amps-python-client 5.3.4.3__zip → 5.3.4.4__zip

{amps-python-client-5.3.4.3 → amps-python-client-5.3.4.4}/src/raw_wrapper.cpp

@@ -24,16 +24,22 @@
 ////////////////////////////////////////////////////////////////////////////
 
 #define PY_SSIZE_T_CLEAN 1
+#ifdef _WIN32
+#include <Winsock2.h>
+#include <Ws2tcpip.h>
+#endif
 #include <Python.h>
+#include <object.h>
 #include <amps/ampsplusplus.hpp>
 extern "C" {
 #include <amps/amps_impl.h>
+#include <amps/amps_ssl.h>
 }
 #include <ampspy_types.hpp>
 #include <ampspy_defs.hpp>
+#include <ampspy_ssl.hpp>
 #include <ampspyver.h>
 
-
 using namespace AMPS;
 
 AMPSDLL PyObject* not_copyable(PyObject* self, PyObject* args)
@@ -42,6 +48,16 @@ AMPSDLL PyObject* not_copyable(PyObject* self, PyObject* args)
   return NULL;
 }
 
+extern "C"
+{
+  extern int        (*amps_tcps_close_all)(AMPS_SOCKET, _amps_SSL*);
+  extern _amps_SSL* (*amps_tcps_get_socket_and_ssl)(AMPS_SOCKET,
+                                                   const char* address_, int port_,
+                                                   struct addrinfo*,
+                                                   char*, void*);
+  void amps_tcps_set_external_error(void* transport, const amps_char* buffer);
+}
+
 namespace ampspy
 {
   namespace exc
@@ -469,38 +485,103 @@ failure:
   }
   bool _is_signaled = false;
 
+  // SSL related section
   bool _ssl_is_initialized = false;
 
-  AMPSDLL PyObject* ssl_init_internal(const char* dll_name)
+#if PY_MAJOR_VERSION >= 3
+  // Python provided SSL things we hold onto
+  PyObject* _ampspy_ssl_module = NULL;
+  PyObject* _ampspy__ssl_module = NULL;
+  PyObject* _ampspy_socket_module = NULL;
+  PyObject* _ampspy__socket_module = NULL;
+  PyObject* _ampspy_ssl_context = NULL;
+  PyObject* _ampspy_sslcontext_class = NULL;
+  // Holder for the tcps version if we can't get Python to work
+  _amps_SSL* (*_ampspy_get_socket_and_ssl)(AMPS_SOCKET,
+                                           const char* address_, int port_,
+                                           struct addrinfo*, char*, void*);
+  // Storage for our Python objects related to each connection
+  std::map<_amps_SSL*, std::pair<PyObject*, PyObject*> > _ampspy_ssl_object_map;
+  AMPS::Mutex _ampspy_ssl_map_lock;
+
+  // Get the ssl.SSLSocket based on the C lib SSL*. Used in client.
+  AMPSDLL PyObject* ampspy_get_PySSLSocket_from_SSL(_amps_SSL* ssl_)
   {
-    if (_ssl_is_initialized)
+    if (!ssl_)
     {
       Py_INCREF(Py_None);
       return Py_None;
     }
+    AMPS::Lock<AMPS::Mutex> guard(_ampspy_ssl_map_lock);
+    auto iter = _ampspy_ssl_object_map.find((_amps_SSL*)ssl_);
+    if (iter != _ampspy_ssl_object_map.end())
+    {
+      PyObject* pySSLSocket = iter->second.first;
+      Py_INCREF(pySSLSocket);
+      return pySSLSocket;
+    }
+    Py_INCREF(Py_None);
+    return Py_None;
+  }
 
+  // Remove all our module/type references
+  AMPSDLL void _ampspy_ssl_cleanup(void)
+  {
+    Py_XDECREF(_ampspy_sslcontext_class);
+    _ampspy_sslcontext_class = NULL;
+    Py_XDECREF(_ampspy_ssl_context);
+    _ampspy_ssl_context = NULL;
+    Py_XDECREF(_ampspy_socket_module);
+    _ampspy_socket_module = NULL;
+    Py_XDECREF(_ampspy__socket_module);
+    _ampspy__socket_module = NULL;
+    Py_XDECREF(_ampspy__ssl_module);
+    _ampspy__ssl_module = NULL;
+    Py_XDECREF(_ampspy_ssl_module);
+    _ampspy_ssl_module = NULL;
+  }
+#endif // Python 3+ only
+
+  // Init everything to just use the C lib and not have Python objects
+  int ssl_init_c_lib(const char* dll_name)
+  {
     int rc = amps_ssl_init(dll_name);
-#ifndef _WIN32
     if (rc && !dll_name)
     {
+#if PY_MAJOR_VERSION >= 3
+      if (!_ampspy_ssl_module)
+      {
+        // Try to load the Python ssl module, and see if we can use it.
+        _ampspy_ssl_module = PyImport_ImportModule("ssl");
+        if (!_ampspy_ssl_module)
+        {
+          PyErr_SetString(ampspy::exc::ConnectionException,
+                          "No SSL module found or specified.");
+          return rc;
+        }
+      }
+#else
       // Try to load the Python ssl module, and see if we can use it.
-      PyObject* ssl_module = PyImport_ImportModule("ssl");
-      if (!ssl_module)
+      PyObject* _ampspy_ssl_module = PyImport_ImportModule("ssl");
+      if (!_ampspy_ssl_module)
       {
         PyErr_SetString(ampspy::exc::ConnectionException,
                         "No SSL module found or specified.");
-        return NULL;
+        return rc;
       }
+#endif
 
       // Does it have a "_ssl" attribute?
-      PyObject* ssl_internal_module = PyObject_GetAttrString(ssl_module,
+      PyObject* ssl_internal_module = PyObject_GetAttrString(_ampspy_ssl_module,
                                                              "_ssl");
-      Py_DECREF(ssl_module);
       if (!ssl_internal_module)
       {
+#if PY_MAJOR_VERSION < 3
+        Py_DECREF(_ampspy_ssl_module);
+#endif
         PyErr_SetString(ampspy::exc::ConnectionException,
-                        "No SSL module found or specified.");
-        return NULL;
+                        "No _SSL module found or specified.");
+        return rc;
       }
 
       // It does, let's get its file name
@@ -510,36 +591,524 @@ failure:
       if (!(ssl_internal_filename && PyString_Check(ssl_internal_filename)))
       {
         Py_XDECREF(ssl_internal_filename);
+#if PY_MAJOR_VERSION < 3
+        Py_DECREF(_ampspy_ssl_module);
+#endif
         PyErr_SetString(ampspy::exc::ConnectionException,
-                        "No SSL module found or specified.");
-        return NULL;
+                        "No SSL module filename found.");
+        return rc;
       }
       dll_name = PyString_AsString(ssl_internal_filename);
-      Py_DECREF(ssl_internal_filename);
+#if PY_MAJOR_VERSION < 3
+      Py_DECREF(_ampspy_ssl_module);
+#endif
       rc = amps_ssl_init(dll_name);
+      Py_DECREF(ssl_internal_filename);
+    }
+    _ssl_is_initialized = (rc == 0);
+    return rc;
+  }
+
+#if PY_MAJOR_VERSION >= 3
+  // We use the following truncated struct definition to grab
+  // otherwise inaccessible members that we need.
+  // typedef struct {
+  //     PyObject_HEAD
+  //     PyObject *Socket; /* weakref to socket on which we're layered */
+  //     SSL *ssl;
+  // ...
+  // } PySSLSocket;
+  typedef struct
+  {
+    PyObject_HEAD
+    PyObject *pPySocket; /* weakref to socket on which we're layered */
+    _amps_SSL *ssl;
+  } ampspy_PySSLSocket;
+
+  // Create a conencted Python ssl.SSLSocket wrapping the given fd_, connected
+  // to address_:port_, possibly using sni for hostname_
+  AMPSDLL _amps_SSL* _ampspy_SSL_new_wrapped_socket(AMPS_SOCKET fd_,
+                                                    const char* address_, int port_,
+                                                    struct addrinfo* pAddrInfo_,
+                                                    char* hostname_, void* me_)
+  {
+    LOCKGIL;
+    if (!_ampspy_ssl_context)
+    {
+      ssl_init_internal(NULL, NULL);
+      if (!_ampspy_ssl_context)
+      {
+        amps_tcps_set_external_error(me_, "Failed to initialize SSL and get a context");
+        return NULL;
+      }
+    }
+    if (!_ampspy_socket_module)
+    {
+      _ampspy_socket_module = PyImport_ImportModule("socket");
+      if (!_ampspy_socket_module)
+      {
+        amps_tcps_set_external_error(me_, "Failed to load Python socket module");
+        return _ampspy_get_socket_and_ssl(fd_, address_, port_, pAddrInfo_, hostname_, me_);
+      }
+    }
+    PyObject* pySockType = PyObject_GetAttrString(_ampspy_socket_module, "socket");
+    if (!pySockType)
+    {
+      amps_tcps_set_external_error(me_, "Failed to load Python socket type");
+      Py_DECREF(_ampspy_socket_module);
+      _ampspy_socket_module = NULL;
+      return _ampspy_get_socket_and_ssl(fd_, address_, port_, pAddrInfo_, hostname_, me_);
+    }
+    PyObject* pyFd = NULL;
+    if (sizeof(fd_) == 8)
+    {
+      pyFd = PyLong_FromLongLong((long long)fd_);
+    }
+    else
+    {
+      pyFd = PyLong_FromLong((long)fd_);
+    }
+    // We'll only use keyword arguments
+    PyObject* args = PyTuple_New(1);
+    switch (pAddrInfo_->ai_family)
+    {
+    case AF_INET:
+    {
+      PyTuple_SetItem(args, 0, PyObject_GetAttrString(_ampspy_socket_module, "AF_INET"));
+    }
+    break;
+    case AF_INET6:
+    {
+      PyTuple_SetItem(args, 0, PyObject_GetAttrString(_ampspy_socket_module, "AF_INET6"));
+    }
+    break;
+    case AF_UNIX:
+    {
+      PyTuple_SetItem(args, 0, PyObject_GetAttrString(_ampspy_socket_module, "AF_UNIX"));
     }
+    break;
+    default:
+    {
+      PyTuple_SetItem(args, 0, PyLong_FromLong((long)pAddrInfo_->ai_family));
+    }
+    }
+    PyObject* kwargs = PyDict_New();
+    if (pAddrInfo_->ai_protocol)
+    {
+      PyDict_SetItemString(kwargs, "proto", PyLong_FromLong(pAddrInfo_->ai_protocol));
+    }
+    PyDict_SetItemString(kwargs, "fileno", pyFd);
+    PyObject* pySocket = PyObject_Call(pySockType, args, kwargs);
+    if (!pySocket)
+    {
+      amps_tcps_set_external_error(me_, "Failed to create Python socket");
+      Py_DECREF(pySockType);
+      Py_DECREF(args);
+      Py_DECREF(kwargs);
+      return _ampspy_get_socket_and_ssl(fd_, address_, port_, pAddrInfo_, hostname_, me_);
+    }
+    Py_DECREF(args);
+    Py_DECREF(kwargs);
+    PyObject* pySSLSocket = NULL;
+    if (hostname_)
+    {
+      // We're using sni, so we need to set a few things
+      PyObject_SetAttrString(_ampspy_ssl_context, "check_hostname", Py_True);
+      PyObject* pyVm = PyObject_GetAttrString(_ampspy_ssl_module, "VerifyMode");
+      PyObject* pyVerifyMode = PyObject_GetAttrString(pyVm, "CERT_REQUIRED");
+      PyObject_SetAttrString(_ampspy_ssl_context, "verify_mode", pyVerifyMode);
+      Py_XDECREF(pyVm);
+      Py_XDECREF(pyVerifyMode);
+
+      pySSLSocket = PyObject_CallMethodObjArgs(_ampspy_ssl_context,
+                                               PyString_FromString("wrap_socket"),
+                                               pySocket, Py_False, Py_True,
+                                               Py_True,
+                                               PyString_FromString(hostname_),
+                                               NULL);
+    }
+    else
+    {
+      pySSLSocket = PyObject_CallMethodObjArgs(_ampspy_ssl_context,
+                                               PyString_FromString("wrap_socket"),
+                                               pySocket, Py_False, NULL);
+    }
+    if (!pySSLSocket)
+    {
+      amps_tcps_set_external_error(me_, "Failed to create Python SSLSocket");
+      Py_DECREF(pySockType);
+      Py_DECREF(pySocket);
+      return _ampspy_get_socket_and_ssl(fd_, address_, port_, pAddrInfo_, hostname_, me_);
+    }
+
+    // connect the socket.socket
+    PyObject* retVal = NULL;
+    if (pAddrInfo_->ai_addr->sa_family == AF_INET)
+    {
+      retVal = PyObject_CallMethod(pySSLSocket, "connect", "((si))", address_, port_);
+    }
+    else if (pAddrInfo_->ai_addr->sa_family == AF_INET6)
+    {
+#ifdef _WIN32
+      SOCKADDR_IN6* pAddr6 = (SOCKADDR_IN6*)(pAddrInfo_->ai_addr->sa_data);
+#else
+      sockaddr_in6* pAddr6 = (sockaddr_in6*)(pAddrInfo_->ai_addr->sa_data);
+#endif
+      retVal = PyObject_CallMethod(pySSLSocket, "connect", "((siii))", address_, port_,
+                                   pAddr6->sin6_flowinfo, pAddr6->sin6_scope_id);
+    }
+    if (!retVal)
+    {
+      // We're not going to use these
+      Py_DECREF(pySockType);
+      Py_DECREF(pySocket);
+      Py_DECREF(pySSLSocket);
+      // Ignore errors here, just being sure the socket is released
+#ifdef _WIN32
+      shutdown(fd_, SD_BOTH);
+      closesocket(fd_);
+#else
+      shutdown(fd_, SHUT_RDWR);
+      close(fd_);
+#endif
+      amps_tcps_set_external_error(me_, "Failed to connect Python SSLSocket");
+      return NULL;
+    }
+    Py_DECREF(retVal);
+
+    int pyMinor = 0;
+    const char* pyVer = Py_GetVersion();
+    for (size_t i=2; pyVer[i] >= '0' && pyVer[i] <= '9'; ++i)
+    {
+      pyMinor *= 10;
+      pyMinor += (int)pyVer[i] - (int)'0';
+    }
+    PyObject* pySSLSocketObj = PyObject_GetAttrString(pySSLSocket, "_sslobj");
+    _amps_SSL* ssl = 0;
+    if (pyMinor > 6)
+    {
+      // The _sslobj is a PySSLSocket that is only present on a connected socket
+      // Use our truncated struct to get the SSL*
+      ampspy_PySSLSocket* sslSocket = (ampspy_PySSLSocket*)pySSLSocketObj;
+      ssl = sslSocket->ssl;
+    }
+    else
+    {
+      // Python 3.6 _sslobj is an SSLObj wrapper with a PySSLSocket in _sslobj
+      pySSLSocketObj = PyObject_GetAttrString(pySSLSocketObj, "_sslobj");
+      // Use our truncated struct to get the SSL*
+      ampspy_PySSLSocket* sslSocket = (ampspy_PySSLSocket*)pySSLSocketObj;
+      ssl = sslSocket->ssl;
+    }
+    _amps_SSL_ctrl(ssl, AMPS_SSL_CTRL_MODE, AMPS_SSL_AUTO_RETRY, NULL);
+
+    AMPS::Lock<AMPS::Mutex> guard(_ampspy_ssl_map_lock);
+    _ampspy_ssl_object_map[ssl] = std::make_pair(pySSLSocket, pySocket);
+    Py_DECREF(pySSLSocketObj);
+    Py_DECREF(pySockType);
+    return ssl;
+  }
+
+  // Here is where we use Python to close the Python objects
+  AMPSDLL int _ampspy_close_all(AMPS_SOCKET fd_, _amps_SSL* pSSL_)
+  {
+    if (!pSSL_)
+    {
+      if (fd_ != AMPS_INVALID_SOCKET)
+      {
+#ifdef _WIN32
+        shutdown(fd_, SD_BOTH);
+        closesocket(fd_);
+#else
+        shutdown(fd_, SHUT_RDWR);
+        close(fd_);
 #endif
+      }
+      return 0;
+    }
+    PyObject* pySSLSocket = NULL;
+    PyObject* pySocket = NULL;
+    {
+      AMPS::Lock<AMPS::Mutex> guard(_ampspy_ssl_map_lock);
+      auto iter = _ampspy_ssl_object_map.find(pSSL_);
+      if (iter != _ampspy_ssl_object_map.end())
+      {
+        pySSLSocket = iter->second.first;
+        pySocket = iter->second.second;
+        _ampspy_ssl_object_map.erase(iter);
+      }
+    }
+    if (pySSLSocket)
+    {
+      LOCKGIL;
+      // Shutdown everything, then close the connection
+      PyObject* arg = PyObject_GetAttrString(_ampspy_socket_module, "SHUT_RDWR");
+      PyObject_CallMethodObjArgs(pySSLSocket, PyString_FromString("shutdown"), arg, NULL);
+      PyObject_CallMethodObjArgs(pySSLSocket, PyString_FromString("_real_close"), NULL);
+      PyObject_SetAttrString(pySSLSocket, "_closed", Py_True);
+      PyObject_SetAttrString(pySSLSocket, "connected", Py_False);
+      Py_XDECREF(arg);
+      Py_DECREF(pySSLSocket);
+      Py_DECREF(pySocket);
+    }
+    else if (!_ampspy_socket_module)
+    {
+      // We didn't find python objects, must have been handled in C
+      _amps_SSL_shutdown(pSSL_);
+      _amps_SSL_free(pSSL_);
+    }
+    return 0;
+  }
+
+  // typedef struct {
+  // PyObject_HEAD
+  // SSL_CTX *ctx;
+  // ...
+  // } PySSLContext;
+  // The SSL_CTX* is the first item after PyObject_HEAD
+  typedef struct
+  {
+    PyObject_HEAD
+    _amps_SSL_CTX *ctx;
+  } ampspy_PySSLContext;
+
+  AMPSDLL PyObject* ssl_init_internal(const char* dll_name, PyObject* pyCtx,
+                                      bool strictCiphersOnly_)
+  {
+    if (_ssl_is_initialized)
+    {
+      Py_INCREF(Py_None);
+      return Py_None;
+    }
+
+    // Are we being provided an ssl.SSLContext or do we need to create one?
+    if (!pyCtx)
+    {
+      if (dll_name)
+      {
+        PyObject* modules = PyImport_GetModuleDict();
+        PyObject* sslName = PyString_FromString("ssl");
+        if (PyDict_Contains(modules, sslName) != 1)
+        {
+          Py_DECREF(sslName);
+          if (ssl_init_c_lib(dll_name))
+          {
+            PyErr_SetString(ampspy::exc::ConnectionException,
+                            "No SSL module found.");
+            return NULL;
+          }
+          PyErr_Clear();
+          Py_INCREF(Py_None);
+          return Py_None;
+        }
+        Py_DECREF(sslName);
+      }
+      // Load the socket module
+      if (!_ampspy_socket_module)
+      {
+        _ampspy_socket_module = PyImport_ImportModule("socket");
+      }
+      // Try to load the Python ssl module, and see if we can use it.
+      if (!_ampspy_ssl_module)
+      {
+        _ampspy_ssl_module = PyImport_ImportModule("ssl");
+        if (!_ampspy_ssl_module)
+        {
+          if (ssl_init_c_lib(dll_name))
+          {
+            PyErr_SetString(ampspy::exc::ConnectionException,
+                            "No SSL module found.");
+            return NULL;
+          }
+          PyErr_Clear();
+          Py_INCREF(Py_None);
+          return Py_None;
+        }
+      }
+
+      if (!_ampspy__ssl_module)
+      {
+        _ampspy__ssl_module = PyImport_ImportModule("_ssl");
+        if (!_ampspy__ssl_module)
+        {
+          if (ssl_init_c_lib(dll_name))
+          {
+            Py_DECREF(_ampspy_ssl_module);
+            _ampspy_ssl_module = NULL;
+            PyErr_SetString(ampspy::exc::ConnectionException,
+                            "No _ssl module found.");
+            return NULL;
+          }
+          PyErr_Clear();
+          Py_INCREF(Py_None);
+          return Py_None;
+        }
+      }
+
+      // Get the SSLContext class
+      if (!_ampspy_sslcontext_class)
+      {
+        _ampspy_sslcontext_class = PyObject_GetAttrString(_ampspy_ssl_module, "SSLContext");
+        if (!_ampspy_sslcontext_class)
+        {
+          Py_DECREF(_ampspy_ssl_module);
+          Py_DECREF(_ampspy__ssl_module);
+          _ampspy_ssl_module = NULL;
+          _ampspy__ssl_module = NULL;
+          if (ssl_init_c_lib(dll_name))
+          {
+            PyErr_SetString(ampspy::exc::ConnectionException,
+                            "No SSLContext in SSL module");
+            return NULL;
+          }
+          PyErr_Clear();
+          Py_INCREF(Py_None);
+          return Py_None;
+        }
+      }
+
+      PyObject* tlsClient = PyObject_GetAttrString(_ampspy_ssl_module, "PROTOCOL_TLS_CLIENT");
+      if (!tlsClient)
+      {
+        // From _ssl.c in Python source code: PY_SSL_VERSION_TLS_CLIENT=0x10,
+        //long PY_SSL_VERSION_TLS_CLIENT = (long)0x10;
+        // Create an SSLContext for our client
+        //_ampspy_ssl_context = PyObject_CallFunction(_ampspy_sslcontext_class, "l", (long)0x10);
+        _ampspy_ssl_context = PyObject_CallMethod(_ampspy_ssl_module, "create_default_context", NULL);
+      }
+      else
+      {
+        _ampspy_ssl_context = PyObject_CallFunctionObjArgs(_ampspy_sslcontext_class, tlsClient, NULL);
+        Py_DECREF(tlsClient);
+      }
+      if (!_ampspy_ssl_context)
+      {
+        Py_DECREF(_ampspy_ssl_module);
+        Py_DECREF(_ampspy__ssl_module);
+        Py_DECREF(_ampspy_sslcontext_class);
+        _ampspy_ssl_module = NULL;
+        _ampspy__ssl_module = NULL;
+        _ampspy_sslcontext_class = NULL;
+        PyErr_SetString(ampspy::exc::ConnectionException,
+                        "Could not create SSLContext");
+        return NULL;
+      }
+    }
+    else
+    {
+      _ampspy_ssl_context = pyCtx;
+      Py_INCREF(_ampspy_ssl_context);
+    }
+
+    PyObject* ssl_internal_filename = NULL;
+    const char* dllName = dll_name;
+    if (!dllName)
+    {
+      if (_ampspy__ssl_module)
+      {
+        ssl_internal_filename = PyObject_GetAttrString(_ampspy__ssl_module,
+                                                       "__file__");
+        if (ssl_internal_filename && PyString_Check(ssl_internal_filename))
+        {
+          dllName = PyString_AsString(ssl_internal_filename);
+        }
+      }
+    }
+
+    if (!strictCiphersOnly_)
+    {
+      PyObject* retVal = PyObject_CallMethod(_ampspy_ssl_context, "set_ciphers", "(s)", "DEFAULT");
+      Py_XDECREF(retVal);
+    }
+    PyObject_SetAttrString(_ampspy_ssl_context, "check_hostname", Py_False);
+    PyObject* pyVm = PyObject_GetAttrString(_ampspy_ssl_module, "VerifyMode");
+    if (pyVm)
+    {
+      PyObject* pyVerifyMode = PyObject_GetAttrString(pyVm, "CERT_NONE");
+      if (pyVerifyMode)
+      {
+        PyObject_SetAttrString(_ampspy_ssl_context,
+                               "verify_mode",
+                               pyVerifyMode);
+        Py_DECREF(pyVerifyMode);
+      }
+      Py_DECREF(pyVm);
+    }
+
+    // typedef struct {
+    // PyObject_HEAD
+    // SSL_CTX *ctx;
+    // ...
+    // } PySSLContext;
+    // The SSL_CTX* is the first item after PyObject_HEAD
+    _amps_SSL_CTX* ctx = ((ampspy_PySSLContext*)_ampspy_ssl_context)->ctx;
+
+    // Init the C++ client with the _amps_SSL_CTX* from the Python object
+    int rc = amps_ssl_init_from_context(ctx, dllName);
+    Py_XDECREF(ssl_internal_filename);
     if (rc)
     {
-      PyErr_SetString(ampspy::exc::ConnectionException,
-                      amps_ssl_get_error());
+      char errbuf[256];
+      _AMPS_SNPRINTF(errbuf, sizeof(errbuf), "init from context failed %s ctx is %p ssl_context is %p\n", amps_ssl_get_error(), (void*)ctx, (void*)_ampspy_ssl_context);
+      PyErr_SetString(ampspy::exc::ConnectionException, errbuf);
       return NULL;
     }
     _ssl_is_initialized = true;
+    // Redirect TCPS calls so we can use python wrapped socket/SSL
+    amps_tcps_close_all = _ampspy_close_all;
+    _ampspy_get_socket_and_ssl = amps_tcps_get_socket_and_ssl;
+    amps_tcps_get_socket_and_ssl = _ampspy_SSL_new_wrapped_socket;
 
     Py_INCREF(Py_None);
     return Py_None;
   }
-  PyObject* ssl_init(PyObject* self, PyObject* args)
+
+  // Make our ssl.SSLContext available
+  PyObject* ssl_get_context(PyObject* self, PyObject* args)
   {
-    const char* dll_name = NULL;
+    if (_ampspy_ssl_context)
+    {
+      Py_INCREF(_ampspy_ssl_context);
+      return _ampspy_ssl_context;
+    }
+    else
+    {
+      Py_INCREF(Py_None);
+      return Py_None;
+    }
+  }
+#endif // Python 3+ only
+
+#if PY_MAJOR_VERSION < 3
+  PyObject* ampspy_ssl_init(PyObject* self, PyObject* args)
+  {
+    if (_ssl_is_initialized)
+    {
+      Py_INCREF(Py_None);
+      return Py_None;
+    }
 
-    if (!PyArg_ParseTuple(args, "|s", &dll_name))
+    const char* dll_name = NULL;
+    if (self && args)
     {
+      if (!PyArg_ParseTuple(args, "|s", &dll_name))
+      {
+        return NULL;
+      }
+    }
+    if (ssl_init_c_lib(dll_name))
+    {
+      PyErr_SetString(ampspy::exc::ConnectionException,
+                      amps_ssl_get_error());
       return NULL;
     }
+    Py_INCREF(Py_None);
+    return Py_None;
+  }
 
-    return ssl_init_internal(dll_name);
+  PyObject* ssl_init(PyObject* self, PyObject* args)
+  {
+    return ampspy_ssl_init(self, args);
   }
 
   PyObject* ssl_set_verify(PyObject* self, PyObject* args)
@@ -560,6 +1129,85 @@ failure:
                     amps_ssl_get_error());
     return NULL;
   }
+#else
+  int ampspy_ssl_set_verify(int mode_)
+  {
+    PyObject* pyVm = PyObject_GetAttrString(_ampspy_ssl_module, "VerifyMode");
+    PyObject* pyVerifyMode;
+    if (mode_ == 0)
+    {
+      pyVerifyMode = PyObject_GetAttrString(pyVm, "CERT_NONE");
+    }
+    else
+    {
+      pyVerifyMode = PyObject_GetAttrString(pyVm, "CERT_REQUIRED");
+    }
+    int rc = PyObject_SetAttrString(_ampspy_ssl_context, "verify_mode", pyVerifyMode);
+    Py_XDECREF(pyVm);
+    Py_XDECREF(pyVerifyMode);
+    return rc;
+  }
+
+  PyObject* ampspy_ssl_init(PyObject* self, PyObject* args, PyObject* kwds)
+  {
+    static const char* kwargs[] = { "dll_name", "ssl_context", "strict_ciphers_only", NULL };
+    const char* dll_name = NULL;
+    PyObject* ssl_context = NULL;
+    int strict_ciphers_only = 0;
+    if (self && args)
+    {
+      if (!PyArg_ParseTupleAndKeywords(args, kwds, "|sOi", (char**)kwargs,
+                                       &dll_name, &ssl_context, &strict_ciphers_only))
+      {
+        return NULL;
+      }
+    }
+
+    return ssl_init_internal(dll_name, ssl_context, strict_ciphers_only != 0);
+  }
+
+  PyObject* ssl_init(PyObject* self, PyObject* args, PyObject* kwds)
+  {
+    // If this is called repeatedly, want to make sure that verify mode
+    // gets reset to expected value after init.
+    PyObject* ret = ampspy_ssl_init(self, args, kwds);
+    if (ret && _ampspy_ssl_module)
+    {
+      ampspy_ssl_set_verify(0);
+    }
+    return ret;
+  }
+
+  PyObject* ssl_set_verify(PyObject* self, PyObject* args)
+  {
+    int mode = 0;
+    if (!PyArg_ParseTuple(args, "i", &mode))
+    {
+      return NULL;
+    }
+
+    if (_ampspy_ssl_module)
+    {
+      if (0 == ampspy_ssl_set_verify(mode))
+      {
+        Py_INCREF(Py_None);
+        return Py_None;
+      }
+    }
+    else
+    {
+      if (0 == amps_ssl_set_verify(mode ? 1 : 0))
+      {
+        Py_INCREF(Py_None);
+        return Py_None;
+      }
+    }
+
+    PyErr_SetString(ampspy::exc::ConnectionException,
+                    amps_ssl_get_error());
+    return NULL;
+  }
+#endif
 
   PyObject* ssl_load_verify_locations(PyObject* self, PyObject* args)
   {
@@ -646,6 +1294,7 @@ void* copy_route_function(void* vpData_)
 static PyMethodDef AMPSMethods[] =
 {
   {ampspy::shims::g_shimExitFuncName, (PyCFunction)ampspy::shims::_shimExitFunc, METH_NOARGS, ""},
+#if PY_MAJOR_VERSION < 3
   {
     "ssl_init",
     (PyCFunction)ampspy::ssl_init, METH_VARARGS,
@@ -653,6 +1302,27 @@ static PyMethodDef AMPSMethods[] =
     ":param dllpath: The path to the OpenSSL DLL or shared library to use for\n"
     "                SSL functionality."
   },
+#else
+  {
+    "ssl_init",
+    (PyCFunction)ampspy::ssl_init, METH_VARARGS | METH_KEYWORDS,
+    "Initializes SSL support in the AMPS module.\n\n"
+    ":param dllpath: The path to the OpenSSL DLL or shared library to use for\n"
+    "                SSL functionality.\n"
+    ":param ssl_context: An ssl.SSLContext preconfigured with desired settings\n"
+    "                    for tcps connections to the AMPS server.\n"
+    ":param strict_ciphers_only: If True, use only the stricter ciphers allowed\n"
+    "                            by default in Python version 3.10 and above. The\n"
+    "                            default is False, which enables all default\n"
+    "                            OpenSSL ciphers for compatibility with some AMPS\n"
+    "                            versions using older OpenSSL libraries.\n"
+  },
+  {
+    "ssl_get_context",
+    (PyCFunction)ampspy::ssl_get_context, METH_VARARGS,
+    "Returns the SSLContext used for SSL connections. Call ssl_init first.\n\n"
+  },
+#endif
   {
     "ssl_set_verify",
     (PyCFunction)ampspy::ssl_set_verify, METH_VARARGS,