_FORMAT;

  if (!PyArg_ParseTuple(args, "|i", &format))
    goto error;

  if ((result_list = X509_object_helper_get_name(self->crl->crl->issuer, format)) == NULL)
    lose("failed to produce name list");

  return result_list;

 error:

  return NULL;
}

static char x509_crl_object_set_issuer__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>setIssuer</name>\n"
"      <parameter>name</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to set the issuers name.\n"
"         <parameter>name</parameter> can be comprised of lists or tuples in\n"
"         the format described in the <function>getIssuer</function> method\n"
"         of <classname>X509</classname>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_set_issuer(x509_crl_object *self, PyObject *args)
{
  PyObject *name_sequence = NULL;
  X509_NAME *name = NULL;

  if (!PyArg_ParseTuple(args, "O", &name_sequence))
    goto error;

  if (!PyTuple_Check(name_sequence) && !PyList_Check(name_sequence))
    lose_type_error("Inapropriate type");

  if ((name = X509_NAME_new()) == NULL)
    lose("could not allocate memory");

  if (!X509_object_helper_set_name(name, name_sequence))
    lose("unable to set new name");

  if (!X509_NAME_set(&self->crl->crl->issuer, name))
    lose("unable to set name");

  X509_NAME_free(name);

  Py_RETURN_NONE;

 error:

  if (name)
    X509_NAME_free(name);

  return  NULL;
}

static char x509_crl_object_set_this_update__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>setThisUpdate</name>\n"
"      <parameter>time</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this accepts one parameter, a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_set_this_update (x509_crl_object *self, PyObject *args)
{
  char *new_time = NULL;

  if (!PyArg_ParseTuple(args, "s", &new_time))
    goto error;

  if (!python_ASN1_TIME_set_string(self->crl->crl->lastUpdate, new_time))
    lose("Could not set lastUpdate");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char x509_crl_object_get_this_update__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>getThisUpdate</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this function returns a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_get_this_update (x509_crl_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  return ASN1_TIME_to_Python(self->crl->crl->lastUpdate);

 error:

  return NULL;
}

static char x509_crl_object_set_next_update__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>setNextUpdate</name>\n"
"      <parameter>time</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this accepts one parameter, a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_set_next_update (x509_crl_object *self, PyObject *args)
{
  char *new_time = NULL;
  ASN1_UTCTIME *time = NULL;

  if (!PyArg_ParseTuple(args, "s", &new_time))
    goto error;

  if (self->crl->crl->nextUpdate == NULL && (time = ASN1_UTCTIME_new()) == NULL)
    lose("could not allocate memory");

  self->crl->crl->nextUpdate = time;

  if (!python_ASN1_TIME_set_string(time, new_time))
    lose("Could not set nextUpdate");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char x509_crl_object_get_next_update__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>getNextUpdate</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this function returns a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_get_next_update (x509_crl_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  return ASN1_TIME_to_Python(self->crl->crl->nextUpdate);

 error:

  return NULL;
}

static char x509_crl_object_set_revoked__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>setRevoked</name>\n"
"      <parameter>revoked</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method sets the sequence of revoked certificates in this CRL.\n"
"         <parameter>revoked</parameter> should be a list or tuple of\n"
"         <classname>X509Revoked</classname>.\n"
"      </para>\n"
"      <example>\n"
"         <title><function>setRevoked</function> function usage</title>\n"
"         <programlisting>\n"
"      privateFile = open('test/private.key', 'r')\n"
"      publicFile = open('test/public.key', 'r')\n"
"      crlFile = open('test/crl.pem', 'w')\n"
"\n"
"      publicKey = POW.pemRead(POW.RSA_PUBLIC_KEY, publicFile.read())\n"
"      privateKey = POW.pemRead(POW.RSA_PRIVATE_KEY, privateFile.read(), 'pass')\n"
"\n"
"      crl = POW.X509Crl()\n"
"\n"
"      name = [  ['C', 'GB'], ['ST', 'Hertfordshire'],\n"
"                ['O','The House'], ['CN', 'Peter Shannon'] ]\n"
"\n"
"      t1 = POW.pkix.time2utc(time.time())\n"
"      t2 = POW.pkix.time2utc(time.time() + 60*60*24*365)\n"
"      crl.setIssuer(name)\n"
"      rev = [  POW.X509Revoked(3, t1),\n"
"               POW.X509Revoked(4, t1),\n"
"               POW.X509Revoked(5, t1)    ]\n"
"\n"
"      crl.setRevoked(rev)\n"
"      crl.setThisUpdate(t1)\n"
"      crl.setNextUpdate(t2)\n"
"      crl.sign(privateKey)\n"
"\n"
"      crlFile.write(crl.pemWrite())\n"
"\n"
"      privateFile.close()\n"
"      publicFile.close()\n"
"      crlFile.close()\n"
"         </programlisting>\n"
"      </example>\n"
"\n"
"   </body>\n"
"</method>\n"
;

// added because we don't already have one!
static X509_REVOKED *
X509_REVOKED_dup(X509_REVOKED *rev)
{
  return((X509_REVOKED *)ASN1_dup((i2d_of_void *) i2d_X509_REVOKED,
                                  (d2i_of_void *) d2i_X509_REVOKED,
                                  (char *) rev));
}

static PyObject *
x509_crl_object_set_revoked(x509_crl_object *self, PyObject *args)
{
  PyObject *revoked_sequence = NULL;
  x509_revoked_object *revoked = NULL;
  X509_REVOKED *tmp_revoked = NULL;
  int i = 0,size = 0;

  if (!PyArg_ParseTuple(args, "O", &revoked_sequence))
    goto error;

  if (!PyTuple_Check(revoked_sequence) && !PyList_Check(revoked_sequence))
    lose_type_error("inapropriate type");

  size = PySequence_Size(revoked_sequence);
  for (i = 0; i < size; i++) {
    if ((revoked = (x509_revoked_object*) PySequence_GetItem(revoked_sequence, i)) == NULL)
      goto error;

    if (!X_X509_revoked_Check(revoked))
      lose_type_error("inapropriate type");

    if ((tmp_revoked = X509_REVOKED_dup(revoked->revoked)) == NULL)
      lose("could not allocate memory");

    if (!X509_CRL_add0_revoked(self->crl, tmp_revoked))
      lose("could not add revokation to stack");

    Py_XDECREF(revoked);
    revoked = NULL;
  }

  Py_RETURN_NONE;

 error:

  Py_XDECREF(revoked);

  return  NULL;
}

static PyObject *
x509_crl_object_helper_get_revoked(STACK_OF(X509_REVOKED) *revoked)
{
  int no_entries = 0, i = 0;
  x509_revoked_object *revoke_obj = NULL;
  PyObject *result_list = NULL, *result_tuple = NULL;

  no_entries = sk_X509_REVOKED_num(revoked);

  if ((result_list = PyList_New(0)) == NULL)
    lose("could not allocate memory");

  for (i = 0; i < no_entries; i++) {
    if ((revoke_obj = PyObject_New(x509_revoked_object, &x509_revokedtype)) == NULL)
      lose("could not allocate memory");

    if ((revoke_obj->revoked = X509_REVOKED_dup(sk_X509_REVOKED_value(revoked, i))) == NULL)
      lose("could not get revocation");

    if (PyList_Append(result_list, (PyObject*) revoke_obj) != 0)
      goto error;

    Py_XDECREF(revoke_obj);
    revoke_obj = NULL;
  }

  result_tuple = PyList_AsTuple(result_list);
  Py_XDECREF(result_list);

  return result_tuple;

 error:

  Py_XDECREF(revoke_obj);
  Py_XDECREF(result_list);
  return NULL;
}

static char x509_crl_object_get_revoked__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>getRevoked</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a tuple of <classname>X509Revoked</classname>\n"
"         objects described in the CRL.\n"
"      </para>\n"
"      <example>\n"
"         <title><function>getRevoked</function> function usage</title>\n"
"         <programlisting>\n"
"      publicFile = open('test/public.key', 'r')\n"
"      crlFile = open('test/crl.pem', 'r')\n"
"\n"
"      publicKey = POW.pemRead(POW.RSA_PUBLIC_KEY, publicFile.read())\n"
"\n"
"      crl = POW.pemRead(POW.X509_CRL, crlFile.read())\n"
"\n"
"      print crl.pprint()\n"
"      if crl.verify(publicKey):\n"
"         print 'signature ok!'\n"
"      else:\n"
"         print 'signature not ok!'\n"
"\n"
"      revocations = crl.getRevoked()\n"
"      for revoked in revocations:\n"
"         print 'serial number:', revoked.getSerial()\n"
"         print 'date:', time.ctime(revoked.getDate()[0])\n"
"\n"
"      publicFile.close()\n"
"      crlFile.close()\n"
"         </programlisting>\n"
"      </example>\n"
"\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_get_revoked(x509_crl_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  return x509_crl_object_helper_get_revoked(X509_CRL_get_REVOKED(self->crl));

 error:

  return NULL;
}

static char X509_crl_object_add_extension__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>addExtension</name>\n"
"      <parameter>extensionName</parameter>\n"
"      <parameter>critical</parameter>\n"
"      <parameter>extensionValue</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method adds an extension to this CRL.\n"
"         <parameter>extensionName</parameter> should be the of the\n"
"         extension.  <parameter>critical</parameter> should an integer, 1\n"
"         for true and 0 for clase.  <parameter>extensionValue</parameter>\n"
"         should be a string, DER encoded value of the extension.  The name\n"
"         of the extension must be correct according to OpenSSL and can be\n"
"         checkd in the <constant>objects.h</constant> header file, part of\n"
"         the OpenSSL source distrobution.  In the majority of cases they\n"
"         are the same as those defined in <constant>POW._oids</constant>\n"
"         but if you do encounter problems is may be worth checking.\n"
"      </para>\n"
"      <example>\n"
"         <title><function>addExtension</function> method usage</title>\n"
"         <programlisting>\n"
"      oids = POW.pkix.OidData()\n"
"      o2i = oids.obj2oid\n"
"\n"
"      n1 = ('directoryName',  (((o2i('countryName'), ('printableString', 'UK')),),\n"
"                               ((o2i('stateOrProvinceName'), ('printableString', 'Herts')),),\n"
"                               ((o2i('organizationName'), ('printableString', 'The House')),),\n"
"                               ((o2i('commonName'), ('printableString', 'Shannon Works')),)))\n"
"\n"
"      n2 = ('rfc822Name', 'peter_shannon@yahoo.com')\n"
"      n3 = ('uri', 'http://www.p-s.org.uk')\n"
"      n4 = ('iPAddress', (192,168,100,51))\n"
"\n"
"      issuer = POW.pkix.IssuerAltName()\n"
"      issuer.set([n1,n2,n3,n4])\n"
"      crl.addExtension('issuerAltName', 0, issuer.toString())\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_crl_object_add_extension(x509_crl_object *self, PyObject *args)
{
  int critical = 0, nid = 0, len = 0;
  char *name = NULL;
  unsigned char *buf = NULL;
  ASN1_OCTET_STRING *octetString = NULL;
  X509_EXTENSION *extn = NULL;

  if (!PyArg_ParseTuple(args, "sis#", &name, &critical, &buf, &len))
    goto error;

  if ((octetString = M_ASN1_OCTET_STRING_new()) == NULL)
    lose("could not allocate memory");

  if (!ASN1_OCTET_STRING_set(octetString, buf, len))
    lose("could not set ASN1 Octect string");

  if ((nid = OBJ_txt2nid(name)) == NID_undef)
    lose("extension has unknown object identifier");

  if ((extn = X509_EXTENSION_create_by_NID(NULL, nid, critical, octetString)) == NULL)
    lose("unable to create ASN1 X509 Extension object");

  if (!self->crl->crl->extensions &&
      (self->crl->crl->extensions = sk_X509_EXTENSION_new_null()) == NULL)
    lose("unable to allocate memory");

  if (!sk_X509_EXTENSION_push(self->crl->crl->extensions, extn))
    lose("unable to add extension");

  Py_RETURN_NONE;

 error:

  if (extn)
    X509_EXTENSION_free(extn);

  return NULL;
}

static char X509_crl_object_clear_extensions__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>clearExtensions</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method clears the structure which holds the extension for\n"
"         this CRL.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_crl_object_clear_extensions(x509_crl_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (self->crl->crl->extensions) {
    sk_X509_EXTENSION_free(self->crl->crl->extensions);
    self->crl->crl->extensions = NULL;
  }

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char X509_crl_object_count_extensions__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>countExtensions</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the size of the structure which holds the\n"
"         extension for this CRL.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_crl_object_count_extensions(x509_crl_object *self, PyObject *args)
{
  int num = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (self->crl->crl->extensions)
    num = sk_X509_EXTENSION_num(self->crl->crl->extensions);

  return Py_BuildValue("i", num);

 error:

  return NULL;
}

static char X509_crl_object_get_extension__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>getExtension</name>\n"
"      <parameter>index</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a tuple equivalent the parameters of\n"
"         <function>addExtension</function>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_crl_object_get_extension(x509_crl_object *self, PyObject *args)
{
  int num = 0, index = 0, ext_nid = 0;
  char const *ext_ln = NULL;
  char unknown_ext [] = "unknown";
  X509_EXTENSION *ext;

  if (!PyArg_ParseTuple(args, "i", &index))
    goto error;

  if (self->crl->crl->extensions)
    num = sk_X509_EXTENSION_num(self->crl->crl->extensions);


  if (index >= num)
    lose("certificate does not have that many extensions");

  if ((ext = sk_X509_EXTENSION_value(self->crl->crl->extensions, index)) == NULL)
    lose("could not get extension");

  if ((ext_nid = OBJ_obj2nid(ext->object)) == NID_undef)
    lose("extension has unknown object identifier");

  if ((ext_ln = OBJ_nid2sn(ext_nid)) == NULL)
    ext_ln = unknown_ext;

  return Py_BuildValue("sis#", ext_ln, ext->critical, ext->value->data, ext->value->length);

 error:

  return NULL;
}

static char x509_crl_object_sign__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>sign</name>\n"
"      <parameter>key</parameter>\n"
"      <parameter>digest = MD5_DIGEST</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         <parameter>key</parameter> should be an instance of\n"
"         <classname>Asymmetric</classname> and contain a private key.\n"
"         <parameter>digest</parameter> indicates\n"
"         which digest function should be used to compute the hash to be\n"
"         signed, it should be one of the following:\n"
"      </para>\n"
"      <simplelist>\n"
#ifndef OPENSSL_NO_MD2
"         <member><constant>MD2_DIGEST</constant></member>\n"
#endif
"         <member><constant>MD5_DIGEST</constant></member>\n"
"         <member><constant>SHA_DIGEST</constant></member>\n"
"         <member><constant>SHA1_DIGEST</constant></member>\n"
"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
"         <member><constant>SHA256_DIGEST</constant></member>\n"
"         <member><constant>SHA384_DIGEST</constant></member>\n"
"         <member><constant>SHA512_DIGEST</constant></member>\n"
"     </simplelist>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_sign(x509_crl_object *self, PyObject *args)
{
  EVP_PKEY *pkey = NULL;
  asymmetric_object *asym;
  int digest = MD5_DIGEST;

  if (!PyArg_ParseTuple(args, "O!|i", &asymmetrictype, &asym, &digest))
    goto error;

  if ((pkey = EVP_PKEY_new()) == NULL)
    lose("could not allocate memory");

  if (asym->key_type != RSA_PRIVATE_KEY)
    lose("cannot use this type of key");

  if (!EVP_PKEY_assign_RSA(pkey, asym->cipher))
    lose("EVP_PKEY assignment error");

  switch (digest) {
  case MD5_DIGEST:
    if (!X509_CRL_sign(self->crl, pkey, EVP_md5()))
      lose("could not sign CRL");
    break;

#ifndef OPENSSL_NO_MD2
  case MD2_DIGEST:
    if (!X509_CRL_sign(self->crl, pkey, EVP_md2()))
      lose("could not sign CRL");
    break;
#endif

  case SHA_DIGEST:
    if (!X509_CRL_sign(self->crl, pkey, EVP_sha()))
      lose("could not sign CRL");
    break;

  case SHA1_DIGEST:
    if (!X509_CRL_sign(self->crl, pkey, EVP_sha1()))
      lose("could not sign CRL");
    break;

  case RIPEMD160_DIGEST:
    if (!X509_CRL_sign(self->crl, pkey, EVP_ripemd160()))
      lose("could not sign CRL");
    break;

  case SHA256_DIGEST:
    if (!X509_CRL_sign(self->crl, pkey, EVP_sha256()))
      lose("could not sign CRL");
    break;

  case SHA384_DIGEST:
    if (!X509_CRL_sign(self->crl, pkey, EVP_sha384()))
      lose("could not sign CRL");
    break;

  case SHA512_DIGEST:
    if (!X509_CRL_sign(self->crl, pkey, EVP_sha512()))
      lose("could not sign CRL");
    break;
  }

  Py_RETURN_NONE;

 error:

  if (pkey)
    EVP_PKEY_free(pkey);

  return NULL;

}

static char x509_crl_object_verify__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>verify</name>\n"
"      <parameter>key</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         The <classname>X509Crl</classname> method\n"
"         <function>verify</function> is based on the\n"
"         <function>X509_CRL_verify</function> function.  Unlike the\n"
"         <classname>X509</classname> function of the same name, this\n"
"         function simply checks the CRL was signed with the private key\n"
"         which corresponds the parameter <parameter>key</parameter>.\n"
"         <parameter>key</parameter> should be an instance of\n"
"         <classname>Asymmetric</classname> and contain a public key.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_verify(x509_crl_object *self, PyObject *args)
{
  EVP_PKEY *pkey = NULL;
  asymmetric_object *asym;
  int ok;

  if (!PyArg_ParseTuple(args, "O!", &asymmetrictype, &asym))
    goto error;

  if ((pkey = EVP_PKEY_new()) == NULL)
    lose("could not allocate memory");

  if (!EVP_PKEY_assign_RSA(pkey, asym->cipher))
    lose("EVP_PKEY assignment error");

  ok = X509_CRL_verify(self->crl, pkey);

  return PyBool_FromLong(ok);

 error:

  if (pkey)
    EVP_PKEY_free(pkey);

  return NULL;

}

static PyObject *
x509_crl_object_write_helper(x509_crl_object *self, PyObject *args, int format)
{
  int len = 0, ret = 0;
  char *buf = NULL;
  BIO *out_bio = NULL;
  PyObject *cert = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  out_bio = BIO_new(BIO_s_mem());

  switch (format) {

  case DER_FORMAT:
    if (!i2d_X509_CRL_bio(out_bio, self->crl))
      lose("unable to write certificate");
    break;

  case PEM_FORMAT:
    if (!PEM_write_bio_X509_CRL(out_bio, self->crl))
      lose("unable to write certificate");

  default:
    lose("internal error, unknown output format");
  }

  if ((len = BIO_ctrl_pending(out_bio)) == 0)
    lose("unable to get bytes stored in bio");

  if ((buf = malloc(len)) == NULL)
    lose("unable to allocate memory");

  if ((ret = BIO_read(out_bio, buf, len)) != len)
    lose("unable to write out cert");

  cert = Py_BuildValue("s#", buf, len);

  BIO_free(out_bio);
  free(buf);
  return cert;

 error:

  if (out_bio)
    BIO_free(out_bio);

  if (buf)
    free(buf);

  return NULL;
}

static char x509_crl_object_pem_write__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>pemWrite</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a PEM encoded CRL as a\n"
"         string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_pem_write(x509_crl_object *self, PyObject *args)
{
  return x509_crl_object_write_helper(self, args, PEM_FORMAT);
}

static char x509_crl_object_der_write__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>derWrite</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a DER encoded CRL as a string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_der_write(x509_crl_object *self, PyObject *args)
{
  return x509_crl_object_write_helper(self, args, DER_FORMAT);
}

static char x509_crl_object_pprint__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Crl</memberof>\n"
"      <name>pprint</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a formatted string showing the information\n"
"         held in the CRL.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_crl_object_pprint(x509_crl_object *self, PyObject *args)
{
  int len = 0, ret = 0;
  char *buf = NULL;
  BIO *out_bio = NULL;
  PyObject *crl = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  out_bio = BIO_new(BIO_s_mem());

  if (!X509_CRL_print(out_bio, self->crl))
    lose("unable to write crl");

  if ((len = BIO_ctrl_pending(out_bio)) == 0)
    lose("unable to get bytes stored in bio");

  if ((buf = malloc(len)) == NULL)
    lose("unable to allocate memory");

  if ((ret = BIO_read(out_bio, buf, len)) != len)
    lose("unable to write out cert");

  crl = Py_BuildValue("s#", buf, len);

  BIO_free(out_bio);
  free(buf);
  return crl;

 error:

  if (out_bio)
    BIO_free(out_bio);

  if (buf)
    free(buf);

  return NULL;

}

static struct PyMethodDef x509_crl_object_methods[] = {
  {"sign",             (PyCFunction)x509_crl_object_sign,              METH_VARARGS,  NULL},
  {"verify",           (PyCFunction)x509_crl_object_verify,            METH_VARARGS,  NULL},
  {"getVersion",       (PyCFunction)x509_crl_object_get_version,       METH_VARARGS,  NULL},
  {"setVersion",       (PyCFunction)x509_crl_object_set_version,       METH_VARARGS,  NULL},
  {"getIssuer",        (PyCFunction)x509_crl_object_get_issuer,        METH_VARARGS,  NULL},
  {"setIssuer",        (PyCFunction)x509_crl_object_set_issuer,        METH_VARARGS,  NULL},
  {"getThisUpdate",    (PyCFunction)x509_crl_object_get_this_update,   METH_VARARGS,  NULL},
  {"setThisUpdate",    (PyCFunction)x509_crl_object_set_this_update,   METH_VARARGS,  NULL},
  {"getNextUpdate",    (PyCFunction)x509_crl_object_get_next_update,   METH_VARARGS,  NULL},
  {"setNextUpdate",    (PyCFunction)x509_crl_object_set_next_update,   METH_VARARGS,  NULL},
  {"setRevoked",       (PyCFunction)x509_crl_object_set_revoked,       METH_VARARGS,  NULL},
  {"getRevoked",       (PyCFunction)x509_crl_object_get_revoked,       METH_VARARGS,  NULL},
  {"addExtension",     (PyCFunction)X509_crl_object_add_extension,     METH_VARARGS,  NULL},
  {"clearExtensions",  (PyCFunction)X509_crl_object_clear_extensions,  METH_VARARGS,  NULL},
  {"countExtensions",  (PyCFunction)X509_crl_object_count_extensions,  METH_VARARGS,  NULL},
  {"getExtension",     (PyCFunction)X509_crl_object_get_extension,     METH_VARARGS,  NULL},
  {"pemWrite",         (PyCFunction)x509_crl_object_pem_write,         METH_VARARGS,  NULL},
  {"derWrite",         (PyCFunction)x509_crl_object_der_write,         METH_VARARGS,  NULL},
  {"pprint",           (PyCFunction)x509_crl_object_pprint,            METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static PyObject *
x509_crl_object_getattr(x509_crl_object *self, char *name)
{
  return Py_FindMethod(x509_crl_object_methods, (PyObject *)self, name);
}

static void
x509_crl_object_dealloc(x509_crl_object *self, char *name)
{
  X509_CRL_free(self->crl);
  PyObject_Del(self);
}

static char x509_crltype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>X509Crl</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides access to OpenSSL X509 CRL management\n"
"         facilities.\n"
"      </para>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject x509_crltype = {
  PyObject_HEAD_INIT(0)
  0,                                     /*ob_size*/
  "X509Crl",                             /*tp_name*/
  sizeof(x509_crl_object),               /*tp_basicsize*/
  0,                                     /*tp_itemsize*/
  (destructor)x509_crl_object_dealloc,   /*tp_dealloc*/
  (printfunc)0,                          /*tp_print*/
  (getattrfunc)x509_crl_object_getattr,  /*tp_getattr*/
  (setattrfunc)0,                        /*tp_setattr*/
  (cmpfunc)0,                            /*tp_compare*/
  (reprfunc)0,                           /*tp_repr*/
  0,                                     /*tp_as_number*/
  0,                                     /*tp_as_sequence*/
  0,                                     /*tp_as_mapping*/
  (hashfunc)0,                           /*tp_hash*/
  (ternaryfunc)0,                        /*tp_call*/
  (reprfunc)0,                           /*tp_str*/
  0,
  0,
  0,
  0,
  x509_crltype__doc__                   /* Documentation string */
};
/*========== x509 crl Code ==========*/

/*========== revoked Code ==========*/
x509_revoked_object* x509_revoked_object_new(void)
{
  x509_revoked_object *self = NULL;

  if ((self = PyObject_New(x509_revoked_object, &x509_revokedtype)) == NULL)
    goto error;

  self->revoked = X509_REVOKED_new();

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static char x509_revoked_object_set_serial__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <name>setSerial</name>\n"
"      <parameter>serial</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method sets the serial number in the serial field of\n"
"         this object.  <parameter>serial</parameter> should be an\n"
"         integer.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_revoked_object_set_serial(x509_revoked_object *self, PyObject *args)
{
  int serial = 0;

  if (!PyArg_ParseTuple(args, "i", &serial))
    goto error;

  if (!ASN1_INTEGER_set(self->revoked->serialNumber, serial))
    lose("unable to set serial number");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char x509_revoked_object_get_serial__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <name>getSerial</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method gets the serial number in the serial field of\n"
"         this object.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_revoked_object_get_serial(x509_revoked_object *self, PyObject *args)
{
  int serial = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((serial = ASN1_INTEGER_get(self->revoked->serialNumber)) == -1)
    lose("unable to get serial number");

  return Py_BuildValue("i", serial);

 error:

  return NULL;
}

static char x509_revoked_object_get_date__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <name>getDate</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this function returns a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_revoked_object_get_date(x509_revoked_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  return ASN1_TIME_to_Python(self->revoked->revocationDate);

 error:

  return NULL;
}

static char x509_revoked_object_set_date__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <name>setDate</name>\n"
"      <parameter>time</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         In a change from previous releases, for reasons of portability\n"
"         and to avoid hard to fix issues with problems in unreliable time\n"
"         functions, this accepts one parameter, a UTCTime string.  You\n"
"         can use the function <function>time2utc</function> to convert to a\n"
"         string if you like and <function>utc2time</function> to back.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
x509_revoked_object_set_date(x509_revoked_object *self, PyObject *args)
{
  char *time = NULL;

  if (!PyArg_ParseTuple(args, "s", &time))
    goto error;

  if (!python_ASN1_TIME_set_string(self->revoked->revocationDate, time))
    lose_type_error("Could not set revocationDate");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char X509_revoked_object_add_extension__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <name>addExtension</name>\n"
"      <parameter>extensionName</parameter>\n"
"      <parameter>critical</parameter>\n"
"      <parameter>extensionValue</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method adds an extension to this revocation.\n"
"         <parameter>extensionName</parameter> should be the of the\n"
"         extension.  <parameter>critical</parameter> should an integer, 1\n"
"         for true and 0 for clase.  <parameter>extensionValue</parameter>\n"
"         should be a string, DER encoded value of the extension.  The name\n"
"         of the extension must be correct according to OpenSSL and can be\n"
"         checkd in the <constant>objects.h</constant> header file, part of\n"
"         the OpenSSL source distrobution.  In the majority of cases they\n"
"         are the same as those defined in <constant>POW._oids</constant>\n"
"         but if you do encounter problems is may be worth checking.\n"
"      </para>\n"
"      <example>\n"
"         <title><function>addExtension</function> method usage</title>\n"
"         <programlisting>\n"
"      reason = POW.pkix.CrlReason()\n"
"      reason.set(1)\n"
"      revocation.addExtension('CRLReason', 0, reason.toString())\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_revoked_object_add_extension(x509_revoked_object *self, PyObject *args)
{
  int critical = 0, nid = 0, len = 0;
  char *name = NULL;
  unsigned char *buf = NULL;
  ASN1_OCTET_STRING *octetString = NULL;
  X509_EXTENSION *extn = NULL;

  if (!PyArg_ParseTuple(args, "sis#", &name, &critical, &buf, &len))
    goto error;

  if ((octetString = M_ASN1_OCTET_STRING_new()) == NULL)
    lose("could not allocate memory");

  if (!ASN1_OCTET_STRING_set(octetString, buf, strlen((char *) buf)))
    lose("could not set ASN1 Octect string");

  if ((nid = OBJ_txt2nid(name)) == NID_undef)
    lose("extension has unknown object identifier");

  if ((extn = X509_EXTENSION_create_by_NID(NULL, nid, critical, octetString)) == NULL)
    lose("unable to create ASN1 X509 Extension object");

  if (!self->revoked->extensions && (self->revoked->extensions = sk_X509_EXTENSION_new_null()) == NULL)
    lose("unable to allocate memory");

  if (!sk_X509_EXTENSION_push(self->revoked->extensions, extn))
    lose("unable to add extension");

  Py_RETURN_NONE;

 error:

  if (extn)
    X509_EXTENSION_free(extn);

  return NULL;
}

static char X509_revoked_object_clear_extensions__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <name>clearExtensions</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method clears the structure which holds the extension for\n"
"         this revocation.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_revoked_object_clear_extensions(x509_revoked_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (self->revoked->extensions) {
    sk_X509_EXTENSION_free(self->revoked->extensions);
    self->revoked->extensions = NULL;
  }

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char X509_revoked_object_count_extensions__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <name>countExtensions</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the size of the structure which holds the\n"
"         extension for this revocation.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_revoked_object_count_extensions(x509_revoked_object *self, PyObject *args)
{
  int num = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (self->revoked->extensions)
    num = sk_X509_EXTENSION_num(self->revoked->extensions);

  return Py_BuildValue("i", num);

 error:

  return NULL;
}

static char X509_revoked_object_get_extension__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <name>getExtension</name>\n"
"      <parameter>index</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a tuple equivalent the parameters of\n"
"         <function>addExtension</function>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
X509_revoked_object_get_extension(x509_revoked_object *self, PyObject *args)
{
  int num = 0, index = 0, ext_nid = 0;
  char const *ext_ln = NULL;
  char unknown_ext [] = "unknown";
  X509_EXTENSION *ext;

  if (!PyArg_ParseTuple(args, "i", &index))
    goto error;

  if (self->revoked->extensions)
    num = sk_X509_EXTENSION_num(self->revoked->extensions);

  if (index >= num)
    lose("certificate does not have that many extensions");

  if ((ext = sk_X509_EXTENSION_value(self->revoked->extensions, index)) == NULL)
    lose("could not get extension");

  if ((ext_nid = OBJ_obj2nid(ext->object)) == NID_undef)
    lose("extension has unknown object identifier");

  if ((ext_ln = OBJ_nid2sn(ext_nid)) == NULL)
    ext_ln = unknown_ext;

  return Py_BuildValue("sis#", ext_ln, ext->critical, ext->value->data, ext->value->length);

 error:

  return NULL;
}

static struct PyMethodDef x509_revoked_object_methods[] = {
  {"getSerial",         (PyCFunction)x509_revoked_object_get_serial,       METH_VARARGS,  NULL},
  {"setSerial",         (PyCFunction)x509_revoked_object_set_serial,       METH_VARARGS,  NULL},
  {"getDate",           (PyCFunction)x509_revoked_object_get_date,         METH_VARARGS,  NULL},
  {"setDate",           (PyCFunction)x509_revoked_object_set_date,         METH_VARARGS,  NULL},
  {"addExtension",      (PyCFunction)X509_revoked_object_add_extension,    METH_VARARGS,  NULL},
  {"clearExtensions",   (PyCFunction)X509_revoked_object_clear_extensions, METH_VARARGS,  NULL},
  {"countExtensions",   (PyCFunction)X509_revoked_object_count_extensions, METH_VARARGS,  NULL},
  {"getExtension",      (PyCFunction)X509_revoked_object_get_extension,    METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static PyObject *
x509_revoked_object_getattr(x509_revoked_object *self, char *name)
{
  return Py_FindMethod(x509_revoked_object_methods, (PyObject *) self, name);
}

static void
x509_revoked_object_dealloc(x509_revoked_object *self, char *name)
{
  X509_REVOKED_free(self->revoked);
  PyObject_Del(self);
}

static char x509_revokedtype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>X509Revoked</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides a container for details of a revoked\n"
"         certificate.  It normally would only be used in association with\n"
"         a CRL, its not much use by itself.  Indeed the only reason this\n"
"         class exists is because in the future POW is likely to be extended\n"
"         to support extensions for certificates, CRLs and revocations.\n"
"         <classname>X509Revoked</classname> existing as an object in its\n"
"         own right will make adding this support easier, while avoiding\n"
"         backwards compatibility issues.\n"
"      </para>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject x509_revokedtype = {
  PyObject_HEAD_INIT(0)
  0,                                        /*ob_size*/
  "X509Revoked",                            /*tp_name*/
  sizeof(x509_revoked_object),              /*tp_basicsize*/
  0,                                        /*tp_itemsize*/
  (destructor)x509_revoked_object_dealloc,  /*tp_dealloc*/
  (printfunc)0,                             /*tp_print*/
  (getattrfunc)x509_revoked_object_getattr, /*tp_getattr*/
  (setattrfunc)0,                           /*tp_setattr*/
  (cmpfunc)0,                               /*tp_compare*/
  (reprfunc)0,                              /*tp_repr*/
  0,                                        /*tp_as_number*/
  0,                                        /*tp_as_sequence*/
  0,                                        /*tp_as_mapping*/
  (hashfunc)0,                              /*tp_hash*/
  (ternaryfunc)0,                           /*tp_call*/
  (reprfunc)0,                              /*tp_str*/
  0,
  0,
  0,
  0,
  x509_revokedtype__doc__                  /* Documentation string */
};
/*========== x509 revoked Code ==========*/

/*========== ssl Code ==========*/
static char ssl_object_use_certificate__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>useCertificate</name>\n"
"      <parameter>cert</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         The parameter <parameter>cert</parameter> must be an\n"
"         instance of the <classname>X590</classname> class and must be\n"
"         called before <function>setFd</function>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_use_certificate(ssl_object *self, PyObject *args)
{
  x509_object *x509 = NULL;

  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
    goto error;

  if (self->ctxset)
    lose("cannot be called after setFd()");

  if (!SSL_CTX_use_certificate(self->ctx, x509->x509))
    lose("could not use certificate");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static PyObject *
ssl_object_add_certificate(ssl_object *self, PyObject *args)
{
  x509_object *x509 = NULL;
  X509 *x = NULL;

  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
    goto error;

  if (self->ctxset)
    lose("cannot be called after setFd()");

  if ((x = X509_dup(x509->x509)) == NULL)
    lose("could not duplicate X509 object");

  if (!SSL_CTX_add_extra_chain_cert(self->ctx, x))
    lose_openssl_error("Could not add certificate");

  x = NULL;

  Py_RETURN_NONE;

 error:

  if (x)
    X509_free(x);

  return NULL;
}

static PyObject *
ssl_object_add_trust(ssl_object *self, PyObject *args)
{
  x509_object *x509 = NULL;
  X509 *x = NULL;

  if (!PyArg_ParseTuple(args, "O!", &x509type, &x509))
    goto error;

  if (self->ctxset)
    lose("Cannot be called after setFd()");

  if (self->trusted_certs == NULL &&
      (self->trusted_certs = sk_X509_new_null()) == NULL)
    lose("Couldn't allocate trusted certificate stack");

  if ((x = X509_dup(x509->x509)) == NULL)
    lose("Couldn't duplicate X509 object");

  if (!sk_X509_push(self->trusted_certs, x))
    lose("Couldn't push cert onto trusted certificate stack");

  x = NULL;

  Py_RETURN_NONE;

 error:

  if (x)
    X509_free(x);

  return NULL;
}

static char ssl_object_use_key__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>useKey</name>\n"
"      <parameter>key</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         The parameter <parameter>key</parameter> must be an\n"
"         instance of the <classname>Asymmetric</classname> class and\n"
"         must contain the private key.  This function cannot be called\n"
"         after <function>useKey</function>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_use_key(ssl_object *self, PyObject *args)
{
  asymmetric_object *asym = NULL;
  EVP_PKEY *pkey = NULL;

  if (!PyArg_ParseTuple(args, "O!", &asymmetrictype, &asym))
    goto error;

  if (self->ctxset)
    lose("cannot be called after setFd()");

  if ((pkey = EVP_PKEY_new()) == NULL)
    lose("could not allocate memory");

  if (asym->key_type != RSA_PRIVATE_KEY)
    lose("cannot use this type of key");

  if (!EVP_PKEY_set1_RSA(pkey, asym->cipher))
    lose("EVP_PKEY assignment error");

  if (!SSL_CTX_use_PrivateKey(self->ctx, pkey))
    lose("ctx key assignment error");

  Py_RETURN_NONE;

 error:

  if(pkey)
    EVP_PKEY_free(pkey);

  return NULL;
}

static char ssl_object_check_key__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>checkKey</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This simple method will return 1 if the public key, contained in\n"
"         the X509 certificate this <classname>Ssl</classname> instance is using,\n"
"         matches the private key this <classname>Ssl</classname> instance is using.\n"
"         Otherwise it will return 0.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_check_key(ssl_object *self, PyObject *args)
{
  return PyBool_FromLong(SSL_CTX_check_private_key(self->ctx));
}

static char ssl_object_set_fd__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>setFd</name>\n"
"      <parameter>descriptor</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function is used to associate a file descriptor with a\n"
"         <classname>Ssl</classname> object.  The file descriptor should\n"
"         belong to an open TCP connection.  Once this function has\n"
"         been called, calling <function>useKey</function> or\n"
"         <function>useCertificate</function> will, fail rasing exceptions.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_set_fd(ssl_object *self, PyObject *args)
{
  int fd = 0, self_index = 0;

  if (!PyArg_ParseTuple(args, "i", &fd))
    goto error;

  if ((self->ssl = SSL_new(self->ctx)) == NULL)
    lose("Unable to create ssl structure");

  SSL_set_mode(self->ssl, (SSL_MODE_ENABLE_PARTIAL_WRITE |
                           SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER));

  if (!SSL_set_fd(self->ssl, fd))
    lose("Unable to set file descriptor");

  if ((self_index = SSL_get_ex_new_index(0, "self_index", NULL, NULL, NULL)) != -1)
    SSL_set_ex_data(self->ssl, self_index, self);
  else
    lose("Unable to create ex data index");

  self->ctxset = 1;

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char ssl_object_fileno__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>fileno</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function is used to extract the file descriptor associated\n"
"         with a <classname>Ssl</classname> object.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_fileno(ssl_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  return Py_BuildValue("i", SSL_get_fd(self->ssl));

 error:

  return NULL;
}

static char ssl_object_accept__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>accept</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function will attempt the SSL level accept with a\n"
"         client.  The <classname>Ssl</classname> object must have been\n"
"         created using a <constant>XXXXX_SERVER_METHOD</constant> or\n"
"         a <constant>XXXXX_METHOD</constant> and this function should only be\n"
"         called after <function>useKey</function>,\n"
"         <function>useCertificate</function> and\n"
"         <function>setFd</function> functions have been called.\n"
"      </para>\n"
"\n"
"      <example>\n"
"         <title><function>accept</function> function usage</title>\n"
"         <programlisting>\n"
"      keyFile = open('test/private.key', 'r')\n"
"      certFile = open('test/cacert.pem', 'r')\n"
"\n"
"      rsa = POW.pemRead(POW.RSA_PRIVATE_KEY, keyFile.read(), 'pass')\n"
"      x509 = POW.pemRead(POW.X509_CERTIFICATE, certFile.read())\n"
"\n"
"      keyFile.close()\n"
"      certFile.close()\n"
"\n"
"      sl = POW.Ssl(POW.SSLV23_SERVER_METHOD)\n"
"      sl.useCertificate(x509)\n"
"      sl.useKey(rsa)\n"
"\n"
"      s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n"
"      s.bind(('localhost', 1111))\n"
"      s.listen(5)\n"
"      s2, addr = s.accept()\n"
"\n"
"      s.close()\n"
"\n"
"      sl.setFd(s2.fileno())\n"
"      sl.accept()\n"
"      print sl.read(1024)\n"
"      sl.write('Message from server to client...')\n"
"\n"
"      s2.close()\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_accept(ssl_object *self, PyObject *args)
{
  int ret = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  Py_BEGIN_ALLOW_THREADS;
  ret = SSL_accept(self->ssl);
  Py_END_ALLOW_THREADS;

  if (ret <= 0)
    lose_ssl_error(self, ret);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char ssl_object_connect__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>connect</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function will attempt the SSL level connection with a\n"
"         server.  The <classname>Ssl</classname> object must have been\n"
"         created using a <constant>XXXXX_CLIENT_METHOD</constant> or\n"
"         a <constant>XXXXX_METHOD</constant> and this function should only be\n"
"         called after <function>setFd</function> has already been\n"
"         called.\n"
"      </para>\n"
"\n"
"      <example>\n"
"         <title><function>connect</function> function usage</title>\n"
"         <programlisting>\n"
"      s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n"
"      s.connect(('localhost', 1111))\n"
"\n"
"      sl = POW.Ssl(POW.SSLV23_CLIENT_METHOD)\n"
"      sl.setFd(s.fileno())\n"
"      sl.connect()\n"
"      sl.write('Message from client to server...')\n"
"      print sl.read(1024)\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_connect(ssl_object *self, PyObject *args)
{
  int ret;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  Py_BEGIN_ALLOW_THREADS;
  ret = SSL_connect(self->ssl);
  Py_END_ALLOW_THREADS;

  if (ret <= 0)
    lose_ssl_error(self, ret);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char ssl_object_write__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>write</name>\n"
"      <parameter>string</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method writes the <parameter>string</parameter> to the\n"
"         <classname>Ssl</classname> object, to be read by it's peer.  This\n"
"         function is analogous to the <classname>socket</classname>\n"
"         classes <function>write</function> function.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_write(ssl_object *self, PyObject *args)
{
  char *msg;
  int length = 0, ret = 0;

  if (!PyArg_ParseTuple(args, "s#", &msg, &length))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  Py_BEGIN_ALLOW_THREADS;
  ret = SSL_write(self->ssl, msg, length);
  Py_END_ALLOW_THREADS;

  if (ret <= 0)
    lose_ssl_error(self, ret);

  return Py_BuildValue("i", ret);

 error:

  return NULL;
}

static char ssl_object_read__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>read</name>\n"
"      <parameter>amount = 1024</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method reads up to <parameter>amount</parameter> characters from the\n"
"         <classname>Ssl</classname> object.  This\n"
"         function is analogous to the <classname>socket</classname>\n"
"         classes <function>read</function> function.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_read(ssl_object *self, PyObject *args)
{
  PyObject *data;
  char *msg = NULL;
  int len = 1024, ret = 0;

  if (!PyArg_ParseTuple(args, "|i", &len))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  if ((msg = malloc(len)) == NULL)
    lose("unable to allocate memory");

  Py_BEGIN_ALLOW_THREADS;
  ret = SSL_read(self->ssl, msg, len);
  Py_END_ALLOW_THREADS;

  if (ret <= 0)
    lose_ssl_error(self, ret);

  data = Py_BuildValue("s#", msg, ret);

  free(msg);
  return data;

 error:

  if (msg)
    free(msg);

  return NULL;
}

static char ssl_object_peer_certificate__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>peerCertificate</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns any peer certificate presented in the initial\n"
"         SSL negotiation or <constant>None</constant>.  If a certificate is\n"
"         returned, it will be an instance of <classname>X509</classname>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_peer_certificate(ssl_object *self, PyObject *args)
{
  X509 *x509 = NULL;
  x509_object *x509_obj = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  if ((x509_obj = X509_object_new()) == NULL)
    lose("could not create x509 object");

  x509 = SSL_get_peer_certificate(self->ssl);

  if (x509) {
    X509_free(x509_obj->x509);
    x509_obj->x509 = x509;
    return (PyObject *) x509_obj;
  }
  else {
    Py_XDECREF(x509_obj);
    Py_RETURN_NONE;
  }

 error:

  if (x509)
    X509_free(x509);

  Py_XDECREF(x509_obj);
  return NULL;
}

static char ssl_object_clear__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>clear</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method will clear the SSL session ready for\n"
"         a new SSL connection.  It will not effect the underlying socket.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_clear(ssl_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  if (!SSL_clear(self->ssl))
    lose("failed to clear ssl connection");

  if (self->x509_cb_err) {
    free(self->x509_cb_err);
    self->x509_cb_err = NULL;
  }

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char ssl_object_shutdown__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>shutdown</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method will issue a <constant>shutdown</constant> signal to it's peer.\n"
"         If this connection's peer has already initiated a shutdown this call\n"
"         will succeed, otherwise it will raise and exception.  In order to\n"
"         check the shutdown handshake was successful,\n"
"         <function>shutdown</function> must be called again.  If no\n"
"         exception is raised, the handshake is complete.\n"
"      </para>\n"
"      <para>\n"
"         The odd\n"
"         implementation of this function reflects the underlying OpenSSL\n"
"         function, which reflects the SSL protocol.  Although rasing an\n"
"         exception is a bit annoying, the alternative, returning true all\n"
"         false will not tell you why the call failed and the exception\n"
"         will, at least that is the theory.  Look up the exact meaning\n"
"         of the exceptions in the OpenSSL man page SSL_get_error.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_shutdown(ssl_object *self, PyObject *args)
{
  int ret = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  ret = SSL_shutdown(self->ssl);

  /*
   * The original POW behavior here seems nuts to me.  SSL_shutdown()
   * returns a tristate:
   *
   *  1: fully closed
   *  0: close notification sent, waiting for peer
   * -1: error, WANT_READ, or WANT_WRITE
   *
   * Doc claims the protocol allows us to bail on 0 return if we don't
   * want to wait.  So the "obvious" thing to do here is return boolean
   * for 1 or 0 and raise an exception for -1.  Original author's explanation
   * for why he didn't do that makes no sense to me, so I've changed it.
   */

  if (ret < 0)
    lose_ssl_error(self, ret);

  return PyBool_FromLong(ret);

 error:

  return NULL;
}

static char ssl_object_get_shutdown__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>getShutdown</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function returns an integer indicating the state of the\n"
"         SSL connection. <constant>SSL_RECEIVED_SHUTDOWN</constant>\n"
"         will be set the if it's peer sends a <constant>shutdown</constant>\n"
"         signal or the underlying socket\n"
"         receives a close notify .  The possible values are:\n"
"      </para>\n"
"      <simplelist>\n"
"         <member><constant>SSL_NO_SHUTDOWN</constant></member>\n"
"         <member><constant>SSL_SENT_SHUTDOWN</constant></member>\n"
"         <member><constant>SSL_RECEIVED_SHUTDOWN</constant></member>\n"
"         <member><constant>SSL_SENT_SHUTDOWN</constant> | <constant>SSL_RECEIVED_SHUTDOWN</constant></member>\n"
"      </simplelist>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_get_shutdown(ssl_object *self, PyObject *args)
{
  int state = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  state = SSL_get_shutdown(self->ssl);

  return Py_BuildValue("i", state);

 error:

  return NULL;
}

static char ssl_object_get_ciphers__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>getCiphers</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function returns a list of available ciphers ordered from\n"
"         most favored to least.  This function must be called after\n"
"         <function>setFd</function>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_get_ciphers(ssl_object *self, PyObject *args)
{
  int i = 0;
  const char *cipher = NULL;
  PyObject *list = NULL, *name = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  list = PyList_New(0);

  cipher = SSL_get_cipher_list(self->ssl, 0);
  while (cipher) {
    if ((name = PyString_FromString(cipher)) == NULL)
      goto error;
    if (PyList_Append(list, name) != 0)
      goto error;
    Py_XDECREF(name);
    name = NULL;
    cipher = SSL_get_cipher_list(self->ssl, ++i);
  }
  return list;

 error:

  Py_XDECREF(name);
  Py_XDECREF(list);
  return NULL;
}

static char ssl_object_set_ciphers__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>setCiphers</name>\n"
"      <parameter>ciphers</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         <function>setCiphers</function>\n"
"         can help protect against certain types of attacks which try to\n"
"         coerce the server, client or both to negotiate a weak cipher.\n"
"         <parameter>ciphers</parameter> should be a list of strings, as\n"
"         produced by <function>getCiphers</function> and described in the\n"
"         OpenSSL man page ciphers.   <function>setCiphers</function> should\n"
"         only be called after <function>setFd</function>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_set_ciphers(ssl_object *self, PyObject *args)
{
  PyObject *ciphers = NULL;
  PyObject *cipher = NULL;
  int size = 0, cipherstrlen = 0, nextstrlen = 0, i = 0;
  char *cipherstr = NULL;

  if (!PyArg_ParseTuple(args, "O", &ciphers))
    goto error;

  if (!PyList_Check(ciphers) && !PyTuple_Check(ciphers))
    lose_type_error("inapropriate type");

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  cipherstr = malloc(8);        // Very bogus, realloc() dosn't work without some
                                // previously allocated memory! Really should.
  memset(cipherstr, 0, 8);
  size = PySequence_Size(ciphers);
  for (i = 0; i < size; i++) {
    if ((cipher = PySequence_GetItem(ciphers, i)) == NULL)
      goto error;

    if (!PyString_Check(cipher))
      lose_type_error("inapropriate type");

    cipherstrlen = strlen(cipherstr);
    nextstrlen = strlen(PyString_AsString(cipher));

    if ((cipherstr = realloc(cipherstr, cipherstrlen + nextstrlen + 2)) == NULL)
      lose_type_error("could allocate memory");

    if (cipherstrlen)
      strcat(cipherstr, ":\0");

    strcat(cipherstr, PyString_AsString(cipher));
    Py_XDECREF(cipher);
    cipher = NULL;
  }
  SSL_set_cipher_list(self->ssl, cipherstr);
  free(cipherstr);
  Py_RETURN_NONE;

 error:

  if (cipherstr)
    free(cipherstr);

  Py_XDECREF(cipher);

  return NULL;
}

static char ssl_object_get_cipher__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>getCipher</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function returns the current cipher in use.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_get_cipher(ssl_object *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if (!self->ctxset)
    lose("cannot be called before setFd()");

  return Py_BuildValue("s", SSL_get_cipher(self->ssl));

 error:

  return NULL;
}

static int ssl_object_verify_callback(X509_STORE_CTX *ctx, void *arg)
{
  ssl_object *self = arg;
  int ok;

  if (self->trusted_certs)
    X509_STORE_CTX_trusted_stack(ctx, self->trusted_certs);

  if (self->x509_cb_err) {
    free(self->x509_cb_err);
    self->x509_cb_err = NULL;
  }

  ok = X509_verify_cert(ctx) == 1;

  if (!ok) {

    /*
     * We probably should be pushing out structured Python data here
     * rather than a string, but we're pretty deep in the OpenSSL call
     * chain at this point and I'd rather not risk whacky interactions
     * with the Python garbage collector.  Try this kludge initially,
     * rewrite as something better later if it looks worth the effort.
     */

    BIO *b = BIO_new(BIO_s_mem());
    char *buf = NULL;
    int len;

    if (!b)
      goto fail;

    BIO_puts(b, "TLS validation failure:\n\n");

    if (self->trusted_certs) {
      int i;
      BIO_puts(b, "Trusted cert stack\n");
      for (i = 0; i < sk_X509_num(self->trusted_certs); i++) {
        X509 *x = sk_X509_value(self->trusted_certs, i);
        BIO_printf(b, "[%d] ", i);
        if (x)
          X509_print(b, x);
        else
          BIO_puts(b, "<NULL>!\n");
      }
    } else {
      BIO_puts(b, "No trusted cert stack\n");
    }

    BIO_printf(b,
            "\nX509_verify_cert() error: error depth %d error %d current_cert %p current_issuer %p current_crl %p: %s\n",
            ctx->error_depth,
            ctx->error,
            ctx->current_cert,
            ctx->current_issuer,
            ctx->current_crl,
            X509_verify_cert_error_string(ctx->error));
    if (ctx->current_cert)
      X509_print(b, ctx->current_cert);

    /* This seems to be returning garbage, don't know why */
    if (ctx->current_issuer)
      X509_print(b, ctx->current_issuer);

    if ((len = BIO_ctrl_pending(b)) == 0 || (buf = malloc(len + 1)) == NULL)
      goto fail;

    if (BIO_read(b, buf, len) == len) {
      buf[len] = '\0';
      self->x509_cb_err = buf;
    } else {
      free(buf);
    }

  fail:
    BIO_free(b);
  }

  return ok;
}

static char ssl_object_set_verify_mode__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <name>setVerifyMode</name>\n"
"      <parameter>mode</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function sets the behavior of the SSL handshake.  The\n"
"         parameter <parameter>mode</parameter> should be one of the\n"
"         following:\n"
"      </para>\n"
"      <simplelist>\n"
"         <member><constant>SSL_VERIFY_NONE</constant></member>\n"
"         <member><constant>SSL_VERIFY_PEER</constant></member>\n"
"         <member><constant>SSL_VERIFY_PEER</constant> |\n"
"                 <constant>SSL_VERIFY_FAIL_IF_NO_PEER_CERT</constant></member>\n"
"      </simplelist>\n"
"      <para>\n"
"         See the OpenSSL man page <function>SSL_CTX_set_verify</function>\n"
"         for details.  This function must be called after <function>setfd</function>\n"
"         has been called.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
ssl_object_set_verify_mode(ssl_object *self, PyObject *args)
{
  int mode = 0;

  if (!PyArg_ParseTuple(args, "i", &mode))
    goto error;

  if (self->ctxset)
    lose("cannot be called after setfd()");

  SSL_CTX_set_verify(self->ctx, mode, NULL);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static struct PyMethodDef ssl_object_methods[] = {
  {"useCertificate",   (PyCFunction)ssl_object_use_certificate,  METH_VARARGS,  NULL},
  {"addCertificate",   (PyCFunction)ssl_object_add_certificate,  METH_VARARGS,  NULL},
  {"addTrust",         (PyCFunction)ssl_object_add_trust,        METH_VARARGS,  NULL},
  {"useKey",           (PyCFunction)ssl_object_use_key,          METH_VARARGS,  NULL},
  {"checkKey",         (PyCFunction)ssl_object_check_key,        METH_VARARGS,  NULL},
  {"setFd",            (PyCFunction)ssl_object_set_fd,           METH_VARARGS,  NULL},
  {"fileno",           (PyCFunction)ssl_object_fileno,           METH_VARARGS,  NULL},
  {"connect",          (PyCFunction)ssl_object_connect,          METH_VARARGS,  NULL},
  {"accept",           (PyCFunction)ssl_object_accept,           METH_VARARGS,  NULL},
  {"write",            (PyCFunction)ssl_object_write,            METH_VARARGS,  NULL},
  {"read",             (PyCFunction)ssl_object_read,             METH_VARARGS,  NULL},
  {"peerCertificate",  (PyCFunction)ssl_object_peer_certificate, METH_VARARGS,  NULL},
  {"clear",            (PyCFunction)ssl_object_clear,            METH_VARARGS,  NULL},
  {"shutdown",         (PyCFunction)ssl_object_shutdown,         METH_VARARGS,  NULL},
  {"getShutdown",      (PyCFunction)ssl_object_get_shutdown,     METH_VARARGS,  NULL},
  {"getCiphers",       (PyCFunction)ssl_object_get_ciphers,      METH_VARARGS,  NULL},
  {"setCiphers",       (PyCFunction)ssl_object_set_ciphers,      METH_VARARGS,  NULL},
  {"getCipher",        (PyCFunction)ssl_object_get_cipher,       METH_VARARGS,  NULL},
  {"setVerifyMode",    (PyCFunction)ssl_object_set_verify_mode,  METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static ssl_object *
newssl_object(int type)
{
  ssl_object *self;
  const SSL_METHOD *method;


  if ((self = PyObject_NEW(ssl_object, &ssltype)) == NULL)
    goto error;

  self->ctxset = 0;
  self->ssl = NULL;
  self->trusted_certs = NULL;
  self->x509_cb_err = NULL;

  switch (type) {
  case SSLV2_SERVER_METHOD:  method = SSLv2_server_method();   break;
  case SSLV2_CLIENT_METHOD:  method = SSLv2_client_method();   break;
  case SSLV2_METHOD:         method = SSLv2_method();          break;
  case SSLV3_SERVER_METHOD:  method = SSLv3_server_method();   break;
  case SSLV3_CLIENT_METHOD:  method = SSLv3_client_method();   break;
  case SSLV3_METHOD:         method = SSLv3_method();          break;
  case TLSV1_SERVER_METHOD:  method = TLSv1_server_method();   break;
  case TLSV1_CLIENT_METHOD:  method = TLSv1_client_method();   break;
  case TLSV1_METHOD:         method = TLSv1_method();          break;
  case SSLV23_SERVER_METHOD: method = SSLv23_server_method();  break;
  case SSLV23_CLIENT_METHOD: method = SSLv23_client_method();  break;
  case SSLV23_METHOD:        method = SSLv23_method();         break;

  default:
    lose("unknown ctx method");
  }

  if ((self->ctx = SSL_CTX_new(method)) == NULL)
    lose("unable to create new ctx");

  SSL_CTX_set_cert_verify_callback(self->ctx, ssl_object_verify_callback, self);

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static PyObject *
ssl_object_getattr(ssl_object *self, char *name)
{
  return Py_FindMethod(ssl_object_methods, (PyObject *)self, name);
}

static void
ssl_object_dealloc(ssl_object *self)
{
  SSL_free(self->ssl);
  SSL_CTX_free(self->ctx);
  if (self->trusted_certs)
    sk_X509_pop_free(self->trusted_certs, X509_free);
  if (self->x509_cb_err)
    free(self->x509_cb_err);
  PyObject_Del(self);
}

static char ssltype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>Ssl</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides access to the Secure Socket Layer\n"
"         functionality of OpenSSL.  It is designed to be a simple as\n"
"         possible to use and is not designed for high performance\n"
"         applications which handle many simultaneous connections.  The\n"
"         original motivation for writing this library was to provide a\n"
"         security layer for network agents written in Python, for this\n"
"         application, good performance with multiple concurrent connections\n"
"         is not an issue.\n"
"      </para>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject ssltype = {
   PyObject_HEAD_INIT(0)
   0,                               /*ob_size*/
   "Ssl",                           /*tp_name*/
   sizeof(ssl_object),               /*tp_basicsize*/
   0,                               /*tp_itemsize*/
   (destructor)ssl_object_dealloc,  /*tp_dealloc*/
   (printfunc)0,                    /*tp_print*/
   (getattrfunc)ssl_object_getattr, /*tp_getattr*/
   (setattrfunc)0,                  /*tp_setattr*/
   (cmpfunc)0,                      /*tp_compare*/
   (reprfunc)0,                     /*tp_repr*/
   0,                               /*tp_as_number*/
   0,                               /*tp_as_sequence*/
   0,                               /*tp_as_mapping*/
   (hashfunc)0,                     /*tp_hash*/
   (ternaryfunc)0,                  /*tp_call*/
   (reprfunc)0,                     /*tp_str*/
   0,
   0,
   0,
   0,
   ssltype__doc__                   /* Documentation string */
};
/*========== ssl Object ==========*/

/*========== asymmetric Object ==========*/
static asymmetric_object *
asymmetric_object_new(int cipher_type, int key_size)
{
  asymmetric_object *self = NULL;

  self = PyObject_New(asymmetric_object, &asymmetrictype);
  if (self == NULL)
    goto error;

  if (cipher_type != RSA_CIPHER)
    lose("unsupported cipher");

  if ((self->cipher = RSA_generate_key(key_size,RSA_F4,NULL,NULL)) == NULL)
    lose("could not generate key");

  self->key_type = RSA_PRIVATE_KEY;
  self->cipher_type = RSA_CIPHER;

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static asymmetric_object *
asymmetric_object_pem_read(int key_type, BIO *in, char *pass)
{
  asymmetric_object *self = NULL;

  self = PyObject_New(asymmetric_object, &asymmetrictype);
  if (self == NULL)
    goto error;

  switch (key_type) {

  case RSA_PUBLIC_KEY:
    if ((self->cipher = PEM_read_bio_RSA_PUBKEY(in, NULL, NULL, NULL)) == NULL)
      lose("could not load public key");
    self->key_type = RSA_PUBLIC_KEY;
    self->cipher_type = RSA_CIPHER;
    break;

  case RSA_PRIVATE_KEY:
    if ((self->cipher = PEM_read_bio_RSAPrivateKey(in, NULL, NULL, pass)) == NULL)
      lose("could not load private key");
    self->key_type = RSA_PRIVATE_KEY;
    self->cipher_type = RSA_CIPHER;
    break;

  default:
    lose("unknown key type");
  }

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static asymmetric_object *
asymmetric_object_der_read(int key_type, unsigned char *src, int len)
{
  asymmetric_object *self = NULL;
  unsigned char *ptr = src;

  self = PyObject_New(asymmetric_object, &asymmetrictype);
  if (self == NULL)
    goto error;

  switch (key_type) {
  case RSA_PUBLIC_KEY:

    if ((self->cipher = d2i_RSA_PUBKEY(NULL, (const unsigned char **) &ptr, len)) == NULL)
      lose("could not load public key");

    self->key_type = RSA_PUBLIC_KEY;
    self->cipher_type = RSA_CIPHER;
    break;

  case RSA_PRIVATE_KEY:

    if ((self->cipher = d2i_RSAPrivateKey(NULL, (const unsigned char **) &ptr, len)) == NULL)
      lose("could not load private key");

    self->key_type = RSA_PRIVATE_KEY;
    self->cipher_type = RSA_CIPHER;
    break;

  default:
    lose("unknown key type");
  }

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static char asymmetric_object_pem_write__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Asymmetric</memberof>\n"
"      <name>pemWrite</name>\n"
"      <parameter>keytype</parameter>\n"
"      <parameter>ciphertype = None</parameter>\n"
"      <parameter>passphrase = None</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to write <classname>Asymmetric</classname>\n"
"         objects out as strings.  The first argument should be either\n"
"         <constant>RSA_PUBLIC_KEY</constant> or\n"
"         <constant>RSA_PRIVATE_KEY</constant>.  Private keys are often\n"
"         saved in encrypted files to offer extra security above access\n"
"         control mechanisms.  If the <parameter>keytype</parameter> is\n"
"         <constant>RSA_PRIVATE_KEY</constant> a\n"
"         <parameter>ciphertype</parameter> and\n"
"         <parameter>passphrase</parameter> can also be specified.  The\n"
"         <parameter>ciphertype</parameter> should be one of those listed in\n"
"         the <classname>Symmetric</classname> class section.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
asymmetric_object_pem_write(asymmetric_object *self, PyObject *args)
{
  int key_type = 0, cipher = 0, len = 0, ret = 0;
  char *kstr = NULL, *buf = NULL;
  BIO *out_bio = NULL;
  PyObject *asymmetric = NULL;

  if (!PyArg_ParseTuple(args, "|iis", &key_type, &cipher, &kstr))
    goto error;

  if (key_type == 0)
    key_type = self->key_type;

  if ((out_bio = BIO_new(BIO_s_mem())) == NULL)
    lose("unable to create new BIO");

  if ((kstr && !cipher) || (cipher && !kstr))
    lose("cipher type and key string must both be supplied");

  switch(key_type) {

  case RSA_PRIVATE_KEY:
    if (kstr && cipher) {
      if (!PEM_write_bio_RSAPrivateKey(out_bio, self->cipher, evp_cipher_factory(cipher), NULL, 0, NULL, kstr))
        lose("unable to write key");
    }
    else {
      if (!PEM_write_bio_RSAPrivateKey(out_bio, self->cipher, NULL, NULL, 0, NULL, NULL))
        lose("unable to write key");
    }
    break;

  case RSA_PUBLIC_KEY:
    if (kstr && cipher)
      lose("public keys should not encrypted");
    else {
      if (!PEM_write_bio_RSA_PUBKEY(out_bio, self->cipher))
        lose("unable to write key");
    }
    break;

  default:
    lose("unsupported key type");
  }

  if ((len = BIO_ctrl_pending(out_bio)) == 0)
    lose("unable to get number of bytes in bio");

  if ((buf = malloc(len)) == NULL)
    lose("unable to allocate memory");

  if ((ret = BIO_read(out_bio, buf, len)) != len)
    lose("unable to write out key");

  asymmetric = Py_BuildValue("s#", buf, len);

  BIO_free(out_bio);
  free(buf);
  return asymmetric;

 error:

  if (out_bio);
  BIO_free(out_bio);

  if (buf)
    free(buf);

  return NULL;
}

static char asymmetric_object_der_write__doc__[] =
"<method>"
"   <header>"
"      <memberof>Asymmetric</memberof>"
"      <name>derWrite</name>"
"      <parameter>keytype</parameter>"
"   </header>"
"   <body>"
"      <para>"
"         This method is used to write <classname>Asymmetric</classname>"
"         objects out as strings.  The first argument should be either"
"         <constant>RSA_PUBLIC_KEY</constant> or "
"         <constant>RSA_PRIVATE_KEY</constant>."
"      </para>"
"   </body>"
"</method>"
;

static PyObject *
asymmetric_object_der_write(asymmetric_object *self, PyObject *args)
{
  int len = 0, key_type = 0;
  unsigned char *buf = NULL, *p = NULL;
  PyObject *asymmetric = NULL;

  if (!PyArg_ParseTuple(args, "|i", &key_type))
    goto error;

  if (key_type == 0)
    key_type = self->key_type;

  switch(key_type) {

  case RSA_PRIVATE_KEY:
    len = i2d_RSAPrivateKey(self->cipher, NULL);
    if ((buf = malloc(len)) == NULL)
      lose("could not allocate memory");
    p = buf;
    if (!i2d_RSAPrivateKey(self->cipher, &buf))
      lose("unable to write key");
    break;

  case RSA_PUBLIC_KEY:
    len = i2d_RSA_PUBKEY(self->cipher, NULL);
    if ((buf = malloc(len)) == NULL)
      lose("could not allocate memory");
    p = buf;
    if (!i2d_RSA_PUBKEY(self->cipher, &buf))
      lose("unable to write key");
    break;

  default:
    lose("unsupported key type");
  }

  asymmetric = Py_BuildValue("s#", p, len);

  free(p);
  return asymmetric;

 error:

  if (p)
    free(p);

  return NULL;
}

static char asymmetric_object_public_encrypt__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Asymmetric</memberof>\n"
"      <name>publicEncrypt</name>\n"
"      <parameter>plaintext</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to encrypt the <parameter>plaintext</parameter>\n"
"         using a public key. It should be noted; in practice this\n"
"         function would be used almost exclusively to encrypt symmetric cipher\n"
"         keys and not data since asymmetric cipher operations are very slow.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
asymmetric_object_public_encrypt(asymmetric_object *self, PyObject *args)
{
  unsigned char *plain_text = NULL, *cipher_text = NULL;
  int len = 0, size = 0;
  PyObject *obj = NULL;

  if (self->cipher_type != RSA_CIPHER)
    lose("unsupported cipher type");

  if (!PyArg_ParseTuple(args, "s#", &plain_text, &len))
    goto error;

  size = RSA_size(self->cipher);
  if (len > size)
    lose("plain text is too long");

  if ((cipher_text = malloc(size + 16)) == NULL)
    lose("could not allocate memory");

  if ((len = RSA_public_encrypt(len, plain_text, cipher_text, self->cipher, RSA_PKCS1_PADDING)) < 0)
    lose("could not encrypt plain text");

  obj = Py_BuildValue("s#", cipher_text, len);
  free(cipher_text);
  return obj;

 error:

  if (cipher_text)
    free(cipher_text);

  return NULL;
}

static char asymmetric_object_private_encrypt__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Asymmetric</memberof>\n"
"      <name>privateEncrypt</name>\n"
"      <parameter>plaintext</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to encrypt the <parameter>plaintext</parameter>\n"
"         using a private key. It should be noted; in practice this\n"
"         function would be used almost exclusively to encrypt symmetric cipher\n"
"         keys and not data since asymmetric cipher operations are very slow.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
asymmetric_object_private_encrypt(asymmetric_object *self, PyObject *args)
{
  unsigned char *plain_text = NULL, *cipher_text = NULL;
  int len = 0, size = 0;
  PyObject *obj = NULL;

  if (self->key_type != RSA_PRIVATE_KEY)
    lose("cannot perform private encryption with this key");

  if (!PyArg_ParseTuple(args, "s#", &plain_text, &len))
    goto error;

  size = RSA_size(self->cipher);
  if (len > size)
    lose("plain text is too long");

  if ((cipher_text = malloc(size + 16)) == NULL)
    lose("could not allocate memory");

  if ((len = RSA_private_encrypt(len, plain_text, cipher_text, self->cipher, RSA_PKCS1_PADDING)) < 0)
    lose("could not encrypt plain text");

  obj = Py_BuildValue("s#", cipher_text, len);
  free(cipher_text);
  return obj;

 error:

  if (cipher_text)
    free(cipher_text);

  return NULL;
}

static char asymmetric_object_public_decrypt__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Asymmetric</memberof>\n"
"      <name>publicDecrypt</name>\n"
"      <parameter>ciphertext</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to decrypt the\n"
"         <parameter>ciphertext</parameter> which has been encrypted\n"
"         using the corresponding private key and the\n"
"         <function>privateEncrypt</function> function.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
asymmetric_object_public_decrypt(asymmetric_object *self, PyObject *args)
{
  unsigned char *plain_text = NULL, *cipher_text = NULL;
  int len = 0, size = 0;
  PyObject *obj = NULL;

  if (self->cipher_type != RSA_CIPHER)
    lose("unsupported cipher type");

  if (!PyArg_ParseTuple(args, "s#", &cipher_text, &len))
    goto error;

  size = RSA_size(self->cipher);
  if (len > size)
    lose("cipher text is too long");

  if ((plain_text = malloc(size + 16)) == NULL)
    lose("could not allocate memory");

  if ((len = RSA_public_decrypt(len, cipher_text, plain_text, self->cipher, RSA_PKCS1_PADDING)) < 0)
    lose("could not decrypt cipher text");

  obj = Py_BuildValue("s#", plain_text, len);
  free(plain_text);
  return obj;

 error:

  if (plain_text)
    free(plain_text);

  return NULL;
}

static char asymmetric_object_private_decrypt__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Asymmetric</memberof>\n"
"      <name>privateDecrypt</name>\n"
"      <parameter>ciphertext</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to decrypt ciphertext which has been encrypted\n"
"         using the corresponding public key and the\n"
"         <function>publicEncrypt</function> function.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
asymmetric_object_private_decrypt(asymmetric_object *self, PyObject *args)
{
  unsigned char *plain_text = NULL, *cipher_text = NULL;
  int len = 0, size = 0;
  PyObject *obj = NULL;

  if (self->key_type != RSA_PRIVATE_KEY)
    lose("cannot perform private decryption with this key");

  if (!PyArg_ParseTuple(args, "s#", &cipher_text, &len))
    goto error;

  size = RSA_size(self->cipher);
  if (len > size)
    lose("cipher text is too long");

  if ((plain_text = malloc(size + 16)) == NULL)
    lose("could not allocate memory");

  if ((len = RSA_private_decrypt(len, cipher_text, plain_text, self->cipher, RSA_PKCS1_PADDING)) < 0)
    lose("could not decrypt cipher text");

  obj = Py_BuildValue("s#", plain_text, len);
  free(plain_text);
  return obj;

 error:

  if (plain_text)
    free(plain_text);
  return NULL;
}

static char asymmetric_object_sign__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Asymmetric</memberof>\n"
"      <name>sign</name>\n"
"      <parameter>digesttext</parameter>\n"
"      <parameter>digesttype</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to produce a signed digest text.\n"
"         This instance of\n"
"         <classname>Asymmetric</classname> should be a private key used for\n"
"         signing.  The parameter\n"
"         <parameter>digesttext</parameter> should be a digest of the\n"
"         data to protect against alteration and\n"
"         finally <parameter>digesttype</parameter> should be one of the\n"
"         following:\n"
"      </para>\n"
"      <simplelist>\n"
#ifndef OPENSSL_NO_MD2
"         <member><constant>MD2_DIGEST</constant></member>\n"
#endif
"         <member><constant>MD5_DIGEST</constant></member>\n"
"         <member><constant>SHA_DIGEST</constant></member>\n"
"         <member><constant>SHA1_DIGEST</constant></member>\n"
"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
"         <member><constant>SHA256_DIGEST</constant></member>\n"
"         <member><constant>SHA384_DIGEST</constant></member>\n"
"         <member><constant>SHA512_DIGEST</constant></member>\n"
"      </simplelist>\n"
"      <para>\n"
"         If the procedure was successful, a string containing the signed\n"
"         digest is returned.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
asymmetric_object_sign(asymmetric_object *self, PyObject *args)
{
  unsigned char *digest_text = NULL, *signed_text = NULL;
  unsigned int digest_len = 0, digest_type = 0, digest_nid = 0, signed_len = 0;
  PyObject *obj = NULL;

  if (!PyArg_ParseTuple(args, "s#i", &digest_text, &digest_len, &digest_type))
    goto error;

  if (self->key_type != RSA_PRIVATE_KEY)
    lose("unsupported key type");

  if ((signed_text = malloc(RSA_size(self->cipher))) == NULL)
    lose("could not allocate memory");

  switch(digest_type) {
#ifndef OPENSSL_NO_MD2
  case MD2_DIGEST:
    digest_nid = NID_md2;
    digest_len = MD2_DIGEST_LENGTH;
    break;
#endif
  case MD5_DIGEST:
    digest_nid = NID_md5;
    digest_len = MD5_DIGEST_LENGTH;
    break;
  case SHA_DIGEST:
    digest_nid = NID_sha;
    digest_len = SHA_DIGEST_LENGTH;
    break;
  case SHA1_DIGEST:
    digest_nid = NID_sha1;
    digest_len = SHA_DIGEST_LENGTH;
    break;
  case RIPEMD160_DIGEST:
    digest_nid = NID_ripemd160;
    digest_len = RIPEMD160_DIGEST_LENGTH;
    break;
  case SHA256_DIGEST:
    digest_nid = NID_sha256;
    digest_len = SHA256_DIGEST_LENGTH;
    break;
  case SHA384_DIGEST:
    digest_nid = NID_sha384;
    digest_len = SHA384_DIGEST_LENGTH;
    break;
  case SHA512_DIGEST:
    digest_nid = NID_sha512;
    digest_len = SHA512_DIGEST_LENGTH;
    break;
  default:
    lose("unsupported digest");
  }

  if (!RSA_sign(digest_nid, digest_text, digest_len, signed_text, &signed_len, self->cipher))
    lose("could not sign digest");

  obj = Py_BuildValue("s#", signed_text, signed_len);
  free(signed_text);
  return obj;

 error:

  if (signed_text)
    free(signed_text);

  return NULL;
}

static char asymmetric_object_verify__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Asymmetric</memberof>\n"
"      <name>verify</name>\n"
"      <parameter>signedtext</parameter>\n"
"      <parameter>digesttext</parameter>\n"
"      <parameter>digesttype</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to verify a signed digest text.\n"
"      </para>\n"
"       <example>\n"
"         <title><function>verify</function> method usage</title>\n"
"         <programlisting>\n"
"      plain_text = 'Hello World!'\n"
"      print '\tPlain text:', plain_text\n"
"      digest = POW.Digest(POW.RIPEMD160_DIGEST)\n"
"      digest.update(plain_text)\n"
"      print '\tDigest text:', digest.digest()\n"
"\n"
"      privateFile = open('test/private.key', 'r')\n"
"      privateKey = POW.pemRead(POW.RSA_PRIVATE_KEY, privateFile.read(), 'pass')\n"
"      privateFile.close()\n"
"      signed_text =  privateKey.sign(digest.digest(), POW.RIPEMD160_DIGEST)\n"
"      print '\tSigned text:', signed_text\n"
"\n"
"      digest2 = POW.Digest(POW.RIPEMD160_DIGEST)\n"
"      digest2.update(plain_text)\n"
"      publicFile = open('test/public.key', 'r')\n"
"      publicKey = POW.pemRead(POW.RSA_PUBLIC_KEY, publicFile.read())\n"
"      publicFile.close()\n"
"      if publicKey.verify(signed_text, digest2.digest(), POW.RIPEMD160_DIGEST):\n"
"         print 'Signing verified!'\n"
"      else:\n"
"         print 'Signing gone wrong!'\n"
"         </programlisting>\n"
"      </example>\n"
"      <para>\n"
"         The parameter <parameter>signedtext</parameter> should be a\n"
"         signed digest text.  This instance of\n"
"         <classname>Asymmetric</classname> should correspond to the private\n"
"         key used to sign the digest.  The parameter\n"
"         <parameter>digesttext</parameter> should be a digest of the same\n"
"         data used to produce the <parameter>signedtext</parameter> and\n"
"         finally <parameter>digesttype</parameter> should be one of the\n"
"         following:\n"
"      </para>\n"
"      <simplelist>\n"
#ifndef OPENSSL_NO_MD2
"         <member><constant>MD2_DIGEST</constant></member>\n"
#endif
"         <member><constant>MD5_DIGEST</constant></member>\n"
"         <member><constant>SHA_DIGEST</constant></member>\n"
"         <member><constant>SHA1_DIGEST</constant></member>\n"
"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
"         <member><constant>SHA256_DIGEST</constant></member>\n"
"         <member><constant>SHA384_DIGEST</constant></member>\n"
"         <member><constant>SHA512_DIGEST</constant></member>\n"
"      </simplelist>\n"
"      <para>\n"
"         If the procedure was successful, 1 is returned, otherwise 0 is\n"
"         returned.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
asymmetric_object_verify(asymmetric_object *self, PyObject *args)
{
  unsigned char *digest_text = NULL, *signed_text = NULL;
  int digest_len = 0, digest_type = 0, digest_nid = 0, signed_len = 0;

  if (!PyArg_ParseTuple(args, "s#s#i", &signed_text, &signed_len, &digest_text, &digest_len, &digest_type))
    goto error;

  switch (digest_type) {
#ifndef OPENSSL_NO_MD2
  case MD2_DIGEST:
    digest_len = MD2_DIGEST_LENGTH;
    digest_nid = NID_md2;
    break;
#endif
  case MD5_DIGEST:
    digest_len = MD5_DIGEST_LENGTH;
    digest_nid = NID_md5;
    break;
  case SHA_DIGEST:
    digest_len = SHA_DIGEST_LENGTH;
    digest_nid = NID_sha;
    break;
  case SHA1_DIGEST:
    digest_len = SHA_DIGEST_LENGTH;
    digest_nid = NID_sha1;
    break;
  case RIPEMD160_DIGEST:
    digest_len = RIPEMD160_DIGEST_LENGTH;
    digest_nid = NID_ripemd160;
    break;
  case SHA256_DIGEST:
    digest_len = SHA256_DIGEST_LENGTH;
    digest_nid = NID_sha256;
    break;
  case SHA384_DIGEST:
    digest_len = SHA384_DIGEST_LENGTH;
    digest_nid = NID_sha384;
    break;
  case SHA512_DIGEST:
    digest_len = SHA512_DIGEST_LENGTH;
    digest_nid = NID_sha512;
    break;
  default:
    lose("unsupported digest");
  }

  return PyBool_FromLong(RSA_verify(digest_nid, digest_text, digest_len, signed_text, signed_len, self->cipher));

 error:

  return NULL;
}

static struct PyMethodDef asymmetric_object_methods[] = {
  {"pemWrite",          (PyCFunction)asymmetric_object_pem_write,       METH_VARARGS,  NULL},
  {"derWrite",          (PyCFunction)asymmetric_object_der_write,       METH_VARARGS,  NULL},
  {"publicEncrypt",     (PyCFunction)asymmetric_object_public_encrypt,  METH_VARARGS,  NULL},
  {"privateEncrypt",    (PyCFunction)asymmetric_object_private_encrypt, METH_VARARGS,  NULL},
  {"privateDecrypt",    (PyCFunction)asymmetric_object_private_decrypt, METH_VARARGS,  NULL},
  {"publicDecrypt",     (PyCFunction)asymmetric_object_public_decrypt,  METH_VARARGS,  NULL},
  {"sign",              (PyCFunction)asymmetric_object_sign,            METH_VARARGS,  NULL},
  {"verify",            (PyCFunction)asymmetric_object_verify,          METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static PyObject *
asymmetric_object_getattr(asymmetric_object *self, char *name)
{
  return Py_FindMethod(asymmetric_object_methods, (PyObject *)self, name);
}

static void
asymmetric_object_dealloc(asymmetric_object *self, char *name)
{
  switch(self->cipher_type) {
  case RSA_CIPHER:
    RSA_free(self->cipher);
    break;
  }
  PyObject_Del(self);
}

static char asymmetrictype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>Asymmetric</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides access to RSA asymmetric ciphers in OpenSSL.\n"
"         Other ciphers will probably be supported in the future but this is\n"
"         not a priority.\n"
"      </para>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject asymmetrictype = {
   PyObject_HEAD_INIT(0)
   0,                                     /*ob_size*/
   "Asymmetric",                          /*tp_name*/
   sizeof(asymmetric_object),             /*tp_basicsize*/
   0,                                     /*tp_itemsize*/
   (destructor)asymmetric_object_dealloc, /*tp_dealloc*/
   (printfunc)0,                          /*tp_print*/
   (getattrfunc)asymmetric_object_getattr,   /*tp_getattr*/
   (setattrfunc)0,                        /*tp_setattr*/
   (cmpfunc)0,                            /*tp_compare*/
   (reprfunc)0,                           /*tp_repr*/
   0,                                     /*tp_as_number*/
   0,                                     /*tp_as_sequence*/
   0,                                     /*tp_as_mapping*/
   (hashfunc)0,                           /*tp_hash*/
   (ternaryfunc)0,                        /*tp_call*/
   (reprfunc)0,                           /*tp_str*/
   0,
   0,
   0,
   0,
   asymmetrictype__doc__                   /* Documentation string */
};
/*========== asymmetric Code ==========*/

/*========== symmetric Code ==========*/
static symmetric_object *
symmetric_object_new(int cipher_type)
{
  symmetric_object *self = NULL;

  if ((self = PyObject_New(symmetric_object, &symmetrictype)) == NULL)
    goto error;

  self->cipher_type = cipher_type;
  EVP_CIPHER_CTX_init(&self->cipher_ctx);

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static char symmetric_object_encrypt_init__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Symmetric</memberof>\n"
"      <name>encryptInit</name>\n"
"      <parameter>key</parameter>\n"
"      <parameter>initialvalue = ''</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method sets up the cipher object to start encrypting a stream\n"
"         of data.  The first parameter is the key used to encrypt the\n"
"         data.  The second, the <parameter>initialvalue</parameter> serves\n"
"         a similar purpose the the salt supplied to the Unix\n"
"         <function>crypt</function> function.\n"
"         The <parameter>initialvalue</parameter> is normally chosen at random and\n"
"         often transmitted with the encrypted data, its purpose is to prevent\n"
"         two identical plain texts resulting in two identical cipher texts.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
symmetric_object_encrypt_init(symmetric_object *self, PyObject *args)
{
  unsigned char *key = NULL, *iv = NULL, nulliv [] = "";
  const EVP_CIPHER *cipher = NULL;

  if (!PyArg_ParseTuple(args, "s|s", &key, &iv))
    goto error;

  if (!iv)
    iv = nulliv;

  if ((cipher = evp_cipher_factory(self->cipher_type)) == NULL)
    lose("unsupported cipher");

  if (!EVP_EncryptInit(&self->cipher_ctx, cipher, key, iv))
    lose("could not initialise cipher");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char symmetric_object_decrypt_init__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Symmetric</memberof>\n"
"      <name>decryptInit</name>\n"
"      <parameter>key</parameter>\n"
"      <parameter>initialvalue = ''</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method sets up the cipher object to start decrypting a stream\n"
"         of data.  The first value must be the key used to encrypt the\n"
"         data.  The second parameter is the <parameter>initialvalue</parameter>\n"
"         used to encrypt the data.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
symmetric_object_decrypt_init(symmetric_object *self, PyObject *args)
{
  unsigned char *key = NULL, *iv = NULL, nulliv [] = "";
  const EVP_CIPHER *cipher = NULL;

  if (!PyArg_ParseTuple(args, "s|s", &key, &iv))
    goto error;

  if (!iv)
    iv = nulliv;

  if ((cipher = evp_cipher_factory(self->cipher_type)) == NULL)
    lose("unsupported cipher");

  if (!EVP_DecryptInit(&self->cipher_ctx, cipher, key, iv))
    lose("could not initialise cipher");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char symmetric_object_update__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Symmetric</memberof>\n"
"      <name>update</name>\n"
"      <parameter>data</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method is used to process the bulk of data being encrypted\n"
"         or decrypted by the cipher object.  <parameter>data</parameter>\n"
"         should be a string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
symmetric_object_update(symmetric_object *self, PyObject *args)
{
  int inl = 0, outl = 0;
  unsigned char *in = NULL, *out = NULL;
  PyObject *py_out = NULL;

  if (!PyArg_ParseTuple(args, "s#", &in, &inl))
    goto error;

  if ((out = malloc(inl + EVP_CIPHER_CTX_block_size(&self->cipher_ctx))) == NULL)
    lose("could not allocate memory");

  if (!EVP_CipherUpdate(&self->cipher_ctx, out, &outl, in, inl))
    lose("could not update cipher");

  if ((py_out = Py_BuildValue("s#", out, outl)) == NULL)
    lose("could not allocate memory");

  free(out);
  return py_out;

 error:

  if (out)
    free(out);

  return NULL;
}

static char symmetric_object_final__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Symmetric</memberof>\n"
"      <name>final</name>\n"
"      <parameter>size = 1024</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         Most ciphers are block ciphers, that is they encrypt or decrypt a block of\n"
"         data at a time.  Often the data being processed will not fill an\n"
"         entire block, this method processes these half-empty blocks.  A\n"
"         string is returned of a maximum length <parameter>size</parameter>.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
symmetric_object_final(symmetric_object *self, PyObject *args)
{
  int outl = 0, size = 1024;
  unsigned char *out = NULL;
  PyObject *py_out = NULL;

  if (!PyArg_ParseTuple(args, "|i", &size))
    goto error;

  if ((out = malloc(size + EVP_CIPHER_CTX_block_size(&self->cipher_ctx))) == NULL)
    lose("could not allocate memory");

  if (!EVP_CipherFinal(&self->cipher_ctx, out, &outl))
    lose("could not update cipher");

  if ((py_out = Py_BuildValue("s#", out, outl)) == NULL)
    lose("could not allocate memory");

  free(out);
  return py_out;

 error:

  if (out)
    free(out);

  return NULL;
}

static struct PyMethodDef symmetric_object_methods[] = {
  {"encryptInit",   (PyCFunction)symmetric_object_encrypt_init,  METH_VARARGS,  NULL},
  {"decryptInit",   (PyCFunction)symmetric_object_decrypt_init,  METH_VARARGS,  NULL},
  {"update",        (PyCFunction)symmetric_object_update,        METH_VARARGS,  NULL},
  {"final",         (PyCFunction)symmetric_object_final,         METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static PyObject *
symmetric_object_getattr(symmetric_object *self, char *name)
{
  return Py_FindMethod(symmetric_object_methods, (PyObject *)self, name);
}

static void
symmetric_object_dealloc(symmetric_object *self, char *name)
{
  PyObject_Del(self);
}

static char symmetrictype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>Symmetric</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides access to all the symmetric ciphers in OpenSSL.\n"
"         Initialisation of the cipher structures is performed late, only\n"
"         when <function>encryptInit</function> or\n"
"         <function>decryptInit</function> is called, the\n"
"         constructor only records the cipher type.  It is possible to reuse\n"
"         the <classname>Symmetric</classname> objects by calling\n"
"         <function>encryptInit</function> or <function>decryptInit</function>\n"
"         again.\n"
"      </para>\n"
"      <example>\n"
"         <title><classname>Symmetric</classname> class usage</title>\n"
"         <programlisting>\n"
"      passphrase = 'my silly passphrase'\n"
"      md5 = POW.Digest(POW.MD5_DIGEST)\n"
"      md5.update(passphrase)\n"
"      password = md5.digest()[:8]\n"
"\n"
"      plaintext = 'cast test message'\n"
"      cast = POW.Symmetric(POW.CAST5_CFB)\n"
"      cast.encryptInit(password)\n"
"      ciphertext = cast.update(plaintext) + cast.final()\n"
"      print 'Cipher text:', ciphertext\n"
"\n"
"      cast.decryptInit(password)\n"
"      out = cast.update(ciphertext) + cast.final()\n"
"      print 'Deciphered text:', out\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject symmetrictype = {
  PyObject_HEAD_INIT(0)
  0,                                     /*ob_size*/
  "Symmetric",                              /*tp_name*/
  sizeof(symmetric_object),              /*tp_basicsize*/
  0,                                     /*tp_itemsize*/
  (destructor)symmetric_object_dealloc,  /*tp_dealloc*/
  (printfunc)0,                          /*tp_print*/
  (getattrfunc)symmetric_object_getattr, /*tp_getattr*/
  (setattrfunc)0,                        /*tp_setattr*/
  (cmpfunc)0,                            /*tp_compare*/
  (reprfunc)0,                           /*tp_repr*/
  0,                                     /*tp_as_number*/
  0,                                     /*tp_as_sequence*/
  0,                                     /*tp_as_mapping*/
  (hashfunc)0,                           /*tp_hash*/
  (ternaryfunc)0,                        /*tp_call*/
  (reprfunc)0,                           /*tp_str*/
  0,
  0,
  0,
  0,
  symmetrictype__doc__                    /* Documentation string */
};
/*========== symmetric Code ==========*/

/*========== digest Code ==========*/
static digest_object *
digest_object_new(int digest_type)
{
  digest_object *self = NULL;

  if ((self = PyObject_New(digest_object, &digesttype)) == NULL)
    goto error;

  switch(digest_type) {
#ifndef OPENSSL_NO_MD2
  case MD2_DIGEST:
    self->digest_type = MD2_DIGEST;
    EVP_DigestInit(&self->digest_ctx, EVP_md2());
    break;
#endif
  case MD5_DIGEST:
    self->digest_type = MD5_DIGEST;
    EVP_DigestInit(&self->digest_ctx, EVP_md5());
    break;
  case SHA_DIGEST:
    self->digest_type = SHA_DIGEST;
    EVP_DigestInit(&self->digest_ctx, EVP_sha());
    break;
  case SHA1_DIGEST:
    self->digest_type = SHA1_DIGEST;
    EVP_DigestInit(&self->digest_ctx, EVP_sha1());
    break;
  case RIPEMD160_DIGEST:
    self->digest_type = RIPEMD160_DIGEST;
    EVP_DigestInit(&self->digest_ctx, EVP_ripemd160());
    break;
  case SHA256_DIGEST:
    self->digest_type = SHA256_DIGEST;
    EVP_DigestInit(&self->digest_ctx, EVP_sha256());
    break;
  case SHA384_DIGEST:
    self->digest_type = SHA384_DIGEST;
    EVP_DigestInit(&self->digest_ctx, EVP_sha384());
    break;
  case SHA512_DIGEST:
    self->digest_type = SHA512_DIGEST;
    EVP_DigestInit(&self->digest_ctx, EVP_sha512());
    break;
  default:
    lose("unsupported digest");
  }

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static char digest_object_update__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Digest</memberof>\n"
"      <name>update</name>\n"
"      <parameter>data</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method updates the internal structures of the\n"
"         <classname>Digest</classname> object with <parameter>data</parameter>.\n"
"         <parameter>data</parameter> should be a string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
digest_object_update(digest_object *self, PyObject *args)
{
  char *data = NULL;
  int len = 0;

  if (!PyArg_ParseTuple(args, "s#", &data, &len))
    goto error;

  EVP_DigestUpdate(&self->digest_ctx, data, len);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char digest_object_copy__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Digest</memberof>\n"
"      <name>copy</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a copy of the <classname>Digest</classname>\n"
"         object.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
digest_object_copy(digest_object *self, PyObject *args)
{
  digest_object *new = NULL;

  if ((new = PyObject_New(digest_object, &digesttype)) == NULL)
    lose("could not allocate memory");

  new->digest_type = self->digest_type;
  if (!EVP_MD_CTX_copy(&new->digest_ctx, &self->digest_ctx))
    lose("could not copy digest");

  return (PyObject*)new;

 error:

  Py_XDECREF(new);
  return NULL;
}

static char digest_object_digest__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Digest</memberof>\n"
"      <name>digest</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the digest of all the data which has been\n"
"         processed.  This function can be called at any time and will not\n"
"         effect the internal structure of the <classname>digest</classname>\n"
"         object.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
digest_object_digest(digest_object *self, PyObject *args)
{
  unsigned char digest_text[EVP_MAX_MD_SIZE];
  void *md_copy = NULL;
  unsigned digest_len = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((md_copy = malloc(sizeof(EVP_MD_CTX))) == NULL)
    lose("could not allocate memory");

  if (!EVP_MD_CTX_copy(md_copy, &self->digest_ctx))
    lose("could not copy digest");

  EVP_DigestFinal(md_copy, digest_text, &digest_len);

  free(md_copy);

  return Py_BuildValue("s#", digest_text, digest_len);

 error:

  if (md_copy)
    free(md_copy);

  return NULL;
}

static struct PyMethodDef digest_object_methods[] = {
  {"update",           (PyCFunction)digest_object_update,  METH_VARARGS, NULL},
  {"digest",           (PyCFunction)digest_object_digest,  METH_VARARGS, NULL},
  {"copy",             (PyCFunction)digest_object_copy,    METH_VARARGS, NULL},

  {NULL}    /* sentinel */
};

static PyObject *
digest_object_getattr(digest_object *self, char *name)
{
  return Py_FindMethod(digest_object_methods, (PyObject *)self, name);
}

static void
digest_object_dealloc(digest_object *self, char *name)
{
  EVP_MD_CTX_cleanup(&self->digest_ctx);
  PyObject_Del(self);
}

static char digesttype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>Digest</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides access to the digest functionality of OpenSSL.\n"
"         It emulates the digest modules in the Python Standard Library but\n"
"         does not currently support the <function>hexdigest</function>\n"
"         function.\n"
"      </para>\n"
"      <example>\n"
"         <title><classname>digest</classname> class usage</title>\n"
"         <programlisting>\n"
"      plain_text = 'Hello World!'\n"
"      sha1 = POW.Digest(POW.SHA1_DIGEST)\n"
"      sha1.update(plain_text)\n"
"      print '\tPlain text: Hello World! =>', sha1.digest()\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject digesttype = {
  PyObject_HEAD_INIT(0)
  0,                                  /*ob_size*/
  "Digest",                           /*tp_name*/
  sizeof(digest_object),              /*tp_basicsize*/
  0,                                  /*tp_itemsize*/
  (destructor)digest_object_dealloc,  /*tp_dealloc*/
  (printfunc)0,                       /*tp_print*/
  (getattrfunc)digest_object_getattr, /*tp_getattr*/
  (setattrfunc)0,                     /*tp_setattr*/
  (cmpfunc)0,                         /*tp_compare*/
  (reprfunc)0,                        /*tp_repr*/
  0,                                  /*tp_as_number*/
  0,                                  /*tp_as_sequence*/
  0,                                  /*tp_as_mapping*/
  (hashfunc)0,                        /*tp_hash*/
  (ternaryfunc)0,                     /*tp_call*/
  (reprfunc)0,                        /*tp_str*/
  0,
  0,
  0,
  0,
  digesttype__doc__                   /* Documentation string */
};
/*========== digest Code ==========*/

/*========== hmac Code ==========*/
static hmac_object *
hmac_object_new(int digest_type, char *key, int key_len)
{
  hmac_object *self = NULL;
  const EVP_MD *md = NULL;

  if ((self = PyObject_New(hmac_object, &hmactype)) == NULL)
    goto error;

  switch (digest_type) {
#ifndef OPENSSL_NO_MD2
  case MD2_DIGEST:
    md = EVP_md2();
    break;
#endif
  case MD5_DIGEST:
    md = EVP_md5();
    break;
  case SHA_DIGEST:
    md = EVP_sha();
    break;
  case SHA1_DIGEST:
    md = EVP_sha1();
    break;
  case RIPEMD160_DIGEST:
    md = EVP_ripemd160();
    break;
  case SHA256_DIGEST:
    md = EVP_sha256();
    break;
  case SHA384_DIGEST:
    md = EVP_sha384();
    break;
  case SHA512_DIGEST:
    md = EVP_sha512();
    break;
  default:
    lose("unsupported digest");
  }

  HMAC_Init(&self->hmac_ctx, key, key_len, md);

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static char hmac_object_update__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Hmac</memberof>\n"
"      <name>update</name>\n"
"      <parameter>data</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method updates the internal structures of the\n"
"         <classname>Hmac</classname> object with <parameter>data</parameter>.\n"
"         <parameter>data</parameter> should be a string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
hmac_object_update(hmac_object *self, PyObject *args)
{
  unsigned char *data = NULL;
  int len = 0;

  if (!PyArg_ParseTuple(args, "s#", &data, &len))
    goto error;

  HMAC_Update(&self->hmac_ctx, data, len);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char hmac_object_copy__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Hmac</memberof>\n"
"      <name>copy</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a copy of the <classname>Hmac</classname>\n"
"         object.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
hmac_object_copy(hmac_object *self, PyObject *args)
{
  hmac_object *new = NULL;

  if ((new = PyObject_New(hmac_object, &hmactype)) == NULL)
    lose("could not allocate memory");

  memcpy(&new->hmac_ctx, &self->hmac_ctx, sizeof(HMAC_CTX));

  return (PyObject*) new;

 error:

  Py_XDECREF(new);
  return NULL;
}

static char hmac_object_mac__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>Hmac</memberof>\n"
"      <name>mac</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the MAC of all the data which has been\n"
"         processed.  This function can be called at any time and will not\n"
"         effect the internal structure of the <classname>Hmac</classname>\n"
"         object.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
hmac_object_mac(hmac_object *self, PyObject *args)
{
  unsigned char hmac_text[EVP_MAX_MD_SIZE];
  void *hmac_copy = NULL;
  unsigned int hmac_len = 0;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((hmac_copy = malloc(sizeof(HMAC_CTX))) == NULL)
    lose("could not allocate memory");

  memcpy(hmac_copy, &self->hmac_ctx, sizeof(HMAC_CTX));
  HMAC_Final(hmac_copy, hmac_text, &hmac_len);

  free(hmac_copy);
  return Py_BuildValue("s#", hmac_text, hmac_len);

 error:

  if (hmac_copy)
    free(hmac_copy);

  return NULL;
}


static struct PyMethodDef hmac_object_methods[] = {
  {"update",           (PyCFunction)hmac_object_update, METH_VARARGS,  NULL},
  {"mac",              (PyCFunction)hmac_object_mac,    METH_VARARGS,  NULL},
  {"copy",             (PyCFunction)hmac_object_copy,   METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static PyObject *
hmac_object_getattr(hmac_object *self, char *name)
{
  return Py_FindMethod(hmac_object_methods, (PyObject *)self, name);
}

static void
hmac_object_dealloc(hmac_object *self, char *name)
{
  PyObject_Del(self);
}

static char hmactype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>Hmac</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides access to the HMAC functionality of OpenSSL.\n"
"         HMAC's are a variant on digest based MACs, which have the\n"
"         interesting property of a provable level of security.  HMAC is\n"
"         discussed further in RFC 2104.\n"
"      </para>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject hmactype = {
   PyObject_HEAD_INIT(0)
   0,                                  /*ob_size*/
   "Hmac",                             /*tp_name*/
   sizeof(hmac_object),                /*tp_basicsize*/
   0,                                  /*tp_itemsize*/
   (destructor)hmac_object_dealloc,    /*tp_dealloc*/
   (printfunc)0,                       /*tp_print*/
   (getattrfunc)hmac_object_getattr,   /*tp_getattr*/
   (setattrfunc)0,                     /*tp_setattr*/
   (cmpfunc)0,                         /*tp_compare*/
   (reprfunc)0,                        /*tp_repr*/
   0,                                  /*tp_as_number*/
   0,                                  /*tp_as_sequence*/
   0,                                  /*tp_as_mapping*/
   (hashfunc)0,                        /*tp_hash*/
   (ternaryfunc)0,                     /*tp_call*/
   (reprfunc)0,                        /*tp_str*/
   0,
   0,
   0,
   0,
   hmactype__doc__                     /* Documentation string */
};
/*========== hmac Code ==========*/

/*========== CMS code ==========*/
static cms_object *
CMS_object_new(void)
{
  cms_object *self;

  if ((self = PyObject_New(cms_object, &cmstype)) == NULL)
    goto error;

  self->cms = NULL;
  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static cms_object *
CMS_object_pem_read(BIO *in)
{
  cms_object *self;

  if ((self = PyObject_New(cms_object, &cmstype)) == NULL)
    goto error;

  if ((self->cms = PEM_read_bio_CMS(in, NULL, NULL, NULL)) == NULL)
    lose("could not load PEM encoded CMS message");

  return self;

 error:

  Py_XDECREF(self);
  return NULL;
}

static cms_object *
CMS_object_der_read(char *src, int len)
{
  cms_object *self;
  BIO *bio = NULL;

  if ((self = PyObject_New(cms_object, &cmstype)) == NULL)
    goto error;

  self->cms = CMS_ContentInfo_new();

  if ((bio = BIO_new_mem_buf(src, len)) == NULL)
    goto error;

  if (!d2i_CMS_bio(bio, &self->cms))
    lose("could not load DER encoded CMS message");

  BIO_free(bio);

  return self;

 error:

  if (bio)
    BIO_free(bio);

  Py_XDECREF(self);
  return NULL;
}

static PyObject *
CMS_object_write_helper(cms_object *self, PyObject *args, int format)
{
  int len = 0;
  char *buf = NULL;
  BIO *out_bio = NULL;
  PyObject *cert = NULL;

  if (!PyArg_ParseTuple(args, ""))
    return NULL;

  out_bio = BIO_new(BIO_s_mem());

  switch (format) {

  case DER_FORMAT:
    if (!i2d_CMS_bio(out_bio, self->cms))
      lose("unable to write certificate");
    break;

  case PEM_FORMAT:
    if (!PEM_write_bio_CMS(out_bio, self->cms))
      lose("unable to write certificate");
    break;

  default:
    lose("internal error, unknown output format");
  }

  if ((len = BIO_ctrl_pending(out_bio)) == 0)
    lose("unable to get bytes stored in bio");

  if ((buf = malloc(len)) == NULL)
    lose("unable to allocate memory");

  if (BIO_read(out_bio, buf, len) != len)
    lose("unable to write out cert");

  cert = Py_BuildValue("s#", buf, len);

  BIO_free(out_bio);
  free(buf);
  return cert;

 error:

  if (out_bio)
    BIO_free(out_bio);

  if (buf)
    free(buf);

  Py_XDECREF(cert);
  return NULL;
}

static char CMS_object_pem_write__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>pemWrite</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a PEM encoded CMS message as a\n"
"         string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_pem_write(cms_object *self, PyObject *args)
{
  return CMS_object_write_helper(self, args, PEM_FORMAT);
}

static char CMS_object_der_write__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>derWrite</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a DER encoded CMS message as a\n"
"         string.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_der_write(cms_object *self, PyObject *args)
{
  return CMS_object_write_helper(self, args, DER_FORMAT);
}

static char CMS_object_sign__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>sign</name>\n"
"      <parameter>signcert</parameter>\n"
"      <parameter>key</parameter>\n"
"      <parameter>data</parameter>\n"
"      <optional>\n"
"        <parameter>certs</parameter>\n"
"        <parameter>crls</parameter>\n"
"        <parameter>eContentType</parameter>\n"
"        <parameter>flags</parameter>\n"
"      </optional>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method signs a message with a private key.\n"
"         Supported flags: CMS_NOCERTS, CMS_NOATTR.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_sign(cms_object *self, PyObject *args)
{
  asymmetric_object *signkey = NULL;
  x509_object *signcert = NULL;
  x509_crl_object *crlobj = NULL;
  PyObject *x509_sequence = Py_None, *crl_sequence = Py_None, *result = NULL;
  STACK_OF(X509) *x509_stack = NULL;
  EVP_PKEY *pkey = NULL;
  char *buf = NULL, *oid = NULL;
  int i, n, len;
  unsigned flags = 0;
  BIO *bio = NULL;
  CMS_ContentInfo *cms = NULL;
  ASN1_OBJECT *econtent_type = NULL;

  if (!PyArg_ParseTuple(args, "O!O!s#|OOsI",
                        &x509type, &signcert,
                        &asymmetrictype, &signkey,
                        &buf, &len,
                        &x509_sequence,
                        &crl_sequence,
                        &oid,
                        &flags))
    goto error;

  assert_no_unhandled_openssl_errors();

  flags &= CMS_NOCERTS | CMS_NOATTR;
  flags |= CMS_BINARY | CMS_NOSMIMECAP | CMS_PARTIAL | CMS_USE_KEYID;

  if (signkey->key_type != RSA_PRIVATE_KEY)
    lose("unsupported key type");

  if ((x509_stack = x509_helper_sequence_to_stack(x509_sequence)) == NULL)
    goto error;

  assert_no_unhandled_openssl_errors();

  if ((pkey = EVP_PKEY_new()) == NULL)
    lose_openssl_error("Could not allocate memory");

  assert_no_unhandled_openssl_errors();

  if (!EVP_PKEY_assign_RSA(pkey, signkey->cipher))
    lose_openssl_error("EVP_PKEY assignment error");

  assert_no_unhandled_openssl_errors();

  if ((bio = BIO_new_mem_buf(buf, len)) == NULL)
    goto error;

  assert_no_unhandled_openssl_errors();

  if (oid && (econtent_type = OBJ_txt2obj(oid, 0)) == NULL)
    lose_openssl_error("Could not parse OID");

  assert_no_unhandled_openssl_errors();

  if ((cms = CMS_sign(NULL, NULL, x509_stack, bio, flags)) == NULL)
    lose_openssl_error("Could not create CMS message");

  assert_no_unhandled_openssl_errors();

  if (econtent_type)
    CMS_set1_eContentType(cms, econtent_type);

  assert_no_unhandled_openssl_errors();

  if (!CMS_add1_signer(cms, signcert->x509, pkey, EVP_sha256(), flags))
    lose_openssl_error("Could not sign CMS message");

  pkey = NULL;                 /* CMS_add1_signer() now owns pkey */

  assert_no_unhandled_openssl_errors();

  if (crl_sequence != Py_None) {

    if (!PyTuple_Check(crl_sequence) && !PyList_Check(crl_sequence))
      lose_type_error("inapropriate type");

    n = PySequence_Size(crl_sequence);

    for (i = 0; i < n; i++) {

      if ((crlobj = (x509_crl_object *) PySequence_GetItem(crl_sequence, i)) == NULL)
        goto error;

      if (!X_X509_crl_Check(crlobj))
        lose_type_error("inappropriate type");

      if (!crlobj->crl)
        lose("CRL object with null crl field!");

      if (!CMS_add1_crl(cms, crlobj->crl))
        lose_openssl_error("Could not add CRL to CMS");

      assert_no_unhandled_openssl_errors();

      Py_XDECREF(crlobj);
      crlobj = NULL;
    }
  }

  if (!CMS_final(cms, bio, NULL, flags))
    lose_openssl_error("Could not finalize CMS signatures");

  assert_no_unhandled_openssl_errors();

  if (self->cms)
    CMS_ContentInfo_free(self->cms);
  self->cms = cms;
  cms = NULL;

  result = Py_BuildValue("");

 error:                          /* fall through */

  assert_no_unhandled_openssl_errors();

  if (cms)
    CMS_ContentInfo_free(cms);

  if (bio)
    BIO_free(bio);

  if (x509_stack)
    sk_X509_free(x509_stack);

  if (pkey)
    EVP_PKEY_free(pkey);

  if (econtent_type)
    ASN1_OBJECT_free(econtent_type);

  if (crlobj) {
    Py_XDECREF(crlobj);
  }

  return result;
}

static char CMS_object_verify__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>verify</name>\n"
"      <parameter>store</parameter>\n"
"      <optional>\n"
"        <parameter>certs</parameter>\n"
"        <parameter>flags</parameter>\n"
"      </optional>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method verifies a message against a trusted store.\n"
"         The optional certs parameter is a set of certificates to search\n"
"         for the signer's certificate.\n"
"         Supported flags: CMS_NOINTERN, CMS_NOCRL,\n"
"         CMS_NO_SIGNER_CERT_VERIFY, CMS_NO_ATTR_VERIFY,\n"
"         CMS_NO_CONTENT_VERIFY.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_verify(cms_object *self, PyObject *args)
{
  x509_store_object *store = NULL;
  PyObject *result = NULL, *certs_sequence = Py_None;
  STACK_OF(X509) *certs_stack = NULL;
  unsigned flags = 0;
  char *buf = NULL;
  BIO *bio = NULL;
  int len;

  if (!PyArg_ParseTuple(args, "O!|OI", &x509_storetype, &store, &certs_sequence, &flags))
    goto error;

  if ((bio = BIO_new(BIO_s_mem())) == NULL)
    goto error;

  assert_no_unhandled_openssl_errors();

  flags &= CMS_NOINTERN | CMS_NOCRL | CMS_NO_SIGNER_CERT_VERIFY | CMS_NO_ATTR_VERIFY | CMS_NO_CONTENT_VERIFY;

  if (certs_sequence != Py_None && (certs_stack = x509_helper_sequence_to_stack(certs_sequence)) == NULL)
    goto error;

  assert_no_unhandled_openssl_errors();

  if (CMS_verify(self->cms, certs_stack, store->store, NULL, bio, flags) <= 0)
    lose_openssl_error("Could not verify CMS message");

  assert_no_unhandled_openssl_errors();

  if ((len = BIO_ctrl_pending(bio)) == 0)
    lose("unable to get bytes stored in bio");

  assert_no_unhandled_openssl_errors();

  if ((buf = malloc(len)) == NULL)
    lose("unable to allocate memory");

  assert_no_unhandled_openssl_errors();

  if (BIO_read(bio, buf, len) != len)
    lose("unable to write out CMS content");

  assert_no_unhandled_openssl_errors();

  result = Py_BuildValue("s#", buf, len);

 error:                          /* fall through */

  assert_no_unhandled_openssl_errors();

  if (certs_stack)
    sk_X509_free(certs_stack);

  if (bio)
    BIO_free(bio);

  if (buf)
    free(buf);

  return result;
}

static char CMS_object_eContentType__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>get_eContentType</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the eContentType of a CMS message.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_eContentType(cms_object *self, PyObject *args)
{
  const ASN1_OBJECT *oid = NULL;
  PyObject *result = NULL;
  char buf[512];

  if (!PyArg_ParseTuple(args, ""))
    return NULL;

  if ((oid = CMS_get0_eContentType(self->cms)) == NULL)
    lose_openssl_error("Could not extract eContentType from CMS message");

  OBJ_obj2txt(buf, sizeof(buf), oid, 1);

  result = Py_BuildValue("s", buf);

 error:

  assert_no_unhandled_openssl_errors();

  return result;
}

static char CMS_object_signingTime__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>get_signingTime</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns the signingTime of a CMS message.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_signingTime(cms_object *self, PyObject *args)
{
  PyObject *result = NULL;
  STACK_OF(CMS_SignerInfo) *sis = NULL;
  CMS_SignerInfo *si = NULL;
  X509_ATTRIBUTE *xa = NULL;
  ASN1_TYPE *so = NULL;
  int i;

  if (!PyArg_ParseTuple(args, ""))
    return NULL;

  if ((sis = CMS_get0_SignerInfos(self->cms)) == NULL)
    lose("Could not extract signerInfos from CMS message[1]");

  if (sk_CMS_SignerInfo_num(sis) != 1)
    lose("Could not extract signerInfos from CMS message[2]");

  si = sk_CMS_SignerInfo_value(sis, 0);

  if ((i = CMS_signed_get_attr_by_NID(si, NID_pkcs9_signingTime, -1)) < 0)
    lose("Could not extract signerInfos from CMS message[3]");

  if ((xa = CMS_signed_get_attr(si, i)) == NULL)
    lose("Could not extract signerInfos from CMS message[4]");

  if (xa->single)
    lose("Could not extract signerInfos from CMS message[5]");

  if (sk_ASN1_TYPE_num(xa->value.set) != 1)
    lose("Could not extract signerInfos from CMS message[6]");

  if ((so = sk_ASN1_TYPE_value(xa->value.set, 0)) == NULL)
    lose("Could not extract signerInfos from CMS message[7]");

  switch (so->type) {
  case V_ASN1_UTCTIME:
    result = ASN1_TIME_to_Python(so->value.utctime);
    break;
  case V_ASN1_GENERALIZEDTIME:
    result = ASN1_TIME_to_Python(so->value.generalizedtime);
    break;
  default:
    lose("Could not extract signerInfos from CMS message[8]");
  }

 error:

  assert_no_unhandled_openssl_errors();

  return result;
}

static char CMS_object_pprint__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>pprint</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns a formatted string showing the information\n"
"         held in the certificate.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_pprint(cms_object *self, PyObject *args)
{
  int len = 0, ret = 0;
  char *buf = NULL;
  BIO *bio = NULL;
  PyObject *result = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  bio = BIO_new(BIO_s_mem());

  if (!CMS_ContentInfo_print_ctx(bio, self->cms, 0, NULL))
    lose("unable to pprint CMS");

  if ((len = BIO_ctrl_pending(bio)) == 0)
    lose("unable to get bytes stored in bio");

  if ((buf = malloc(len)) == NULL)
    lose("unable to allocate memory");

  if ((ret = BIO_read(bio, buf, len)) != len)
    lose("unable to pprint CMS");

  result = Py_BuildValue("s#", buf, len);

 error:                          /* fall through */

  assert_no_unhandled_openssl_errors();

  if (bio)
    BIO_free(bio);

  if (buf)
    free(buf);

  return result;
}


static PyObject *
cms_object_helper_get_cert(void *cert)
{
  x509_object *obj = PyObject_New(x509_object, &x509type);

  if (obj)
    obj->x509 = cert;

  return (PyObject *) obj;
}

static char CMS_object_certs__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>certs</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns any certs embedded in a CMS message.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_certs(cms_object *self, PyObject *args)
{
  STACK_OF(X509) *certs = NULL;
  PyObject *result = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((certs = CMS_get1_certs(self->cms)) != NULL)
    result = stack_to_tuple_helper(CHECKED_PTR_OF(STACK_OF(X509), certs),
                                   cms_object_helper_get_cert);
  else if (!ERR_peek_error())
    result = Py_BuildValue("()");
  else
    lose_openssl_error("Could not extract certs from CMS message");

 error:                          /* fall through */

  if (certs)
    sk_X509_pop_free(certs, X509_free);

  return result;
}

static PyObject *
cms_object_helper_get_crl(void *crl)
{
  x509_crl_object *obj = PyObject_New(x509_crl_object, &x509_crltype);

  if (obj)
    obj->crl = crl;

  return (PyObject *) obj;
}

static char CMS_object_crls__doc__[] =
"<method>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"      <name>crls</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This method returns any CRLs embedded in a CMS message.\n"
"      </para>\n"
"   </body>\n"
"</method>\n"
;

static PyObject *
CMS_object_crls(cms_object *self, PyObject *args)
{
  STACK_OF(X509_CRL) *crls = NULL;
  PyObject *result = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((crls = CMS_get1_crls(self->cms)) != NULL)
    result = stack_to_tuple_helper(CHECKED_PTR_OF(STACK_OF(X509_CRL), crls),
                                   cms_object_helper_get_crl);
  else if (!ERR_peek_error())
    result = Py_BuildValue("()");
  else
    lose_openssl_error("Could not extract CRLs from CMS message");

 error:                          /* fall through */

  if (crls)
    sk_X509_CRL_pop_free(crls, X509_CRL_free);

  return result;
}

static struct PyMethodDef CMS_object_methods[] = {
  {"pemWrite",     (PyCFunction)CMS_object_pem_write,    METH_VARARGS,  NULL},
  {"derWrite",     (PyCFunction)CMS_object_der_write,    METH_VARARGS,  NULL},
  {"sign",         (PyCFunction)CMS_object_sign,         METH_VARARGS,  NULL},
  {"verify",       (PyCFunction)CMS_object_verify,       METH_VARARGS,  NULL},
  {"eContentType", (PyCFunction)CMS_object_eContentType, METH_VARARGS,  NULL},
  {"signingTime",  (PyCFunction)CMS_object_signingTime,  METH_VARARGS,  NULL},
  {"pprint",       (PyCFunction)CMS_object_pprint,       METH_VARARGS,  NULL},
  {"certs",        (PyCFunction)CMS_object_certs,        METH_VARARGS,  NULL},
  {"crls",         (PyCFunction)CMS_object_crls,         METH_VARARGS,  NULL},

  {NULL}    /* sentinel */
};

static PyObject *
CMS_object_getattr(cms_object *self, char *name)
{
  return Py_FindMethod(CMS_object_methods, (PyObject *)self, name);
}

static void
CMS_object_dealloc(cms_object *self, char *name)
{
  CMS_ContentInfo_free(self->cms);
  PyObject_Del(self);
}

static char cmstype__doc__[] =
"<class>\n"
"   <header>\n"
"      <name>CMS</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This class provides basic access OpenSSL's CMS functionality.\n"
"      </para>\n"
"   </body>\n"
"</class>\n"
;

static PyTypeObject cmstype = {
   PyObject_HEAD_INIT(0)
   0,                                  /*ob_size*/
   "CMS",                              /*tp_name*/
   sizeof(cms_object),                 /*tp_basicsize*/
   0,                                  /*tp_itemsize*/
   (destructor)CMS_object_dealloc,     /*tp_dealloc*/
   (printfunc)0,                       /*tp_print*/
   (getattrfunc)CMS_object_getattr,    /*tp_getattr*/
   (setattrfunc)0,                     /*tp_setattr*/
   (cmpfunc)0,                         /*tp_compare*/
   (reprfunc)0,                        /*tp_repr*/
   0,                                  /*tp_as_number*/
   0,                                  /*tp_as_sequence*/
   0,                                  /*tp_as_mapping*/
   (hashfunc)0,                        /*tp_hash*/
   (ternaryfunc)0,                     /*tp_call*/
   (reprfunc)0,                        /*tp_str*/
   0,
   0,
   0,
   0,
   cmstype__doc__                    /* Documentation string */
};
/*========== CMS Code ==========*/

/*========== module functions ==========*/
static char pow_module_new_ssl__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>Ssl</memberof>\n"
"      <parameter>protocol = SSLV23METHOD</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor creates a new <classname>Ssl</classname> object which will behave as a client\n"
"         or server, depending on the <parameter>protocol</parameter> value passed.  The\n"
"         <parameter>protocol</parameter> also determines the protocol type\n"
"         and version and should be one of the following:\n"
"      </para>\n"
"\n"
"      <simplelist>\n"
"         <member><constant>SSLV2_SERVER_METHOD</constant></member>\n"
"         <member><constant>SSLV2_CLIENT_METHOD</constant></member>\n"
"         <member><constant>SSLV2_METHOD</constant></member>\n"
"         <member><constant>SSLV3_SERVER_METHOD</constant></member>\n"
"         <member><constant>SSLV3_CLIENT_METHOD</constant></member>\n"
"         <member><constant>SSLV3_METHOD</constant></member>\n"
"         <member><constant>TLSV1_SERVER_METHOD</constant></member>\n"
"         <member><constant>TLSV1_CLIENT_METHOD</constant></member>\n"
"         <member><constant>TLSV1_METHOD</constant></member>\n"
"         <member><constant>SSLV23_SERVER_METHOD</constant></member>\n"
"         <member><constant>SSLV23_CLIENT_METHOD</constant></member>\n"
"         <member><constant>SSLV23_METHOD</constant></member>\n"
"      </simplelist>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_ssl (PyObject *self, PyObject *args)
{
  ssl_object *ssl = NULL;
  int ctxtype = SSLV23_METHOD;

  if (!PyArg_ParseTuple(args, "|i", &ctxtype))
    goto error;

  if ((ssl = newssl_object(ctxtype)) == NULL)
    goto error;

  return (PyObject*) ssl;

 error:

  return NULL;
}

static char pow_module_new_x509__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>X509</memberof>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor creates a skeletal X509 certificate object.\n"
"         It won't be any use at all until several structures\n"
"         have been created using it's member functions.\n"
"      </para>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_x509 (PyObject *self, PyObject *args)
{
  x509_object *x509 = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((x509 = X509_object_new()) == NULL)
    lose("could not create new x509 object");

  return (PyObject*)x509;

 error:

  return NULL;
}

static char pow_module_new_asymmetric__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>Asymmetric</memberof>\n"
"      <parameter>ciphertype = RSA_CIPHER</parameter>\n"
"      <parameter>keylength = 1024</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor builds a new cipher object.  Only RSA ciphers\n"
"         are currently support, so the first argument should always be\n"
"         <constant>RSA_CIPHER</constant>.  The second argument,\n"
"         <parameter>keylength</parameter>,\n"
"         is normally 512, 768, 1024 or 2048.  Key lengths as short as 512\n"
"         bits are generally considered weak, and can be cracked by\n"
"         determined attackers without tremendous expense.\n"
"      </para>\n"
"      <example>\n"
"         <title><classname>asymmetric</classname> class usage</title>\n"
"         <programlisting>\n"
"      privateFile = open('test/private.key', 'w')\n"
"      publicFile = open('test/public.key', 'w')\n"
"\n"
"      passphrase = 'my silly passphrase'\n"
"      md5 = POW.Digest(POW.MD5_DIGEST)\n"
"      md5.update(passphrase)\n"
"      password = md5.digest()\n"
"\n"
"      rsa = POW.Asymmetric(POW.RSA_CIPHER, 1024)\n"
"      privateFile.write(rsa.pemWrite(\n"
"               POW.RSA_PRIVATE_KEY, POW.DES_EDE3_CFB, password))\n"
"      publicFile.write(rsa.pemWrite(POW.RSA_PUBLIC_KEY))\n"
"\n"
"      privateFile.close()\n"
"      publicFile.close()\n"
"         </programlisting>\n"
"      </example>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_asymmetric (PyObject *self, PyObject *args)
{
  int cipher_type = RSA_CIPHER, key_size = 1024;

  if (!PyArg_ParseTuple(args, "|ii", &cipher_type, &key_size))
    goto error;

  return (PyObject*) asymmetric_object_new(cipher_type, key_size);

 error:

  return NULL;
}

static char pow_module_new_digest__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>Digest</memberof>\n"
"      <parameter>type</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor creates a new <classname>Digest</classname>\n"
"         object.  The parameter <parameter>type</parameter> specifies what kind\n"
"         of digest to create and should be one of the following:\n"
"      </para>\n"
"      <simplelist>\n"
#ifndef OPENSSL_NO_MD2
"         <member><constant>MD2_DIGEST</constant></member>\n"
#endif
"         <member><constant>MD5_DIGEST</constant></member>\n"
"         <member><constant>SHA_DIGEST</constant></member>\n"
"         <member><constant>SHA1_DIGEST</constant></member>\n"
"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
"         <member><constant>SHA256_DIGEST</constant></member>\n"
"         <member><constant>SHA384_DIGEST</constant></member>\n"
"         <member><constant>SHA512_DIGEST</constant></member>\n"
"      </simplelist>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_digest (PyObject *self, PyObject *args)
{
  int digest_type = 0;

  if (!PyArg_ParseTuple(args, "i", &digest_type))
    goto error;

  return (PyObject*) digest_object_new(digest_type);

 error:

  return NULL;
}

static char pow_module_new_hmac__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>Hmac</memberof>\n"
"      <parameter>type</parameter>\n"
"      <parameter>key</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor creates a new <classname>Hmac</classname>\n"
"         object.  The parameter <parameter>key</parameter> should be a\n"
"         string and <parameter>type</parameter> should be one of the following:\n"
"      </para>\n"
"      <simplelist>\n"
#ifndef OPENSSL_NO_MD2
"         <member><constant>MD2_DIGEST</constant></member>\n"
#endif
"         <member><constant>MD5_DIGEST</constant></member>\n"
"         <member><constant>SHA_DIGEST</constant></member>\n"
"         <member><constant>SHA1_DIGEST</constant></member>\n"
"         <member><constant>RIPEMD160_DIGEST</constant></member>\n"
"         <member><constant>SHA256_DIGEST</constant></member>\n"
"         <member><constant>SHA384_DIGEST</constant></member>\n"
"         <member><constant>SHA512_DIGEST</constant></member>\n"
"      </simplelist>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_hmac (PyObject *self, PyObject *args)
{
  int digest_type = 0, key_len = 0;
  char *key = NULL;

  if (!PyArg_ParseTuple(args, "is#", &digest_type, &key, &key_len))
    goto error;

  return (PyObject*) hmac_object_new(digest_type, key, key_len);

 error:

  return NULL;
}

static char pow_module_new_cms__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>CMS</memberof>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor creates a skeletal CMS object.\n"
"      </para>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_cms (PyObject *self, PyObject *args)
{
  cms_object *cms = NULL;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  if ((cms = CMS_object_new()) == NULL)
    lose("could not create new CMS object");

  return (PyObject*)cms;

 error:

  return NULL;
}

static char pow_module_pem_read__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>pemRead</name>\n"
"      <parameter>type</parameter>\n"
"      <parameter>string</parameter>\n"
"      <parameter>pass = None</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function attempts to parse the <parameter>string</parameter> according to the PEM\n"
"         type passed. <parameter>type</parameter> should be one of the\n"
"         following:\n"
"      </para>\n"
"      <simplelist>\n"
"         <member><constant>RSA_PUBLIC_KEY</constant></member>\n"
"         <member><constant>RSA_PRIVATE_KEY</constant></member>\n"
"         <member><constant>X509_CERTIFICATE</constant></member>\n"
"         <member><constant>X509_CRL</constant></member>\n"
"         <member><constant>CMS_MESSAGE</constant></member>\n"
"      </simplelist>\n"
"      <para>\n"
"         <parameter>pass</parameter> should only be provided if an encrypted\n"
"         <classname>Asymmetric</classname> is being loaded.  If the password\n"
"         is incorrect an exception will be raised, if no password is provided\n"
"         and the PEM file is encrypted the user will be prompted.  If this is\n"
"         not desirable, always supply a password.  The object returned will be\n"
"         and instance of <classname>Asymmetric</classname>,\n"
"         <classname>X509</classname>, <classname>X509Crl</classname>,\n"
"         or <classname>CMS</classname>.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_pem_read (PyObject *self, PyObject *args)
{
  BIO *in = NULL;
  PyObject *obj = NULL;
  int object_type = 0, len = 0;
  char *pass = NULL, *src = NULL;

  if (!PyArg_ParseTuple(args, "is#|s", &object_type, &src, &len, &pass))
    goto error;

  if ((in = BIO_new_mem_buf(src, len)) == NULL)
    lose("unable to create new BIO");

  switch(object_type) {
  case RSA_PRIVATE_KEY:
    obj = (PyObject*)asymmetric_object_pem_read(object_type, in, pass);
    break;
  case RSA_PUBLIC_KEY:
    obj = (PyObject*)asymmetric_object_pem_read(object_type, in, pass);
    break;
  case X509_CERTIFICATE:
    obj = (PyObject*)X509_object_pem_read(in);
    break;
  case X_X509_CRL:
    obj = (PyObject*)x509_crl_object_pem_read(in);
    break;
  case CMS_MESSAGE:
    obj = (PyObject*)CMS_object_pem_read(in);
    break;
  default:
    lose("unknown pem encoding");
  }

  BIO_free(in);

  if (obj)
    return obj;

 error:

  return NULL;
}


static char pow_module_der_read__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>derRead</name>\n"
"      <parameter>type</parameter>\n"
"      <parameter>string</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function attempts to parse the <parameter>string</parameter> according to the PEM\n"
"         type passed. <parameter>type</parameter> should be one of the\n"
"         following:\n"
"      </para>\n"
"      <simplelist>\n"
"         <member><constant>RSA_PUBLIC_KEY</constant></member>\n"
"         <member><constant>RSA_PRIVATE_KEY</constant></member>\n"
"         <member><constant>X509_CERTIFICATE</constant></member>\n"
"         <member><constant>X509_CRL</constant></member>\n"
"         <member><constant>CMS_MESSAGE</constant></member>\n"
"      </simplelist>\n"
"      <para>\n"
"         As with the PEM operations, the object returned will be and instance\n"
"         of <classname>Asymmetric</classname>, <classname>X509</classname>,\n"
"         <classname>X509Crl</classname>, or <classname>CMS</classname>.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_der_read (PyObject *self, PyObject *args)
{
  PyObject *obj = NULL;
  int object_type = 0, len = 0;
  unsigned char *src = NULL;

  if (!PyArg_ParseTuple(args, "is#", &object_type, &src, &len))
    goto error;

  switch(object_type) {
  case RSA_PRIVATE_KEY:
    obj = (PyObject*) asymmetric_object_der_read(object_type, src, len);
    break;
  case RSA_PUBLIC_KEY:
    obj = (PyObject*) asymmetric_object_der_read(object_type, src, len);
    break;
  case X509_CERTIFICATE:
    obj = (PyObject*)X509_object_der_read(src, len);
    break;
  case X_X509_CRL:
    obj = (PyObject*)x509_crl_object_der_read(src, len);
    break;
  case CMS_MESSAGE:
    obj = (PyObject*)CMS_object_der_read((char *) src, len);
    break;
  default:
    lose("unknown der encoding");
  }

  if (obj)
    return obj;

 error:

  return NULL;
}

static char pow_module_new_x509_store__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>X509Store</memberof>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor takes no arguments.  The\n"
"         <classname>X509Store</classname> returned cannot be used for\n"
"         verifying certificates until at least one trusted certificate has been\n"
"         added.\n"
"      </para>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_x509_store (PyObject *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  return (PyObject *) x509_store_object_new();

 error:

  return NULL;
}

static char pow_module_new_symmetric__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>Symmetric</memberof>\n"
"      <parameter>type</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor creates a new <classname>Symmetric</classname>\n"
"         object.  The parameter <parameter>type</parameter> specifies which kind\n"
"         of cipher to create. <constant>type</constant> should be one of the following:\n"
"      </para>\n"
"      <simplelist columns = \"2\">\n"
"         <member><constant>DES_ECB</constant></member>\n"
"         <member><constant>DES_EDE</constant></member>\n"
"         <member><constant>DES_EDE3</constant></member>\n"
"         <member><constant>DES_CFB</constant></member>\n"
"         <member><constant>DES_EDE_CFB</constant></member>\n"
"         <member><constant>DES_EDE3_CFB</constant></member>\n"
"         <member><constant>DES_OFB</constant></member>\n"
"         <member><constant>DES_EDE_OFB</constant></member>\n"
"         <member><constant>DES_EDE3_OFB</constant></member>\n"
"         <member><constant>DES_CBC</constant></member>\n"
"         <member><constant>DES_EDE_CBC</constant></member>\n"
"         <member><constant>DES_EDE3_CBC</constant></member>\n"
"         <member><constant>DESX_CBC</constant></member>\n"
"         <member><constant>RC4</constant></member>\n"
"         <member><constant>RC4_40</constant></member>\n"
"         <member><constant>IDEA_ECB</constant></member>\n"
"         <member><constant>IDEA_CFB</constant></member>\n"
"         <member><constant>IDEA_OFB</constant></member>\n"
"         <member><constant>IDEA_CBC</constant></member>\n"
"         <member><constant>RC2_ECB</constant></member>\n"
"         <member><constant>RC2_CBC</constant></member>\n"
"         <member><constant>RC2_40_CBC</constant></member>\n"
"         <member><constant>RC2_CFB</constant></member>\n"
"         <member><constant>RC2_OFB</constant></member>\n"
"         <member><constant>BF_ECB</constant></member>\n"
"         <member><constant>BF_CBC</constant></member>\n"
"         <member><constant>BF_CFB</constant></member>\n"
"         <member><constant>BF_OFB</constant></member>\n"
"         <member><constant>CAST5_ECB</constant></member>\n"
"         <member><constant>CAST5_CBC</constant></member>\n"
"         <member><constant>CAST5_CFB</constant></member>\n"
"         <member><constant>CAST5_OFB</constant></member>\n"
"         <member><constant>RC5_32_12_16_CBC</constant></member>\n"
"         <member><constant>RC5_32_12_16_CFB</constant></member>\n"
"         <member><constant>RC5_32_12_16_ECB</constant></member>\n"
"         <member><constant>RC5_32_12_16_OFB</constant></member>\n"
"      </simplelist>\n"
"      <para>\n"
"         Please note your version of OpenSSL might not have been compiled with\n"
"         all the ciphers listed above.  If that is the case, which is very\n"
"         likely if you are using a stock binary, the unsuported ciphers will not even\n"
"         be in the module namespace.\n"
"      </para>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_symmetric (PyObject *self, PyObject *args)
{
  int cipher_type = 0;

  if (!PyArg_ParseTuple(args, "i", &cipher_type))
    goto error;

  return (PyObject *) symmetric_object_new(cipher_type);

 error:

  return NULL;
}

static char pow_module_new_x509_crl__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>x509_crl</memberof>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor builds an empty CRL.\n"
"      </para>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_x509_crl (PyObject *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  return (PyObject *) x509_crl_object_new();

 error:

  return NULL;
}

static char pow_module_new_x509_revoked__doc__[] =
"<constructor>\n"
"   <header>\n"
"      <memberof>X509Revoked</memberof>\n"
"      <parameter>serial</parameter>\n"
"      <parameter>date</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This constructor builds a X509 Revoked structure.  <parameter>serial</parameter>\n"
"         should be an integer and <parameter>date</parameter> should be and\n"
"         UTCTime string.\n"
"      </para>\n"
"   </body>\n"
"</constructor>\n"
;

static PyObject *
pow_module_new_x509_revoked (PyObject *self, PyObject *args)
{
  int serial = -1;
  char *date = NULL;
  x509_revoked_object *revoke = NULL;

  if (!PyArg_ParseTuple(args, "|is", &serial, &date))
    goto error;

  revoke = x509_revoked_object_new();
  if (serial != -1 && !ASN1_INTEGER_set(revoke->revoked->serialNumber, serial))
    lose("unable to set serial number");

  if (date != NULL && !python_ASN1_TIME_set_string(revoke->revoked->revocationDate, date))
    lose_type_error("Could not set revocationDate");

  return (PyObject*) revoke;

 error:

  return NULL;
}

static char pow_module_add_object__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>addObject</name>\n"
"      <parameter>oid</parameter>\n"
"      <parameter>shortName</parameter>\n"
"      <parameter>longName</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function can be used to dynamically add new objects to\n"
"         OpenSSL.  The <parameter>oid</parameter> should be a string of space separated numbers\n"
"         and <parameter>shortName</parameter> and\n"
"         <parameter>longName</parameter> are the names of the object, ie\n"
"         'cn' and 'commonName'.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_add_object(PyObject *self, PyObject *args)
{
  char *oid = NULL, *sn = NULL, *ln = NULL;

  if (!PyArg_ParseTuple(args, "sss", &oid, &sn, &ln))
    goto error;

  if (!OBJ_create(oid, sn, ln))
    lose("unable to add object");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char pow_module_get_error__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>getError</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         Pops an error off the global error stack and returns it as a string.\n"
"         Returns None if the global error stack is empty.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_get_error(PyObject *self, PyObject *args)
{
  unsigned long error;
  char buf[256];

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  error = ERR_get_error();

  if (!error)
    Py_RETURN_NONE;

  ERR_error_string_n(error, buf, sizeof(buf));

  return Py_BuildValue("s", buf);

 error:

  return NULL;
}

static char pow_module_clear_error__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>clearError</name>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         Removes all errors from the global error stack.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_clear_error(PyObject *self, PyObject *args)
{
  if (!PyArg_ParseTuple(args, ""))
    goto error;

  ERR_clear_error();

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char pow_module_seed__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>seed</name>\n"
"      <parameter>data</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         The <function>seed</function> function adds data to OpenSSLs PRNG\n"
"         state.  It is often said the hardest part of cryptography is\n"
"         getting good random data, after all if you don't have good random\n"
"         data, a 1024 bit key is no better than a 512 bit key and neither\n"
"         would provide protection from a targeted brute force attack.\n"
"         The <function>seed</function> and <function>add</function> are very\n"
"         similar, except the entropy of the data is assumed to be equal to\n"
"         the length for <function>seed</function>.  One final point to be aware\n"
"         of, only systems which support /dev/urandom are automatically seeded.\n"
"         If your system does not support /dev/urandom it is your responsibility\n"
"         to seed OpenSSL's PRNG.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_seed(PyObject *self, PyObject *args)
{
  char *in = NULL;
  int inl = 0;

  if (!PyArg_ParseTuple(args, "s#", &in, &inl))
    goto error;

  RAND_seed(in, inl);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char pow_module_add__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>add</name>\n"
"      <parameter>data</parameter>\n"
"      <parameter>entropy</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         The <function>add</function> function adds data to OpenSSLs PRNG\n"
"         state.  <parameter>data</parameter> should be data obtained from a\n"
"         random source and <parameter>entropy</parameter> is an estimation of the number of random\n"
"         bytes in <parameter>data</parameter>.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_add(PyObject *self, PyObject *args)
{
  char *in = NULL;
  int inl = 0;
  double entropy = 0;

  if (!PyArg_ParseTuple(args, "s#d", &in, &inl, &entropy))
    goto error;

  RAND_add(in, inl, entropy);

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char pow_module_write_random_file__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>writeRandomFile</name>\n"
"      <parameter>filename</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function writes the current random state to a file.  Clearly\n"
"         this function should be used in conjunction with\n"
"         <function>readRandomFile</function>.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_write_random_file(PyObject *self, PyObject *args)
{
  char *file = NULL;

  if (!PyArg_ParseTuple(args, "s", &file))
    goto error;

  if (RAND_write_file(file) == -1)
    lose("could not write random file");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static char pow_module_read_random_file__doc__[] =
"<modulefunction>\n"
"   <header>\n"
"      <name>readRandomFile</name>\n"
"      <parameter>filename</parameter>\n"
"   </header>\n"
"   <body>\n"
"      <para>\n"
"         This function reads a previously saved random state.  It can be very\n"
"         useful to improve the quality of random data used by an application.\n"
"         The random data should be added to, using the\n"
"         <function>add</function> function, with data from other\n"
"         suitable random sources.\n"
"      </para>\n"
"   </body>\n"
"</modulefunction>\n"
;

static PyObject *
pow_module_read_random_file(PyObject *self, PyObject *args)
{
  char *file = NULL;
  int len = -1;

  if (!PyArg_ParseTuple(args, "s|i", &file, &len))
    goto error;

  if (!RAND_load_file(file, len))
    lose("could not load random file");

  Py_RETURN_NONE;

 error:

  return NULL;
}

static PyObject *
pow_module_docset(PyObject *self, PyObject *args)
{
  PyObject *docset;

  if (!PyArg_ParseTuple(args, ""))
    goto error;

  docset = PyList_New(0);

  // module documentation
  docset_helper_add(docset, pow_module__doc__);

  // constructors
  docset_helper_add(docset, pow_module_new_symmetric__doc__);
  docset_helper_add(docset, pow_module_new_asymmetric__doc__);
  docset_helper_add(docset, pow_module_new_digest__doc__);
  docset_helper_add(docset, pow_module_new_hmac__doc__);
  docset_helper_add(docset, pow_module_new_ssl__doc__);
  docset_helper_add(docset, pow_module_new_x509__doc__);
  docset_helper_add(docset, pow_module_new_x509_store__doc__);
  docset_helper_add(docset, pow_module_new_x509_crl__doc__);
  docset_helper_add(docset, pow_module_new_x509_revoked__doc__);
  docset_helper_add(docset, pow_module_new_cms__doc__);

  // functions
  docset_helper_add(docset, pow_module_pem_read__doc__);
  docset_helper_add(docset, pow_module_der_read__doc__);
  docset_helper_add(docset, pow_module_seed__doc__);
  docset_helper_add(docset, pow_module_add__doc__);
  docset_helper_add(docset, pow_module_read_random_file__doc__);
  docset_helper_add(docset, pow_module_write_random_file__doc__);
  docset_helper_add(docset, pow_module_get_error__doc__);
  docset_helper_add(docset, pow_module_clear_error__doc__);
  docset_helper_add(docset, pow_module_add_object__doc__);

  // ssl documentation
  docset_helper_add(docset, ssltype__doc__);
  docset_helper_add(docset, ssl_object_set_fd__doc__);
  docset_helper_add(docset, ssl_object_fileno__doc__);
  docset_helper_add(docset, ssl_object_accept__doc__);
  docset_helper_add(docset, ssl_object_connect__doc__);
  docset_helper_add(docset, ssl_object_write__doc__);
  docset_helper_add(docset, ssl_object_read__doc__);
  docset_helper_add(docset, ssl_object_peer_certificate__doc__);
  docset_helper_add(docset, ssl_object_use_certificate__doc__);
  docset_helper_add(docset, ssl_object_use_key__doc__);
  docset_helper_add(docset, ssl_object_check_key__doc__);
  docset_helper_add(docset, ssl_object_clear__doc__);
  docset_helper_add(docset, ssl_object_shutdown__doc__);
  docset_helper_add(docset, ssl_object_get_shutdown__doc__);
  docset_helper_add(docset, ssl_object_get_ciphers__doc__);
  docset_helper_add(docset, ssl_object_set_ciphers__doc__);
  docset_helper_add(docset, ssl_object_get_cipher__doc__);
  docset_helper_add(docset, ssl_object_set_verify_mode__doc__);

  // x509 documentation
  docset_helper_add(docset, x509type__doc__);
  docset_helper_add(docset, X509_object_pem_write__doc__);
  docset_helper_add(docset, X509_object_der_write__doc__);
  docset_helper_add(docset, X509_object_sign__doc__);
  docset_helper_add(docset, X509_object_set_public_key__doc__);
  docset_helper_add(docset, X509_object_get_version__doc__);
  docset_helper_add(docset, X509_object_set_version__doc__);
  docset_helper_add(docset, X509_object_get_serial__doc__);
  docset_helper_add(docset, X509_object_set_serial__doc__);
  docset_helper_add(docset, X509_object_get_issuer__doc__);
  docset_helper_add(docset, X509_object_set_issuer__doc__);
  docset_helper_add(docset, X509_object_get_subject__doc__);
  docset_helper_add(docset, X509_object_set_subject__doc__);
  docset_helper_add(docset, X509_object_get_not_before__doc__);
  docset_helper_add(docset, X509_object_set_not_before__doc__);
  docset_helper_add(docset, X509_object_get_not_after__doc__);
  docset_helper_add(docset, X509_object_set_not_after__doc__);
  docset_helper_add(docset, X509_object_add_extension__doc__);
  docset_helper_add(docset, X509_object_clear_extensions__doc__);
  docset_helper_add(docset, X509_object_count_extensions__doc__);
  docset_helper_add(docset, X509_object_get_extension__doc__);
  docset_helper_add(docset, x509_object_pprint__doc__);

  // x509_crl documentation
  docset_helper_add(docset, x509_crltype__doc__);
  docset_helper_add(docset, x509_crl_object_pem_write__doc__);
  docset_helper_add(docset, x509_crl_object_der_write__doc__);
  docset_helper_add(docset, x509_crl_object_get_version__doc__);
  docset_helper_add(docset, x509_crl_object_set_version__doc__);
  docset_helper_add(docset, x509_crl_object_get_issuer__doc__);
  docset_helper_add(docset, x509_crl_object_set_issuer__doc__);
  docset_helper_add(docset, x509_crl_object_get_this_update__doc__);
  docset_helper_add(docset, x509_crl_object_set_this_update__doc__);
  docset_helper_add(docset, x509_crl_object_get_next_update__doc__);
  docset_helper_add(docset, x509_crl_object_set_next_update__doc__);
  docset_helper_add(docset, x509_crl_object_get_revoked__doc__);
  docset_helper_add(docset, x509_crl_object_set_revoked__doc__);
  docset_helper_add(docset, x509_crl_object_verify__doc__);
  docset_helper_add(docset, x509_crl_object_sign__doc__);
  docset_helper_add(docset, X509_crl_object_add_extension__doc__);
  docset_helper_add(docset, X509_crl_object_clear_extensions__doc__);
  docset_helper_add(docset, X509_crl_object_count_extensions__doc__);
  docset_helper_add(docset, X509_crl_object_get_extension__doc__);
  docset_helper_add(docset, x509_crl_object_pprint__doc__);

  // x509_revoked documentation
  docset_helper_add(docset, x509_revokedtype__doc__);
  docset_helper_add(docset, x509_revoked_object_get_date__doc__);
  docset_helper_add(docset, x509_revoked_object_set_date__doc__);
  docset_helper_add(docset, x509_revoked_object_get_serial__doc__);
  docset_helper_add(docset, x509_revoked_object_set_serial__doc__);
  docset_helper_add(docset, X509_revoked_object_add_extension__doc__);
  docset_helper_add(docset, X509_revoked_object_clear_extensions__doc__);
  docset_helper_add(docset, X509_revoked_object_count_extensions__doc__);
  docset_helper_add(docset, X509_revoked_object_get_extension__doc__);

  // x509_store documentation
  docset_helper_add(docset, x509_storetype__doc__);
  docset_helper_add(docset, x509_store_object_verify__doc__);
  docset_helper_add(docset, x509_store_object_verify_chain__doc__);
  docset_helper_add(docset, x509_store_object_verify_detailed__doc__);
  docset_helper_add(docset, x509_store_object_add_trust__doc__);
  docset_helper_add(docset, x509_store_object_add_crl__doc__);

  // digest documentation
  docset_helper_add(docset, digesttype__doc__);
  docset_helper_add(docset, digest_object_update__doc__);
  docset_helper_add(docset, digest_object_copy__doc__);
  docset_helper_add(docset, digest_object_digest__doc__);

  // hmac documentation
  docset_helper_add(docset, hmactype__doc__);
  docset_helper_add(docset, hmac_object_update__doc__);
  docset_helper_add(docset, hmac_object_copy__doc__);
  docset_helper_add(docset, hmac_object_mac__doc__);

  // cms documentation
  docset_helper_add(docset, CMS_object_pem_write__doc__);
  docset_helper_add(docset, CMS_object_der_write__doc__);
  docset_helper_add(docset, CMS_object_sign__doc__);
  docset_helper_add(docset, CMS_object_verify__doc__);
  docset_helper_add(docset, CMS_object_eContentType__doc__);
  docset_helper_add(docset, CMS_object_signingTime__doc__);
  docset_helper_add(docset, CMS_object_pprint__doc__);
  docset_helper_add(docset, CMS_object_certs__doc__);
  docset_helper_add(docset, CMS_object_crls__doc__);

  // symmetric documentation
  docset_helper_add(docset, symmetrictype__doc__);
  docset_helper_add(docset, symmetric_object_encrypt_init__doc__);
  docset_helper_add(docset, symmetric_object_decrypt_init__doc__);
  docset_helper_add(docset, symmetric_object_update__doc__);
  docset_helper_add(docset, symmetric_object_final__doc__);

  // asymmetric documentation
  docset_helper_add(docset, asymmetrictype__doc__);
  docset_helper_add(docset, asymmetric_object_pem_write__doc__);
  docset_helper_add(docset, asymmetric_object_der_write__doc__);
  docset_helper_add(docset, asymmetric_object_public_encrypt__doc__);
  docset_helper_add(docset, asymmetric_object_public_decrypt__doc__);
  docset_helper_add(docset, asymmetric_object_private_encrypt__doc__);
  docset_helper_add(docset, asymmetric_object_private_decrypt__doc__);
  docset_helper_add(docset, asymmetric_object_sign__doc__);
  docset_helper_add(docset, asymmetric_object_verify__doc__);

  return docset;

 error:

  return NULL;
}

static struct PyMethodDef pow_module_methods[] = {
  {"Ssl",               (PyCFunction)pow_module_new_ssl,           METH_VARARGS,  NULL},
  {"X509",              (PyCFunction)pow_module_new_x509,          METH_VARARGS,  NULL},
  {"pemRead",           (PyCFunction)pow_module_pem_read,          METH_VARARGS,  NULL},
  {"derRead",           (PyCFunction)pow_module_der_read,          METH_VARARGS,  NULL},
  {"Digest",            (PyCFunction)pow_module_new_digest,        METH_VARARGS,  NULL},
  {"Hmac",              (PyCFunction)pow_module_new_hmac,          METH_VARARGS,  NULL},
  {"CMS",               (PyCFunction)pow_module_new_cms,           METH_VARARGS,  NULL},
  {"Asymmetric",        (PyCFunction)pow_module_new_asymmetric,    METH_VARARGS,  NULL},
  {"Symmetric",         (PyCFunction)pow_module_new_symmetric,     METH_VARARGS,  NULL},
  {"X509Store",         (PyCFunction)pow_module_new_x509_store,    METH_VARARGS,  NULL},
  {"X509Crl",           (PyCFunction)pow_module_new_x509_crl,      METH_VARARGS,  NULL},
  {"X509Revoked",       (PyCFunction)pow_module_new_x509_revoked,  METH_VARARGS,  NULL},
  {"getError",          (PyCFunction)pow_module_get_error,         METH_VARARGS,  NULL},
  {"clearError",        (PyCFunction)pow_module_clear_error,       METH_VARARGS,  NULL},
  {"seed",              (PyCFunction)pow_module_seed,              METH_VARARGS,  NULL},
  {"add",               (PyCFunction)pow_module_add,               METH_VARARGS,  NULL},
  {"readRandomFile",    (PyCFunction)pow_module_read_random_file,  METH_VARARGS,  NULL},
  {"writeRandomFile",   (PyCFunction)pow_module_write_random_file, METH_VARARGS,  NULL},
  {"addObject",         (PyCFunction)pow_module_add_object,        METH_VARARGS,  NULL},

  {"_docset",           (PyCFunction)pow_module_docset,            METH_VARARGS,  NULL},

  {NULL}     /* sentinel */
};
/*========== module functions ==========*/


/*==========================================================================*/
void
init_POW(void)
{
  PyObject *m;

  x509type.ob_type         = &PyType_Type;
  x509_storetype.ob_type   = &PyType_Type;
  x509_crltype.ob_type     = &PyType_Type;
  x509_revokedtype.ob_type = &PyType_Type;
  ssltype.ob_type          = &PyType_Type;
  asymmetrictype.ob_type   = &PyType_Type;
  symmetrictype.ob_type    = &PyType_Type;
  digesttype.ob_type       = &PyType_Type;
  hmactype.ob_type         = &PyType_Type;
  cmstype.ob_type          = &PyType_Type;

  m = Py_InitModule3("_POW", pow_module_methods, pow_module__doc__);

#define Define_Exception(__name__, __parent__) \
  PyModule_AddObject(m, #__name__, ((__name__##Object) = PyErr_NewException("POW." #__name__, __parent__, NULL)))

  Define_Exception(Error,                NULL);
  Define_Exception(SSLError,             ErrorObject);
  Define_Exception(ZeroReturnError,      SSLErrorObject);
  Define_Exception(WantReadError,        SSLErrorObject);
  Define_Exception(WantWriteError,       SSLErrorObject);
  Define_Exception(SSLSyscallError,      SSLErrorObject);
  Define_Exception(SSLErrorSSLError,     SSLErrorObject);
  Define_Exception(SSLSyscallSSLError,   SSLErrorObject);
  Define_Exception(SSLUnexpectedEOFError,SSLErrorObject);
  Define_Exception(SSLOtherError,        SSLErrorObject);

#undef Define_Exception

#define Define_Integer_Constant(__name__) \
  PyModule_AddIntConstant(m, #__name__, __name__)

  // constants for SSL_get_error()
  Define_Integer_Constant(SSL_ERROR_NONE);
  Define_Integer_Constant(SSL_ERROR_ZERO_RETURN);
  Define_Integer_Constant(SSL_ERROR_WANT_READ);
  Define_Integer_Constant(SSL_ERROR_WANT_WRITE);
  Define_Integer_Constant(SSL_ERROR_WANT_X509_LOOKUP);
  Define_Integer_Constant(SSL_ERROR_SYSCALL);
  Define_Integer_Constant(SSL_ERROR_SSL);
  Define_Integer_Constant(SSL_ERROR_WANT_CONNECT);
  Define_Integer_Constant(SSL_ERROR_WANT_ACCEPT);

  // constants for different types of connection methods
  Define_Integer_Constant(SSLV2_SERVER_METHOD);
  Define_Integer_Constant(SSLV2_CLIENT_METHOD);
  Define_Integer_Constant(SSLV2_METHOD);
  Define_Integer_Constant(SSLV3_SERVER_METHOD);
  Define_Integer_Constant(SSLV3_CLIENT_METHOD);
  Define_Integer_Constant(SSLV3_METHOD);
  Define_Integer_Constant(SSLV23_SERVER_METHOD);
  Define_Integer_Constant(SSLV23_CLIENT_METHOD);
  Define_Integer_Constant(SSLV23_METHOD);
  Define_Integer_Constant(TLSV1_SERVER_METHOD);
  Define_Integer_Constant(TLSV1_CLIENT_METHOD);
  Define_Integer_Constant(TLSV1_METHOD);

  Define_Integer_Constant(SSL_NO_SHUTDOWN);
  Define_Integer_Constant(SSL_SENT_SHUTDOWN);
  Define_Integer_Constant(SSL_RECEIVED_SHUTDOWN);

  // ssl verification mode
  Define_Integer_Constant(SSL_VERIFY_NONE);
  Define_Integer_Constant(SSL_VERIFY_PEER);
  Define_Integer_Constant(SSL_VERIFY_FAIL_IF_NO_PEER_CERT);
  Define_Integer_Constant(SSL_VERIFY_CLIENT_ONCE);

  // object format types
  Define_Integer_Constant(LONGNAME_FORMAT);
  Define_Integer_Constant(SHORTNAME_FORMAT);

  // PEM encoded types
#ifndef OPENSSL_NO_RSA
  Define_Integer_Constant(RSA_PUBLIC_KEY);
  Define_Integer_Constant(RSA_PRIVATE_KEY);
#endif
#ifndef OPENSSL_NO_DSA
  Define_Integer_Constant(DSA_PUBLIC_KEY);
  Define_Integer_Constant(DSA_PRIVATE_KEY);
#endif
#ifndef OPENSSL_NO_DH
  Define_Integer_Constant(DH_PUBLIC_KEY);
  Define_Integer_Constant(DH_PRIVATE_KEY);
#endif
  Define_Integer_Constant(X509_CERTIFICATE);
  PyModule_AddIntConstant(m, "X509_CRL", X_X509_CRL);
  Define_Integer_Constant(CMS_MESSAGE);

  // asymmetric ciphers
#ifndef OPENSSL_NO_RSA
  Define_Integer_Constant(RSA_CIPHER);
#endif
#ifndef OPENSSL_NO_DSA
  Define_Integer_Constant(DSA_CIPHER);
#endif
#ifndef OPENSSL_NO_DH
  Define_Integer_Constant(DH_CIPHER);
#endif

  // symmetric ciphers
#ifndef OPENSSL_NO_DES
  Define_Integer_Constant(DES_ECB);
  Define_Integer_Constant(DES_EDE);
  Define_Integer_Constant(DES_EDE3);
  Define_Integer_Constant(DES_CFB);
  Define_Integer_Constant(DES_EDE_CFB);
  Define_Integer_Constant(DES_EDE3_CFB);
  Define_Integer_Constant(DES_OFB);
  Define_Integer_Constant(DES_EDE_OFB);
  Define_Integer_Constant(DES_EDE3_OFB);
  Define_Integer_Constant(DES_CBC);
  Define_Integer_Constant(DES_EDE_CBC);
  Define_Integer_Constant(DES_EDE3_CBC);
  Define_Integer_Constant(DESX_CBC);
#endif
#ifndef OPENSSL_NO_RC4
  Define_Integer_Constant(RC4);
  Define_Integer_Constant(RC4_40);
#endif
#ifndef OPENSSL_NO_IDEA
  Define_Integer_Constant(IDEA_ECB);
  Define_Integer_Constant(IDEA_CFB);
  Define_Integer_Constant(IDEA_OFB);
  Define_Integer_Constant(IDEA_CBC);
#endif
#ifndef OPENSSL_NO_RC2
  Define_Integer_Constant(RC2_ECB);
  Define_Integer_Constant(RC2_CBC);
  Define_Integer_Constant(RC2_40_CBC);
  Define_Integer_Constant(RC2_CFB);
  Define_Integer_Constant(RC2_OFB);
#endif
#ifndef OPENSSL_NO_BF
  Define_Integer_Constant(BF_ECB);
  Define_Integer_Constant(BF_CBC);
  Define_Integer_Constant(BF_CFB);
  Define_Integer_Constant(BF_OFB);
#endif
  Define_Integer_Constant(CAST5_ECB);
  Define_Integer_Constant(CAST5_CBC);
  Define_Integer_Constant(CAST5_CFB);
  Define_Integer_Constant(CAST5_OFB);
#ifndef OPENSSL_NO_RC5
  Define_Integer_Constant(RC5_32_12_16_CBC);
  Define_Integer_Constant(RC5_32_12_16_CFB);
  Define_Integer_Constant(RC5_32_12_16_ECB);
  Define_Integer_Constant(RC5_32_12_16_OFB);
#endif

  // message digests
#ifndef OPENSSL_NO_MD2
  Define_Integer_Constant(MD2_DIGEST);
#endif
  Define_Integer_Constant(MD5_DIGEST);
  Define_Integer_Constant(SHA_DIGEST);
  Define_Integer_Constant(SHA1_DIGEST);
  Define_Integer_Constant(RIPEMD160_DIGEST);
  Define_Integer_Constant(SHA256_DIGEST);
  Define_Integer_Constant(SHA384_DIGEST);
  Define_Integer_Constant(SHA512_DIGEST);

  // general name
  Define_Integer_Constant(GEN_OTHERNAME);
  Define_Integer_Constant(GEN_EMAIL);
  Define_Integer_Constant(GEN_DNS);
  Define_Integer_Constant(GEN_X400);
  Define_Integer_Constant(GEN_DIRNAME);
  Define_Integer_Constant(GEN_EDIPARTY);
  Define_Integer_Constant(GEN_URI);
  Define_Integer_Constant(GEN_IPADD);
  Define_Integer_Constant(GEN_RID);

  // CMS flags
  Define_Integer_Constant(CMS_NOCERTS);
  Define_Integer_Constant(CMS_NOATTR);
  Define_Integer_Constant(CMS_NOINTERN);
  Define_Integer_Constant(CMS_NOCRL);
  Define_Integer_Constant(CMS_NO_SIGNER_CERT_VERIFY);
  Define_Integer_Constant(CMS_NO_ATTR_VERIFY);
  Define_Integer_Constant(CMS_NO_CONTENT_VERIFY);

#undef Define_Integer_Constant

  // initialise library
  SSL_library_init();
  OpenSSL_add_all_algorithms();
  OpenSSL_add_all_ciphers();
  OpenSSL_add_all_digests();

  // load error strings
  SSL_load_error_strings();

  if (PyErr_Occurred())
    Py_FatalError("Can't initialize module POW");
}
/*==========================================================================*/

/*
 * Local Variables:
 * indent-tabs-mode: nil
 * End:
 */