Differences From Artifact [96271aec1e]:
- File
src/SSLSocket.m
— part of check-in
[0326ada0ff]
at
2016-07-09 20:19:20
on branch trunk
— Change webkeks.org -> heap.zone
While at it, also update the copyright years where they were incomplete. (user: js, size: 10442) [annotate] [blame] [check-ins using]
To Artifact [3b375c6852]:
- File
src/SSLSocket.m
— part of check-in
[74db1e8212]
at
2016-07-09 21:24:03
on branch trunk
— Add SSLConnectionFailedException
This way, when an SSLSocket is passed where an OFTCPSocket is expected,
the description will still contain the error and no special code for
SSLSocket is necessary. (user: js, size: 11141) [annotate] [blame] [check-ins using]
| ︙ | ︙ | |||
30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 | #if defined(__clang__) # pragma clang diagnostic push # pragma clang diagnostic ignored "-Wdocumentation" #endif #include <openssl/crypto.h> #include <openssl/err.h> #include <openssl/x509v3.h> #if defined(__clang__) # pragma clang diagnostic pop #endif #import <ObjFW/OFThread.h> #import <ObjFW/OFHTTPRequest.h> #import <ObjFW/OFDataArray.h> #import <ObjFW/OFSystemInfo.h> #import <ObjFW/OFAcceptFailedException.h> | > < < > > > | 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 | #if defined(__clang__) # pragma clang diagnostic push # pragma clang diagnostic ignored "-Wdocumentation" #endif #include <openssl/crypto.h> #include <openssl/err.h> #include <openssl/ssl.h> #include <openssl/x509v3.h> #if defined(__clang__) # pragma clang diagnostic pop #endif #import <ObjFW/OFThread.h> #import <ObjFW/OFHTTPRequest.h> #import <ObjFW/OFDataArray.h> #import <ObjFW/OFSystemInfo.h> #import <ObjFW/OFAcceptFailedException.h> #import <ObjFW/OFInitializationFailedException.h> #import <ObjFW/OFInvalidArgumentException.h> #import <ObjFW/OFNotOpenException.h> #import <ObjFW/OFOutOfRangeException.h> #import <ObjFW/OFReadFailedException.h> #import <ObjFW/OFWriteFailedException.h> #import <ObjFW/macros.h> #import <ObjFW/threading.h> #import "SSLSocket.h" #import "X509Certificate.h" #import "SSLConnectionFailedException.h" #import "SSLInvalidCertificateException.h" #ifndef INVALID_SOCKET # define INVALID_SOCKET -1 #endif static SSL_CTX *ctx; static of_mutex_t *ssl_mutexes; |
| ︙ | ︙ | |||
171 172 173 174 175 176 177 |
}
- (void)SSL_startTLSWithExpectedHost: (OFString*)host
port: (uint16_t)port
{
of_string_encoding_t encoding;
| | > > > | | > | > > > > | | > > | > > > | | > > > > > > > > > > > > > > > > > > > > > > | 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 |
}
- (void)SSL_startTLSWithExpectedHost: (OFString*)host
port: (uint16_t)port
{
of_string_encoding_t encoding;
if ((_SSL = SSL_new(ctx)) == NULL || SSL_set_fd(_SSL, _socket) != 1) {
unsigned long error = ERR_get_error();
[super close];
@throw [SSLConnectionFailedException
exceptionWithHost: host
port: port
socket: self
SSLError: error];
}
if (_certificateVerificationEnabled) {
X509_VERIFY_PARAM *param = SSL_get0_param(_SSL);
X509_VERIFY_PARAM_set_hostflags(param,
X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
if (X509_VERIFY_PARAM_set1_host(param,
[host UTF8String], [host UTF8StringLength]) != 1) {
unsigned long error = ERR_get_error();
[self close];
@throw [SSLConnectionFailedException
exceptionWithHost: host
port: port
socket: self
SSLError: error];
}
SSL_set_verify(_SSL, SSL_VERIFY_PEER, NULL);
}
SSL_set_connect_state(_SSL);
encoding = [OFSystemInfo native8BitEncoding];
if ((_privateKeyFile != nil && !SSL_use_PrivateKey_file(_SSL,
[_privateKeyFile cStringWithEncoding: encoding],
SSL_FILETYPE_PEM)) || (_certificateFile != nil &&
!SSL_use_certificate_file(_SSL, [_certificateFile
cStringWithEncoding: encoding],
SSL_FILETYPE_PEM))) {
unsigned long error = ERR_get_error();
[super close];
@throw [SSLConnectionFailedException
exceptionWithHost: host
port: port
socket: self
SSLError: error];
}
if (SSL_connect(_SSL) != 1) {
unsigned long error = ERR_get_error();
long res;
[super close];
if ((res = SSL_get_verify_result(_SSL)) != X509_V_OK)
@throw [SSLConnectionFailedException
exceptionWithHost: host
port: port
socket: self
SSLError: error
verifyResult: res];
else
@throw [SSLConnectionFailedException
exceptionWithHost: host
port: port
socket: self
SSLError: error];
}
}
- (void)startTLSWithExpectedHost: (OFString*)host
{
[self SSL_startTLSWithExpectedHost: host
port: 0];
|
| ︙ | ︙ |