Method _wrap_socket

crates/stdlib/src/openssl.rs:2096–2156

(
            zelf: PyRef<Self>,
            args: WrapSocketArgs,
            vm: &VirtualMachine,
        )

        #[pymethod]
        fn _wrap_socket(
            zelf: PyRef<Self>,
            args: WrapSocketArgs,
            vm: &VirtualMachine,
        ) -> PyResult<PyObjectRef> {
            // Use common helper function
            let (ssl, socket_type, server_hostname) =
                Self::new_py_ssl_socket(zelf.clone(), args.server_side, args.server_hostname, vm)?;

            // Create SslStream with socket
            let stream = ssl::SslStream::new(ssl, SocketStream(args.sock.clone()))
                .map_err(|e| convert_openssl_error(vm, e))?;

            let py_ssl_socket = PySslSocket {
                ctx: PyRwLock::new(zelf.clone()),
                connection: PyRwLock::new(SslConnection::Socket(stream)),
                socket_type,
                server_hostname,
                owner: PyRwLock::new(args.owner.map(|o| o.downgrade(None, vm)).transpose()?),
            };

            // Convert to PyRef (heap allocation) to avoid use-after-free
            let py_ref =
                py_ssl_socket.into_ref_with_type(vm, PySslSocket::class(&vm.ctx).to_owned())?;

            // Check if SNI callback is configured (minimize lock time)
            let has_sni_callback = zelf.sni_callback.lock().is_some();

            // Set up ex_data for callbacks
            unsafe {
                let ssl_ptr = py_ref.connection.read().ssl().as_ptr();

                // Clone and store via into_raw() - increments refcount and returns stable pointer
                // The refcount will be decremented by msg_callback_data_free when SSL is freed
                let cloned: PyObjectRef = py_ref.clone().into();
                let raw_ptr = cloned.into_raw();
                let msg_cb_idx = get_msg_callback_ex_data_index();
                sys::SSL_set_ex_data(ssl_ptr, msg_cb_idx, raw_ptr.as_ptr() as *mut _);

                // Set SNI callback data if needed
                if has_sni_callback {
                    let ssl_socket_weak = py_ref.as_object().downgrade(None, vm)?;
                    // Store callback data in SSL ex_data - use weak reference to avoid cycle
                    let callback_data = Box::new(SniCallbackData {
                        ssl_context: zelf.clone(),
                        ssl_socket_weak,
                    });
                    let sni_idx = get_sni_ex_data_index();
                    sys::SSL_set_ex_data(ssl_ptr, sni_idx, Box::into_raw(callback_data) as *mut _);
                }
            }

            // Set session if provided
            if let Some(session) = args.session
                && !vm.is_none(&session)
            {
                py_ref.set_session(session, vm)?;
            }