ObjOpenSSL  Check-in [09e348c39a]

	return [OFString stringWithFormat:
	    @"Invalid certificate in class %@! Reason: %@", [self inClass],
	    _reason];
}

- (OFString*)reason
{
	OF_GETTER(_reason, false)
}
@end

@class X509Certificate;

@interface SSLSocket: OFTCPSocket
{
	SSL *_SSL;
	OFString *_privateKeyFile, *_certificateFile;
	bool _requestsClientCertificates;
}

#ifdef OF_HAVE_PROPERTIES
@property (copy) OFString *privateKeyFile, *certificateFile;
@property bool requestsClientCertificates;
#endif

- initWithSocket: (OFTCPSocket*)socket;
-  initWithSocket: (OFTCPSocket*)socket
   privateKeyFile: (OFString*)privateKeyFile
  certificateFile: (OFString*)certificateFile;
- (void)SSL_super_close;
- (SSLSocket*)accept;	/* Changes the return type */
- (void)setPrivateKeyFile: (OFString*)file;
- (OFString*)privateKeyFile;
- (void)setCertificateFile: (OFString*)file;
- (OFString*)certificateFile;
- (void)setRequestsClientCertificates: (bool)enabled;
- (bool)requestsClientCertificates;
- (OFDataArray*)channelBindingDataWithType: (OFString*)type;
- (X509Certificate*)peerCertificate;
- (void)verifyPeerCertificate;
@end

		@throw [OFReadFailedException exceptionWithClass: [self class]
							  stream: self
						 requestedLength: length];
	}

	if (ret == 0)
		_atEndOfStream = true;

	return ret;
}

- (void)lowlevelWriteBuffer: (const void*)buffer
		     length: (size_t)length
{

		return [super numberOfBytesInReadBuffer];

	return [super numberOfBytesInReadBuffer] + SSL_pending(_SSL);
}

- (void)setPrivateKeyFile: (OFString*)privateKeyFile
{
	OF_SETTER(_privateKeyFile, privateKeyFile, true, 1)
}

- (OFString*)privateKeyFile
{
	OF_GETTER(_privateKeyFile, true)
}

- (void)setCertificateFile: (OFString*)certificateFile
{
	OF_SETTER(_certificateFile, certificateFile, true, 1)
}

- (OFString*)certificateFile
{
	OF_GETTER(_certificateFile, true)
}

- (void)setRequestsClientCertificates: (bool)enabled
{
	_requestsClientCertificates = enabled;
}

- (bool)requestsClientCertificates
{
	return _requestsClientCertificates;
}

- (OFDataArray*)channelBindingDataWithType: (OFString*)type
{
	size_t length;

#endif

- initWithFile: (OFString*)file;
- initWithX509Struct: (X509*)cert;
- (OFDictionary*)issuer;
- (OFDictionary*)subject;
- (OFDictionary*)subjectAlternativeName;
- (bool)hasCommonNameMatchingDomain: (OFString*)domain;
- (bool)hasDNSNameMatchingDomain: (OFString*)domain;
- (bool)hasSRVNameMatchingDomain: (OFString*)domain
			 service: (OFString*)service;
- (bool)X509_isAssertedDomain: (OFString*)asserted
		  equalDomain: (OFString*)domain;
- (OFDictionary*)X509_dictionaryFromX509Name: (X509_NAME*)name;
- (X509OID*)X509_stringFromASN1Object: (ASN1_OBJECT*)obj;
- (OFString*)X509_stringFromASN1String: (ASN1_STRING*)str;
@end

	[ret makeImmutable];
	_subjectAlternativeName = [ret retain];

	return ret;
}

- (bool)hasCommonNameMatchingDomain: (OFString*)domain
{
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFList *CNs = [[self subject] objectForKey: OID_commonName];
	OFEnumerator *enumerator = [CNs objectEnumerator];

	while ((name = [enumerator nextObject]) != nil) {
		if ([self X509_isAssertedDomain: name
				    equalDomain: domain]) {
			[pool release];
			return true;
		}
	}

	[pool release];
	return false;
}

- (bool)hasDNSNameMatchingDomain: (OFString*)domain
{
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFDictionary *SANs = [self subjectAlternativeName];
	OFList *assertedNames = [SANs objectForKey: @"dNSName"];
	OFEnumerator *enumerator = [assertedNames objectEnumerator];

	while ((name = [enumerator nextObject]) != nil) {
		if ([self X509_isAssertedDomain: name
				    equalDomain: domain]) {
			[pool release];
			return true;
		}
	}

	[pool release];
	return false;
}

- (bool)hasSRVNameMatchingDomain: (OFString*)domain
			 service: (OFString*)service
{
	size_t serviceLength;
	OFString *name;
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	OFDictionary *SANs = [self subjectAlternativeName];
	OFList *assertedNames = [[SANs objectForKey: @"otherName"]

		if ([name hasPrefix: service]) {
			OFString *asserted;
			asserted = [name substringWithRange: of_range(
			    serviceLength, [name length] - serviceLength)];
			if ([self X509_isAssertedDomain: asserted
					    equalDomain: domain]) {
				[pool release];
				return true;
			}
		}
	}

	[pool release];
	return false;
}

- (bool)X509_isAssertedDomain: (OFString*)asserted
		  equalDomain: (OFString*)domain
{
	/*
	 * In accordance with RFC 6125 this only allows a wildcard as the
	 * left-most label and matches only the left-most label with it.
	 * E.g. *.example.com matches foo.example.com,
	 * but not foo.bar.example.com
	 */

	size_t firstDot;

	if ([asserted caseInsensitiveCompare: domain] == OF_ORDERED_SAME)
		return true;

	if (![asserted hasPrefix: @"*."])
		return false;

	asserted = [asserted substringWithRange:
	    of_range(2, [asserted length] - 2)];

	firstDot = [domain rangeOfString: @"."].location;
	if (firstDot == OF_NOT_FOUND)
		return false;

	domain = [domain substringWithRange:
	    of_range(firstDot + 1, [domain length] - firstDot - 1)];

	if (![asserted caseInsensitiveCompare: domain])
		return true;

	return false;
}

- (OFDictionary*)X509_dictionaryFromX509Name: (X509_NAME*)name
{
	OFMutableDictionary *dict = [OFMutableDictionary dictionary];
	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
	int i, count = X509_NAME_entry_count(name);

- (OFString*)description
{
	char tmp[1024];
	OBJ_obj2txt(tmp, sizeof(tmp), OBJ_txt2obj([_string UTF8String], 1), 0);
	return [OFString stringWithUTF8String: tmp];
}

- (bool)isEqual: (id)object
{
	if ([object isKindOfClass: [X509OID class]]) {
		X509OID *OID = object;

		return [OID->_string isEqual: _string];
	}

	if ([object isKindOfClass: [OFString class]])
		return [_string isEqual: object];

	return false;
}

- (uint32_t)hash
{
	return [_string hash];
}

- copy
{
	return [self retain];
}
@end