Bug 12775, allow more blocking OpenSSL functions to run without GIL, by Miloslav Trmac. This bumps swig dependency to >= 1.3.28.

git-svn-id: http://svn.osafoundation.org/m2crypto/trunk@695 2715db39-9adf-0310-9c64-84f055769b4b

12 files changed, 169 insertions, 9 deletions

diff --git a/SWIG/_asn1.i b/SWIG/_asn1.i
index ff2cb81..fc53e27 100644
--- a/SWIG/_asn1.i
+++ b/SWIG/_asn1.i
@@ -60,7 +60,9 @@ extern int ASN1_STRING_set( ASN1_STRING *, const void *, int);
 %typemap(in) (const void *, int);
 
 %rename(asn1_string_print) ASN1_STRING_print;
+%threadallow ASN1_STRING_print;
 extern int ASN1_STRING_print(BIO *, ASN1_STRING *);
+%threadallow ASN1_STRING_print_ex;
 %rename(asn1_string_print_ex) ASN1_STRING_print_ex;
 extern int ASN1_STRING_print_ex(BIO *, ASN1_STRING *, unsigned long);
 
@@ -75,6 +77,7 @@ extern ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *, long);
 %rename(asn1_utctime_set_string) ASN1_UTCTIME_set_string;
 extern int ASN1_UTCTIME_set_string(ASN1_UTCTIME *, CONST098 char *);
 %rename(asn1_utctime_print) ASN1_UTCTIME_print;
+%threadallow ASN1_UTCTIME_print;
 extern int ASN1_UTCTIME_print(BIO *, ASN1_UTCTIME *);
 
 %rename(asn1_integer_new) ASN1_INTEGER_new;
diff --git a/SWIG/_bio.i b/SWIG/_bio.i
index 3233d02..bae3453 100644
--- a/SWIG/_bio.i
+++ b/SWIG/_bio.i
@@ -38,8 +38,10 @@ extern BIO *BIO_new_fp(FILE *, int);
 %rename(bio_new_file) BIO_new_file;
 extern BIO *BIO_new_file(const char *, const char *);
 %rename(bio_free) BIO_free;
+%threadallow BIO_free;
 extern int BIO_free(BIO *);
 %rename(bio_free_all) BIO_free_all;
+%threadallow BIO_free_all;
 extern void BIO_free_all(BIO *);
 %rename(bio_dup_chain) BIO_dup_chain;
 extern BIO *BIO_dup_chain(BIO *);
@@ -152,7 +154,10 @@ int bio_ctrl_get_write_guarantee(BIO *a) {
 int bio_reset(BIO *bio) {
     return (int)BIO_reset(bio);
 }
+%}
 
+%threadallow bio_flush;
+%inline %{
 int bio_flush(BIO *bio) {
     return (int)BIO_flush(bio);
 }
@@ -190,7 +195,10 @@ int bio_set_mem_eof_return(BIO *b, int v) {
 int bio_get_fd(BIO *bio) {
     return BIO_get_fd(bio, NULL);
 }
+%}
 
+%threadallow bio_do_handshake;
+%inline %{
 int bio_do_handshake(BIO *bio) {
     return BIO_do_handshake(bio);
 }
diff --git a/SWIG/_dh.i b/SWIG/_dh.i
index 9752025..6083d4e 100644
--- a/SWIG/_dh.i
+++ b/SWIG/_dh.i
@@ -20,6 +20,7 @@ extern int DH_size(const DH *);
 %rename(dh_generate_key) DH_generate_key;
 extern int DH_generate_key(DH *);
 %rename(dhparams_print) DHparams_print;
+%threadallow DHparams_print;
 extern int DHparams_print(BIO *, const DH *);
 
 %constant int dh_check_ok             = 0;
@@ -44,7 +45,10 @@ int dh_type_check(DH *dh) {
     XXX Still need to check the pointer for sanity? */
     return 1;
 }
+%}
 
+%threadallow dh_read_parameters;
+%inline %{
 DH *dh_read_parameters(BIO *bio) {
     return PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
 }
diff --git a/SWIG/_dsa.i b/SWIG/_dsa.i
index 3ebd169..81e9795 100644
--- a/SWIG/_dsa.i
+++ b/SWIG/_dsa.i
@@ -153,7 +153,10 @@ PyObject *dsa_set_g(DSA *dsa, PyObject *value) {
     Py_INCREF(Py_None);
     return Py_None;
 }
+%}
 
+%threadallow dsa_read_params;
+%inline %{
 DSA *dsa_read_params(BIO *f, PyObject *pyfunc) {
     DSA *ret;
 
@@ -162,11 +165,17 @@ DSA *dsa_read_params(BIO *f, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow dsa_write_params_bio;
+%inline %{
 int dsa_write_params_bio(DSA* dsa, BIO* f) {
     return PEM_write_bio_DSAparams(f, dsa);
 }
+%}
 
+%threadallow dsa_write_key_bio;
+%inline %{
 int dsa_write_key_bio(DSA* dsa, BIO* f, EVP_CIPHER *cipher, PyObject *pyfunc) {
     int ret;
 
@@ -176,7 +185,10 @@ int dsa_write_key_bio(DSA* dsa, BIO* f, EVP_CIPHER *cipher, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow dsa_write_key_bio_no_cipher;
+%inline %{
 int dsa_write_key_bio_no_cipher(DSA* dsa, BIO* f, PyObject *pyfunc) {
     int ret;
 
@@ -186,11 +198,17 @@ int dsa_write_key_bio_no_cipher(DSA* dsa, BIO* f, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow dsa_write_pub_key_bio;
+%inline %{
 int dsa_write_pub_key_bio(DSA* dsa, BIO* f) {
     return PEM_write_bio_DSA_PUBKEY(f, dsa);
 }
+%}
 
+%threadallow dsa_read_key;
+%inline %{
 DSA *dsa_read_key(BIO *f, PyObject *pyfunc) {
     DSA *ret;
 
@@ -199,7 +217,10 @@ DSA *dsa_read_key(BIO *f, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow dsa_read_pub_key;
+%inline %{
 DSA *dsa_read_pub_key(BIO *f, PyObject *pyfunc) {
     DSA *ret;
 
diff --git a/SWIG/_ec.i b/SWIG/_ec.i
index ee2fed8..a9383c1 100644
--- a/SWIG/_ec.i
+++ b/SWIG/_ec.i
@@ -189,15 +189,24 @@ PyObject *ec_key_get_public_der(EC_KEY *key) {
 
     return pyo;
 }
+%}
 
+%threadallow ec_key_read_pubkey;
+%inline %{
 EC_KEY *ec_key_read_pubkey(BIO *f) {
     return PEM_read_bio_EC_PUBKEY(f, NULL, NULL, NULL);   
 }
+%}
 
+%threadallow ec_key_write_pubkey;
+%inline %{
 int ec_key_write_pubkey(EC_KEY *key, BIO *f) {
     return PEM_write_bio_EC_PUBKEY(f, key );
 }
+%}
 
+%threadallow ec_key_read_bio;
+%inline %{
 EC_KEY *ec_key_read_bio(BIO *f, PyObject *pyfunc) {
     EC_KEY *ret;
 
@@ -206,7 +215,10 @@ EC_KEY *ec_key_read_bio(BIO *f, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow ec_key_write_bio;
+%inline %{
 int ec_key_write_bio(EC_KEY *key, BIO *f, EVP_CIPHER *cipher, PyObject *pyfunc) {
     int ret;
 
@@ -216,7 +228,10 @@ int ec_key_write_bio(EC_KEY *key, BIO *f, EVP_CIPHER *cipher, PyObject *pyfunc)
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow ec_key_write_bio_no_cipher;
+%inline %{
 int ec_key_write_bio_no_cipher(EC_KEY *key, BIO *f, PyObject *pyfunc) {
     int ret;
 
diff --git a/SWIG/_evp.i b/SWIG/_evp.i
index d05b44b..2d4645f 100644
--- a/SWIG/_evp.i
+++ b/SWIG/_evp.i
@@ -461,7 +461,10 @@ int verify_final(EVP_MD_CTX *ctx, PyObject *blob, EVP_PKEY *pkey) {
 
     return EVP_VerifyFinal(ctx, kbuf, len, pkey);
 }
+%}
 
+%threadallow pkey_write_pem_no_cipher;
+%inline %{
 int pkey_write_pem_no_cipher(EVP_PKEY *pkey, BIO *f, PyObject *pyfunc) {
     int ret;
 
@@ -471,7 +474,10 @@ int pkey_write_pem_no_cipher(EVP_PKEY *pkey, BIO *f, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow pkey_write_pem;
+%inline %{
 int pkey_write_pem(EVP_PKEY *pkey, BIO *f, EVP_CIPHER *cipher, PyObject *pyfunc) {
     int ret;
 
@@ -481,7 +487,10 @@ int pkey_write_pem(EVP_PKEY *pkey, BIO *f, EVP_CIPHER *cipher, PyObject *pyfunc)
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow pkey_read_pem;
+%inline %{
 EVP_PKEY *pkey_read_pem(BIO *f, PyObject *pyfunc) {
     EVP_PKEY *pk;
 
diff --git a/SWIG/_lib.i b/SWIG/_lib.i
index b5084e8..2eaa9fa 100644
--- a/SWIG/_lib.i
+++ b/SWIG/_lib.i
@@ -264,23 +264,20 @@ int passphrase_callback(char *buf, int num, int v, void *arg) {
     Py_ssize_t len;
     char *str;
     PyObject *argv, *ret, *cbfunc;
+    PyGILState_STATE gilstate;
 
-    /* NOTE: This should not acquire the GIL, as was discovered in bug 11813
-     * by Keith Jackson:
-     * "rsa_write_key in _rsa.i calls PEM_write_bio_RSAPrivateKey which if you
-     * look at the openssl code calls the callback function passed into it. 
-     * We never give up the GIL in rsa_write_key so trying to acquire it again
-     * in the callback is going to result in deadlock"
-     */
+    gilstate = PyGILState_Ensure();
     cbfunc = (PyObject *)arg;
     argv = Py_BuildValue("(i)", v);
     ret = PyEval_CallObject(cbfunc, argv);
     Py_DECREF(argv);
     if (ret == NULL) {
+        PyGILState_Release(gilstate);
         return -1;
     }
     if (!PyString_Check(ret)) {
         Py_DECREF(ret);
+        PyGILState_Release(gilstate);
         return -1;
     }
     if ((len = PyString_Size(ret)) > num)
@@ -289,6 +286,7 @@ int passphrase_callback(char *buf, int num, int v, void *arg) {
     for (i = 0; i < len; i++)
         buf[i] = str[i];
     Py_DECREF(ret);
+    PyGILState_Release(gilstate);
     return len;
 }
 %}
@@ -496,8 +494,10 @@ BIGNUM *dec_to_bn(PyObject *value) {
 /* A bunch of "straight-thru" functions. */
 
 %rename(err_print_errors_fp) ERR_print_errors_fp;
+%threadallow ERR_print_errors_fp;
 extern void ERR_print_errors_fp(FILE *);
 %rename(err_print_errors) ERR_print_errors;
+%threadallow ERR_print_errors;
 extern void ERR_print_errors(BIO *);
 %rename(err_get_error) ERR_get_error;
 extern unsigned long ERR_get_error(void);
diff --git a/SWIG/_m2crypto.i b/SWIG/_m2crypto.i
index c061ea8..f13418f 100644
--- a/SWIG/_m2crypto.i
+++ b/SWIG/_m2crypto.i
@@ -5,7 +5,12 @@
  * Copyright (C) 2004-2006 OSAF. All Rights Reserved.
  */
 
-%module _m2crypto
+%module(threads=1) _m2crypto
+/* We really don't need threadblock (PyGILState_Ensure() etc.) anywhere.
+   Disable threadallow as well, only enable it for operations likely to
+   block. */
+%nothreadblock;
+%nothreadallow;
 
 %{
 #include <openssl/err.h>
diff --git a/SWIG/_pkcs7.i b/SWIG/_pkcs7.i
index 68dea7c..32b9ab6 100644
--- a/SWIG/_pkcs7.i
+++ b/SWIG/_pkcs7.i
@@ -50,7 +50,10 @@ void smime_init(PyObject *smime_err) {
     Py_INCREF(smime_err);
     _smime_err = smime_err;
 }
+%}
 
+%threadallow pkcs7_encrypt;
+%inline %{
 PKCS7 *pkcs7_encrypt(STACK *stack, BIO *bio, EVP_CIPHER *cipher, int flags) {
     return PKCS7_encrypt((STACK_OF(X509) *)stack, bio, cipher, flags);
 }
@@ -82,15 +85,24 @@ PyObject *pkcs7_decrypt(PKCS7 *pkcs7, EVP_PKEY *pkey, X509 *cert, int flags) {
     PyMem_Free(outbuf);
     return ret;
 }
+%}
 
+%threadallow pkcs7_sign0;
+%inline %{
 PKCS7 *pkcs7_sign0(X509 *x509, EVP_PKEY *pkey, BIO *bio, int flags) {
     return PKCS7_sign(x509, pkey, NULL, bio, flags);
 }
+%}
 
+%threadallow pkcs7_sign1;
+%inline %{
 PKCS7 *pkcs7_sign1(X509 *x509, EVP_PKEY *pkey, STACK *stack, BIO *bio, int flags) {
     return PKCS7_sign(x509, pkey, (STACK_OF(X509) *)stack, bio, flags);
 }
+%}
 
+%threadallow pkcs7_verify1;
+%inline %{
 PyObject *pkcs7_verify1(PKCS7 *pkcs7, STACK *stack, X509_STORE *store, BIO *data, int flags) {
     int outlen;
     char *outbuf;
@@ -122,11 +134,17 @@ PyObject *pkcs7_verify1(PKCS7 *pkcs7, STACK *stack, X509_STORE *store, BIO *data
 PyObject *pkcs7_verify0(PKCS7 *pkcs7, STACK *stack, X509_STORE *store, int flags) {
     return pkcs7_verify1(pkcs7, stack, store, NULL, flags);
 }
+%}
 
+%threadallow smime_write_pkcs7_multi;
+%inline %{
 int smime_write_pkcs7_multi(BIO *bio, PKCS7 *pkcs7, BIO *data, int flags) {
     return SMIME_write_PKCS7(bio, pkcs7, data, flags | PKCS7_DETACHED);
 }
+%}
 
+%threadallow smime_write_pkcs7;
+%inline %{
 int smime_write_pkcs7(BIO *bio, PKCS7 *pkcs7, int flags) {
     return SMIME_write_PKCS7(bio, pkcs7, NULL, flags);
 }
@@ -144,7 +162,10 @@ PyObject *smime_read_pkcs7(BIO *bio) {
         BIO_set_mem_eof_return(bio, 0);
     }
 
-    if (!(p7=SMIME_read_PKCS7(bio, &bcont))) {
+    Py_BEGIN_ALLOW_THREADS
+    p7=SMIME_read_PKCS7(bio, &bcont);
+    Py_END_ALLOW_THREADS
+    if (!p7) {
         PyErr_SetString(_smime_err, ERR_reason_error_string(ERR_get_error()));
         return NULL;
     }
@@ -163,19 +184,31 @@ PyObject *smime_read_pkcs7(BIO *bio) {
     }
     return tuple;
 }
+%}
 
+%threadallow pkcs7_read_bio;
+%inline %{
 PKCS7 *pkcs7_read_bio(BIO *bio) {
     return PEM_read_bio_PKCS7(bio, NULL, NULL, NULL);
 }
+%}
 
+%threadallow pkcs7_read_bio_der;
+%inline %{
 PKCS7 *pkcs7_read_bio_der(BIO *bio) {
     return d2i_PKCS7_bio(bio, NULL);
 }
+%}
 
+%threadallow pkcs7_write_bio;
+%inline %{
 int pkcs7_write_bio(PKCS7 *pkcs7, BIO* bio) {
     return PEM_write_bio_PKCS7(bio, pkcs7);
 }
+%}
 
+%threadallow pkcs7_write_bio_der;
+%inline %{
 int pkcs7_write_bio_der(PKCS7 *pkcs7, BIO *bio) {
     return i2d_PKCS7_bio(bio, pkcs7);
 }
@@ -187,7 +220,10 @@ int pkcs7_type_nid(PKCS7 *pkcs7) {
 const char *pkcs7_type_sn(PKCS7 *pkcs7) {
     return OBJ_nid2sn(OBJ_obj2nid(pkcs7->type));
 }
+%}
 
+%threadallow smime_crlf_copy;
+%inline %{
 int smime_crlf_copy(BIO *in, BIO *out) {
     return SMIME_crlf_copy(in, out, PKCS7_TEXT);
 }
diff --git a/SWIG/_rsa.i b/SWIG/_rsa.i
index 7580c45..2e219b9 100644
--- a/SWIG/_rsa.i
+++ b/SWIG/_rsa.i
@@ -46,7 +46,10 @@ void rsa_init(PyObject *rsa_err) {
     Py_INCREF(rsa_err);
     _rsa_err = rsa_err;
 }
+%}
 
+%threadallow rsa_read_key;
+%inline %{
 RSA *rsa_read_key(BIO *f, PyObject *pyfunc) {
     RSA *rsa;
 
@@ -55,7 +58,10 @@ RSA *rsa_read_key(BIO *f, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return rsa;
 }
+%}
 
+%threadallow rsa_write_key;
+%inline %{
 int rsa_write_key(RSA *rsa, BIO *f, EVP_CIPHER *cipher, PyObject *pyfunc) {
     int ret;
 
@@ -65,7 +71,10 @@ int rsa_write_key(RSA *rsa, BIO *f, EVP_CIPHER *cipher, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow rsa_write_key_no_cipher;
+%inline %{
 int rsa_write_key_no_cipher(RSA *rsa, BIO *f, PyObject *pyfunc) {
     int ret;
 
@@ -75,11 +84,17 @@ int rsa_write_key_no_cipher(RSA *rsa, BIO *f, PyObject *pyfunc) {
     Py_DECREF(pyfunc);
     return ret;
 }
+%}
 
+%threadallow rsa_read_pub_key;
+%inline %{
 RSA *rsa_read_pub_key(BIO *f) {
     return PEM_read_bio_RSA_PUBKEY(f, NULL, NULL, NULL);   
 }
+%}
 
+%threadallow rsa_write_pub_key;
+%inline %{
 int rsa_write_pub_key(RSA *rsa, BIO *f) {
     return PEM_write_bio_RSA_PUBKEY(f, rsa);
 }
@@ -419,7 +434,10 @@ int rsa_type_check(RSA *rsa) {
 int rsa_check_pub_key(RSA *rsa) {
     return (rsa->e) && (rsa->n);
 }
+%}
 
+%threadallow rsa_write_key_der;
+%inline %{
 int rsa_write_key_der(RSA *rsa, BIO *bio) {
     return i2d_RSAPrivateKey_bio(bio, rsa);
 }
diff --git a/SWIG/_ssl.i b/SWIG/_ssl.i
index 7da1800..0930e12 100644
--- a/SWIG/_ssl.i
+++ b/SWIG/_ssl.i
@@ -79,6 +79,7 @@ extern BIO *BIO_new_ssl(SSL_CTX *, int);
 %rename(ssl_new) SSL_new;
 extern SSL *SSL_new(SSL_CTX *);
 %rename(ssl_free) SSL_free;
+%threadallow SSL_free;
 extern void SSL_free(SSL *);
 %rename(ssl_dup) SSL_dup;
 extern SSL *SSL_dup(SSL *);
@@ -93,12 +94,15 @@ extern int SSL_get_shutdown(CONST SSL *);
 %rename(ssl_set_shutdown) SSL_set_shutdown;
 extern void SSL_set_shutdown(SSL *, int);
 %rename(ssl_shutdown) SSL_shutdown;
+%threadallow SSL_shutdown;
 extern int SSL_shutdown(SSL *);
 %rename(ssl_clear) SSL_clear;
 extern int SSL_clear(SSL *);
 %rename(ssl_do_handshake) SSL_do_handshake;
+%threadallow SSL_do_handshake;
 extern int SSL_do_handshake(SSL *);
 %rename(ssl_renegotiate) SSL_renegotiate;
+%threadallow SSL_renegotiate;
 extern int SSL_renegotiate(SSL *);
 %rename(ssl_pending) SSL_pending;
 extern int SSL_pending(CONST SSL *);
@@ -137,6 +141,7 @@ extern int SSL_set_session(SSL *, SSL_SESSION *);
 %rename(ssl_session_free) SSL_SESSION_free;
 extern void SSL_SESSION_free(SSL_SESSION *);
 %rename(ssl_session_print) SSL_SESSION_print;
+%threadallow SSL_SESSION_print;
 extern int SSL_SESSION_print(BIO *, CONST SSL_SESSION *);
 %rename(ssl_session_set_timeout) SSL_SESSION_set_timeout;
 extern long SSL_SESSION_set_timeout(SSL_SESSION *, long);
@@ -686,15 +691,24 @@ int sk_x509_num(STACK *stack) {
 X509 *sk_x509_value(STACK *stack, int idx) {
     return (X509 *)sk_value(stack, idx);
 }
+%}
 
+%threadallow i2d_ssl_session;
+%inline %{
 void i2d_ssl_session(BIO *bio, SSL_SESSION *sess) {
     i2d_SSL_SESSION_bio(bio, sess);
 }
+%}
 
+%threadallow ssl_session_read_pem;
+%inline %{
 SSL_SESSION *ssl_session_read_pem(BIO *bio) {
     return PEM_read_bio_SSL_SESSION(bio, NULL, NULL, NULL);
 }
+%}
 
+%threadallow ssl_session_write_pem;
+%inline %{
 int ssl_session_write_pem(SSL_SESSION *sess, BIO *bio) {
     return PEM_write_bio_SSL_SESSION(bio, sess);
 }
diff --git a/SWIG/_x509.i b/SWIG/_x509.i
index 865e62f..99affed 100644
--- a/SWIG/_x509.i
+++ b/SWIG/_x509.i
@@ -36,8 +36,10 @@ extern void X509_CRL_free(X509_CRL *);
 extern X509_CRL * X509_CRL_new();
 
 %rename(x509_print) X509_print;
+%threadallow X509_print;
 extern int X509_print(BIO *, X509 *);
 %rename(x509_crl_print) X509_CRL_print;
+%threadallow X509_CRL_print;
 extern int X509_CRL_print(BIO *, X509_CRL *);
 
 %rename(x509_get_serial_number) X509_get_serialNumber;
@@ -96,6 +98,7 @@ extern int X509_check_purpose(X509 *, int, int);
 extern int X509_check_trust(X509 *, int, int);
 
 %rename(x509_write_pem) PEM_write_bio_X509;
+%threadallow PEM_write_bio_X509;
 extern int PEM_write_bio_X509(BIO *, X509 *);
 %rename(x509_write_pem_file) PEM_write_X509;
 extern int PEM_write_X509(FILE *, X509 *);
@@ -118,6 +121,7 @@ extern int X509_get_ext_count(X509 *);
 %rename(x509_get_ext) X509_get_ext;
 extern X509_EXTENSION *X509_get_ext(X509 *, int);
 %rename(x509_ext_print) X509V3_EXT_print;
+%threadallow X509V3_EXT_print;
 extern int X509V3_EXT_print(BIO *, X509_EXTENSION *, unsigned long, int);
 
 %rename(x509_name_new) X509_NAME_new;
@@ -125,6 +129,7 @@ extern X509_NAME *X509_NAME_new( void );
 %rename(x509_name_free) X509_NAME_free;
 extern void X509_NAME_free(X509_NAME *);
 %rename(x509_name_print) X509_NAME_print;
+%threadallow X509_NAME_print;
 extern int X509_NAME_print(BIO *, X509_NAME *, int);
 %rename(x509_name_get_entry) X509_NAME_get_entry;
 extern X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *, int);
@@ -139,6 +144,7 @@ extern int X509_NAME_add_entry_by_OBJ(X509_NAME *, ASN1_OBJECT *, int, unsigned
 %rename(x509_name_add_entry_by_nid) X509_NAME_add_entry_by_NID;
 extern int X509_NAME_add_entry_by_NID(X509_NAME *, int, int, unsigned char *, int, int, int );
 %rename(x509_name_print_ex) X509_NAME_print_ex;
+%threadallow X509_NAME_print_ex;
 extern int X509_NAME_print_ex(BIO *, X509_NAME *, int, unsigned long);
 %rename(x509_name_print_ex_fp) X509_NAME_print_ex_fp;
 extern int X509_NAME_print_ex_fp(FILE *, X509_NAME *, int, unsigned long);
@@ -186,6 +192,7 @@ extern X509_REQ * X509_REQ_new();
 %rename(x509_req_free) X509_REQ_free;
 extern void X509_REQ_free(X509_REQ *);
 %rename(x509_req_print) X509_REQ_print;
+%threadallow X509_REQ_print;
 extern int X509_REQ_print(BIO *, X509_REQ *);
 
 %rename(x509_req_get_pubkey) X509_REQ_get_pubkey;
@@ -201,8 +208,10 @@ extern int X509_REQ_verify(X509_REQ *, EVP_PKEY *);
 extern int X509_REQ_sign(X509_REQ *, EVP_PKEY *, const EVP_MD *);
 
 %rename(i2d_x509_bio) i2d_X509_bio;
+%threadallow i2d_X509_bio;
 extern int i2d_X509_bio(BIO *, X509 *);
 %rename(i2d_x509_req_bio) i2d_X509_REQ_bio;
+%threadallow i2d_X509_REQ_bio;
 extern int i2d_X509_REQ_bio(BIO *, X509_REQ *);
 
 %rename(x509_store_new) X509_STORE_new;
@@ -307,15 +316,24 @@ void x509_init(PyObject *x509_err) {
     Py_INCREF(x509_err);
     _x509_err = x509_err;
 }
+%}
 
+%threadallow x509_read_pem;
+%inline %{
 X509 *x509_read_pem(BIO *bio) {
     return PEM_read_bio_X509(bio, NULL, NULL, NULL);
 }
+%}
 
+%threadallow d2i_x509;
+%inline %{
 X509 *d2i_x509(BIO *bio) {
     return d2i_X509_bio(bio, NULL);
 }
+%}
 
+%threadallow d2i_x509_req;
+%inline %{
 X509_REQ *d2i_x509_req(BIO *bio) {
     return d2i_X509_REQ_bio(bio, NULL);
 }
@@ -335,15 +353,24 @@ PyObject *i2d_x509(X509 *x)
     }
     return ret;
 }
+%}
 
+%threadallow x509_req_read_pem;
+%inline %{
 X509_REQ *x509_req_read_pem(BIO *bio) {
     return PEM_read_bio_X509_REQ(bio, NULL, NULL, NULL);
 }
+%}
 
+%threadallow x509_req_write_pem;
+%inline %{
 int x509_req_write_pem(BIO *bio, X509_REQ *x) {
     return PEM_write_bio_X509_REQ(bio, x);
 }
+%}
 
+%threadallow x509_crl_read_pem;
+%inline %{
 X509_CRL *x509_crl_read_pem(BIO *bio) {
     return PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL);
 }