Re: RFC: expose ssl internals for use by ctypes/cffi

On 11/30/2022 4:52 PM, [email protected] wrote:
> Does this seem like a good idea?  As I said, I feel that it is a bit ugly, but it does mean that if someone wants to use some SSL_really_obscure_function in libcrypto or libssl they can do that without having to rebuild all of CPython themselves.

Broadly, no, I don't think it's a good idea. We don't like encouraging 
users to do things that make it hard to support them in the future.

Nonetheless, it's one that I've had to do, and so realistically I think 
it's okay to *enable* the hack without endorsing it. This is one of the 
reasons I switched the Windows builds to dynamically linked OpenSSL 
builds (they used to be statically linked, which meant there was no way 
to get at the unused exports). So now you can use `import _ssl; 
ctypes.CDLL("libssl-1_1")` to get at other exports from the module if 
you need them, and there's a similar trick to get the raw handle that I 
don't recall off the top of my head.

But the only reason I'd ever want to document this is to tell people not 
to rely on it. If you control your environment well enough that you can 
guarantee it'll work for you, that's great. Nobody else should ever 
think they're doing the "right thing".

Cheers,
Steve