ObjOpenSSL  Check-in [897afb173c]

	unsigned long _SSLError;
	long _verifyResult;
}

@property (readonly) unsigned long SSLError;
@property (readonly) long verifyResult;

+ (instancetype)exceptionWithHost: (OFString *)host
			     port: (uint16_t)port
			   socket: (SSLSocket *)socket
			 SSLError: (unsigned long)SSLError;
+ (instancetype)exceptionWithHost: (OFString *)host
			     port: (uint16_t)port
			   socket: (SSLSocket *)socket
			 SSLError: (unsigned long)SSLError
		     verifyResult: (long)verifyResult;
- initWithHost: (OFString *)host
	  port: (uint16_t)port
	socket: (SSLSocket *)socket
      SSLError: (unsigned long)SSLError;
- initWithHost: (OFString *)host
	  port: (uint16_t)port
	socket: (SSLSocket *)socket
      SSLError: (unsigned long)SSLError
  verifyResult: (long)verifyResult;
@end

#if defined(__clang__)
# pragma clang diagnostic pop
#endif

@implementation SSLConnectionFailedException
@synthesize SSLError = _SSLError, verifyResult = _verifyResult;

+ (instancetype)exceptionWithHost: (OFString *)host
			     port: (uint16_t)port
			   socket: (SSLSocket *)socket
			 SSLError: (unsigned long)SSLError
{
	return [[[self alloc] initWithHost: host
				      port: port
				    socket: socket
				  SSLError: SSLError] autorelease];
}


+ (instancetype)exceptionWithHost: (OFString *)host
			     port: (uint16_t)port
			   socket: (SSLSocket *)socket
			 SSLError: (unsigned long)SSLError
		     verifyResult: (long)verifyResult
{
	return [[[self alloc] initWithHost: host
				      port: port
				    socket: socket
				  SSLError: SSLError
			      verifyResult: verifyResult] autorelease];
}

- initWithHost: (OFString *)host
	  port: (uint16_t)port
	socket: (SSLSocket *)socket
      SSLError: (unsigned long)SSLError
{
	self = [super initWithHost: host
			      port: port
			    socket: socket];

	_SSLError = SSLError;

	return self;
}

- initWithHost: (OFString *)host
	  port: (uint16_t)port
	socket: (SSLSocket *)socket
      SSLError: (unsigned long)SSLError
  verifyResult: (long)verifyResult
{
	self = [super initWithHost: host
			      port: port
			    socket: socket];

	_SSLError = SSLError;
	_verifyResult = verifyResult;

	return self;
}

- (OFString *)description
{
	if (_SSLError != SSL_ERROR_NONE) {
		char error[512];

		ERR_error_string_n(_SSLError, error, 512);

		if (_verifyResult != X509_V_OK)

#import <ObjFW/OFException.h>

@interface SSLInvalidCertificateException: OFException
{
	OFString *_reason;
}

@property (readonly, nonatomic) OFString *reason;

+ exceptionWithReason: (OFString *)reason;
- initWithReason: (OFString *)reason;
@end

#import "SSLInvalidCertificateException.h"

#import <ObjFW/macros.h>

@implementation SSLInvalidCertificateException
@synthesize reason = _reason;

+ exceptionWithReason: (OFString *)reason
{
	return [[[self alloc] initWithReason: reason] autorelease];
}

- init
{
	@try {
		[self doesNotRecognizeSelector: _cmd];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	abort();
}

- initWithReason: (OFString *)reason
{
	self = [super init];

	@try {
		_reason = [reason copy];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- (void)dealloc
{
	[_reason release];

	[super dealloc];
}

- (OFString *)description
{
	return [OFString stringWithFormat:
	    @"Invalid certificate! Reason: %@", _reason];
}
@end

	bool _certificateVerificationEnabled;
	bool _requestClientCertificatesEnabled;
}

@property (getter=isRequestClientCertificatesEnabled)
    bool requestClientCertificatesEnabled;

- initWithSocket: (OFTCPSocket *)socket;
- (void)SSL_super_close;
- (OFDataArray *)channelBindingDataWithType: (OFString *)type;
- (X509Certificate *)peerCertificate;
- (void)verifyPeerCertificate;
@end

	self = [super init];

	_certificateVerificationEnabled = true;

	return self;
}

- initWithSocket: (OFTCPSocket *)socket
{
	self = [self init];

	@try {
		if ((_socket = dup(socket->_socket)) < 0)
			@throw [OFInitializationFailedException exception];
	} @catch (id e) {

	[super dealloc];

	if (SSL_ != NULL)
		SSL_free(SSL_);
}

- (void)SSL_startTLSWithExpectedHost: (OFString *)host
				port: (uint16_t)port
{
	of_string_encoding_t encoding;

	if ((_SSL = SSL_new(ctx)) == NULL || SSL_set_fd(_SSL, _socket) != 1) {
		unsigned long error = ERR_get_error();

			    exceptionWithHost: host
					 port: port
				       socket: self
				     SSLError: error];
	}
}

- (void)startTLSWithExpectedHost: (OFString *)host
{
	[self SSL_startTLSWithExpectedHost: host
				      port: 0];
}

- (void)connectToHost: (OFString *)host
		 port: (uint16_t)port
{
	[super connectToHost: host
			port: port];

	[self SSL_startTLSWithExpectedHost: host
				      port: port];
}

- (instancetype)accept
{
	SSLSocket *client = (SSLSocket *)[super accept];
	of_string_encoding_t encoding;

	if ((client->_SSL = SSL_new(ctx)) == NULL ||
	    !SSL_set_fd(client->_SSL, client->_socket)) {
		[client SSL_super_close];
		/* FIXME: Get a proper errno */
		@throw [OFAcceptFailedException exceptionWithSocket: self

}

- (void)SSL_super_close
{
	[super close];
}

- (size_t)lowlevelReadIntoBuffer: (void *)buffer
			  length: (size_t)length
{
	ssize_t ret;

	if (length > INT_MAX)
		@throw [OFOutOfRangeException exception];

	if (ret == 0)
		_atEndOfStream = true;

	return ret;
}

- (void)lowlevelWriteBuffer: (const void *)buffer
		     length: (size_t)length
{
	if (length > INT_MAX)
		@throw [OFOutOfRangeException exception];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotOpenException exceptionWithObject: self];

{
	if (_SSL != NULL && SSL_pending(_SSL) > 0)
		return true;

	return [super hasDataInReadBuffer];
}

- (void)setCertificateFile: (OFString *)certificateFile
		forSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (OFString *)certificateFileForSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (void)setPrivateKeyFile: (OFString *)privateKeyFile
	       forSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (OFString *)privateKeyFileForSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (void)setPrivateKeyPassphrase: (const char *)privateKeyPassphrase
		     forSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (const char *)privateKeyPassphraseForSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}














- (OFDataArray *)channelBindingDataWithType: (OFString *)type
{
	size_t length;
	char buffer[64];
	OFDataArray *data;

	if (![type isEqual: @"tls-unique"])
		@throw [OFInvalidArgumentException exception];

	data = [OFDataArray dataArray];
	[data addItems: buffer
		 count: length];

	return data;
}

- (X509Certificate *)peerCertificate
{
	X509 *certificate = SSL_get_peer_certificate(_SSL);

	if (!certificate)
		return nil;

	return [[[X509Certificate alloc]

#define OID_SRVName @"1.3.6.1.5.5.7.8.7"

@interface X509OID: OFObject <OFCopying>
{
	OFString *_string;
}

- initWithUTF8String: (const char *)string;
@end

@interface X509Certificate: OFObject
{
	X509 *_certificate;
	OFDictionary *_issuer;
	OFDictionary *_subject;
	OFDictionary *_subjectAlternativeName;
}

- initWithFile: (OFString *)file;
- initWithX509Struct: (X509 *)cert;
- (OFDictionary *)issuer;
- (OFDictionary *)subject;
- (OFDictionary *)subjectAlternativeName;
- (bool)hasCommonNameMatchingDomain: (OFString *)domain;
- (bool)hasDNSNameMatchingDomain: (OFString *)domain;
- (bool)hasSRVNameMatchingDomain: (OFString *)domain
			 service: (OFString *)service;
- (bool)X509_isAssertedDomain: (OFString *)asserted
		  equalDomain: (OFString *)domain;
- (OFDictionary *)X509_dictionaryFromX509Name: (X509_NAME *)name;
- (X509OID *)X509_stringFromASN1Object: (ASN1_OBJECT *)obj;
- (OFString *)X509_stringFromASN1String: (ASN1_STRING *)str;
@end

#import <ObjFW/OFList.h>
#import <ObjFW/OFMutableDictionary.h>
#import <ObjFW/OFString.h>

#import <ObjFW/macros.h>

@implementation X509Certificate
- initWithFile: (OFString *)path
{
	self = [self init];

	@try {
		OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
		OFDataArray *data = [OFDataArray
		    dataArrayWithContentsOfFile: path];

		[self release];
		@throw e;
	}

	return self;
}

- initWithX509Struct: (X509 *)certificate
{
	self = [self init];

	@try {
		_certificate = X509_dup(certificate);
		if (_certificate == NULL)
			@throw [OFInitializationFailedException

	if (_certificate != NULL)
		X509_free(_certificate);

	[super dealloc];
}

- (OFString *)description
{
	OFMutableString *ret = [OFMutableString string];

	[ret appendFormat: @"Issuer: %@\n\n", [self issuer]];
	[ret appendFormat: @"Subject: %@\n\n", [self subject]];
	[ret appendFormat: @"SANs: %@", [self subjectAlternativeName]];

	[ret makeImmutable];
	return ret;
}

- (OFDictionary *)issuer
{
	X509_NAME *name;

	if (_issuer != nil)
		return [[_issuer copy] autorelease];

	name = X509_get_issuer_name(_certificate);
	_issuer = [[self X509_dictionaryFromX509Name: name] retain];

	return _issuer;
}

- (OFDictionary *)subject
{
	X509_NAME *name;

	if (_subject != nil)
		return [[_subject copy] autorelease];

	name = X509_get_subject_name(_certificate);
	_subject = [[self X509_dictionaryFromX509Name: name] retain];

	return _subject;
}

- (OFDictionary *)subjectAlternativeName
{
	OFAutoreleasePool *pool;
	OFMutableDictionary *ret;
	int i;

	if (_subjectAlternativeName != nil)
		return [[_subjectAlternativeName copy] autorelease];

	[ret makeImmutable];
	_subjectAlternativeName = [ret retain];

	return ret;
}

- (bool)hasCommonNameMatchingDomain: (OFString *)domain
{
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFList *CNs = [[self subject] objectForKey: OID_commonName];
	OFEnumerator *enumerator = [CNs objectEnumerator];

	while ((name = [enumerator nextObject]) != nil) {
		if ([self X509_isAssertedDomain: name
				    equalDomain: domain]) {
			[pool release];
			return true;
		}
	}

	[pool release];
	return false;
}

- (bool)hasDNSNameMatchingDomain: (OFString *)domain
{
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFDictionary *SANs = [self subjectAlternativeName];
	OFList *assertedNames = [SANs objectForKey: @"dNSName"];
	OFEnumerator *enumerator = [assertedNames objectEnumerator];

	while ((name = [enumerator nextObject]) != nil) {
		if ([self X509_isAssertedDomain: name
				    equalDomain: domain]) {
			[pool release];
			return true;
		}
	}

	[pool release];
	return false;
}

- (bool)hasSRVNameMatchingDomain: (OFString *)domain
			 service: (OFString *)service
{
	size_t serviceLength;
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFDictionary *SANs = [self subjectAlternativeName];
	OFList *assertedNames = [[SANs objectForKey: @"otherName"]
				     objectForKey: OID_SRVName];

		}
	}

	[pool release];
	return false;
}

- (bool)X509_isAssertedDomain: (OFString *)asserted
		  equalDomain: (OFString *)domain
{
	/*
	 * In accordance with RFC 6125 this only allows a wildcard as the
	 * left-most label and matches only the left-most label with it.
	 * E.g. *.example.com matches foo.example.com,
	 * but not foo.bar.example.com
	 */

	if (![asserted caseInsensitiveCompare: domain])
		return true;

	return false;
}

- (OFDictionary *)X509_dictionaryFromX509Name: (X509_NAME *)name
{
	OFMutableDictionary *dict = [OFMutableDictionary dictionary];
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	int i, count = X509_NAME_entry_count(name);

	for (i = 0; i < count; i++) {
		X509OID *key;

	[pool release];

	[dict makeImmutable];
	return dict;
}


- (X509OID *)X509_stringFromASN1Object: (ASN1_OBJECT *)object
{
	X509OID *ret;
	int length, bufferLength = 256;
	char *buffer = [self allocMemoryWithSize: bufferLength];

	@try {
		while ((length = OBJ_obj2txt(buffer, bufferLength, object,

	} @finally {
		[self freeMemory: buffer];
	}

	return ret;
}

- (OFString *)X509_stringFromASN1String: (ASN1_STRING *)str
{
	OFString *ret;
	char *buffer;

	if (ASN1_STRING_to_UTF8((unsigned char **)&buffer, str) < 0)
		@throw [OFInvalidEncodingException exception];

	@try {
		ret = [OFString stringWithUTF8String: buffer];
	} @finally {
		OPENSSL_free(buffer);
	}

	return ret;
}
@end

@implementation X509OID
- initWithUTF8String: (const char *)string
{
	self = [self init];

	@try {
		_string = [[OFString alloc] initWithUTF8String: string];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- (void)dealloc
{
	[_string release];
	[super dealloc];
}

- (OFString *)description
{
	char tmp[1024];
	OBJ_obj2txt(tmp, sizeof(tmp), OBJ_txt2obj([_string UTF8String], 1), 0);
	return [OFString stringWithUTF8String: tmp];
}

- (bool)isEqual: (id)object