ObjOpenSSL  Check-in [8957076139]

Overview
Comment:Adjust to ObjFW changes
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 895707613945b04727bffe6192aa5b491756f2a8a6131a8896cb6a2a7e53f81a
User & Date: js on 2021-11-06 00:15:34
Other Links: manifest | tags
Context
2021-11-07
20:04
Adjust to ObjFW changes Leaf check-in: 22d082c6ea user: js tags: trunk
2021-11-06
00:15
Adjust to ObjFW changes check-in: 8957076139 user: js tags: trunk
2021-04-25
20:41
Adjust to ObjFW changes check-in: a64206ee2e user: js tags: trunk
Changes

Modified src/SSLSocket.h from [c4807a7400] to [0371d9e9ba].

33
34
35
36
37
38
39
40

41
42
43
44
45

46
47


48
49
50
51
52
53
54
55
56
57
58
33
34
35
36
37
38
39

40
41
42
43
44

45
46
47
48
49
50
51
52
53

54
55
56
57
58
59







-
+




-
+


+
+




-






#import <ObjFW/OFTCPSocket.h>
#import <ObjFW/OFTLSSocket.h>

OF_ASSUME_NONNULL_BEGIN

@class X509Certificate;

@interface SSLSocket: OFTCPSocket <OFTLSSocket>
@interface SSLSocket: OFTLSSocket
{
	SSL *_SSL;
	OFString *_certificateFile, *_privateKeyFile;
	const char *_privateKeyPassphrase;
	bool _verifiesCertificates, _requestsClientCertificates;
	bool _requestsClientCertificates;
}

@property (copy, nonatomic) OFString *certificateFile, *privateKeyFile;
@property (nonatomic) const char *privateKeyPassphrase;
@property (nonatomic) bool requestsClientCertificates;
@property OF_NULLABLE_PROPERTY (readonly, nonatomic)
    X509Certificate *peerCertificate;

- (instancetype)initWithSocket: (OFTCPSocket *)socket;
- (OFData *)channelBindingDataWithType: (OFString *)type;
- (nullable X509Certificate *)peerCertificate;
- (void)verifyPeerCertificate;
@end

OF_ASSUME_NONNULL_END

Modified src/SSLSocket.m from [6562bd487a] to [7c2c09a5dc].

73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164

165
166
167
168
169
170
171
73
74
75
76
77
78
79

80
81
82






































































83
84
85
86
87

88
89
90
91

92
93
94
95
96
97
98
99







-



-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-





-




-
+







	if (mode & CRYPTO_LOCK)
		OFEnsure(OFPlainMutexLock(&SSLMutexes[n]) == 0);
	else
		OFEnsure(OFPlainMutexUnlock(&SSLMutexes[n]) == 0);
}

@interface SSLSocket ()
- (void)SSL_startTLSWithExpectedHost: (OFString *)host port: (uint16_t)port;
- (void)SSL_super_close;
@end

@interface SSLSocket_ConnectDelegate: OFObject <OFTLSSocketDelegate>
{
	SSLSocket *_socket;
	OFString *_host;
	uint16_t _port;
	id <OFTLSSocketDelegate> _delegate;
}

- (instancetype)initWithSocket: (SSLSocket *)sock
			  host: (OFString *)host
			  port: (uint16_t)port
		      delegate: (id <OFTLSSocketDelegate>)delegate;
@end

@implementation SSLSocket_ConnectDelegate
- (instancetype)initWithSocket: (SSLSocket *)sock
			  host: (OFString *)host
			  port: (uint16_t)port
		      delegate: (id <OFTLSSocketDelegate>)delegate
{
	self = [super init];

	@try {
		_socket = [sock retain];
		_host = [host copy];
		_port = port;
		_delegate = [delegate retain];

		_socket.delegate = self;
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- (void)dealloc
{
	if (_socket.delegate == self)
		_socket.delegate = _delegate;

	[_socket release];
	[_delegate release];

	[super dealloc];
}

-     (void)socket: (OFTCPSocket *)sock
  didConnectToHost: (OFString *)host
	      port: (uint16_t)port
	 exception: (id)exception
{
	if (exception == nil) {
		@try {
			[(SSLSocket *)sock SSL_startTLSWithExpectedHost: _host
								   port: _port];
		} @catch (id e) {
			exception = e;
		}
	}

	_socket.delegate = _delegate;
	[_delegate    socket: sock
	    didConnectToHost: host
			port: port
		   exception: exception];
}
@end

@implementation SSLSocket
@dynamic delegate;
@synthesize certificateFile = _certificateFile;
@synthesize privateKeyFile = _privateKeyFile;
@synthesize privateKeyPassphrase = _privateKeyPassphrase;
@synthesize verifiesCertificates = _verifiesCertificates;
@synthesize requestsClientCertificates = _requestsClientCertificates;

+ (void)load
{
	OFTLSSocketClass = self;
	OFTLSSocketImplementation = self;
}

+ (void)initialize
{
	int m;

	if (self != [SSLSocket class])
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242

243
244
245
246
247
248
249
126
127
128
129
130
131
132
























133
134
135
136
137
138
139
140
141
142
143
144
145

146
147
148
149
150
151
152
153







-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-













-
+







#endif

	if (SSL_CTX_set_default_verify_paths(ctx) == 0)
		@throw [OFInitializationFailedException
		    exceptionWithClass: self];
}

- (instancetype)init
{
	self = [super init];

	_verifiesCertificates = true;

	return self;
}

- (instancetype)initWithSocket: (OFTCPSocket *)socket
{
	self = [self init];

	@try {
		if ((_socket = dup(socket->_socket)) < 0)
			@throw [OFInitializationFailedException exception];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- (void)dealloc
{
	SSL *SSL_ = _SSL;

	[_privateKeyFile release];
	[_certificateFile release];

	[super dealloc];

	if (SSL_ != NULL)
		SSL_free(SSL_);
}

- (void)SSL_startTLSWithExpectedHost: (OFString *)host port: (uint16_t)port
- (void)startTLSForHost: (OFString *)host port: (uint16_t)port
{
	OFStringEncoding encoding;

	if ((_SSL = SSL_new(ctx)) == NULL || SSL_set_fd(_SSL, _socket) != 1) {
		unsigned long error = ERR_get_error();

		[super close];
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380

381
382
383
384
385
386
387
229
230
231
232
233
234
235














































236
237

238
239
240
241
242
243
244
245







-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-


-
+







			    exceptionWithHost: host
					 port: port
				       socket: self
				     SSLError: error];
	}
}

- (void)startTLSWithExpectedHost: (OFString *)host
{
	[self SSL_startTLSWithExpectedHost: host port: 0];
}

- (void)asyncConnectToHost: (OFString *)host
		      port: (uint16_t)port
	       runLoopMode: (OFRunLoopMode)runLoopMode
{
	void *pool = objc_autoreleasePoolPush();

	[[[SSLSocket_ConnectDelegate alloc]
	    initWithSocket: self
		      host: host
		      port: port
		  delegate: _delegate] autorelease];
	[super asyncConnectToHost: host port: port runLoopMode: runLoopMode];

	objc_autoreleasePoolPop(pool);
}

#ifdef OF_HAVE_BLOCKS
- (void)asyncConnectToHost: (OFString *)host
		      port: (uint16_t)port
	       runLoopMode: (OFRunLoopMode)runLoopMode
		     block: (OFTCPSocketAsyncConnectBlock)block
{
	[super asyncConnectToHost: host
			     port: port
		      runLoopMode: runLoopMode
			    block: ^ (id exception) {
		if (exception == nil) {
			@try {
				[self SSL_startTLSWithExpectedHost: host
							      port: port];
			} @catch (id e) {
				block(e);
				return;
			}
		}

		block(exception);
	}];
}
#endif

- (instancetype)accept
{
	SSLSocket *client = (SSLSocket *)[super accept];
	SSLSocket *client = [self TCPAccept];
	OFStringEncoding encoding;

	if ((client->_SSL = SSL_new(ctx)) == NULL ||
	    !SSL_set_fd(client->_SSL, client->_socket)) {
		[client SSL_super_close];
		/* FIXME: Get a proper errno */
		@throw [OFAcceptFailedException exceptionWithSocket: self
429
430
431
432
433
434
435
436

437
438
439
440
441
442
443
287
288
289
290
291
292
293

294
295
296
297
298
299
300
301







-
+







	/*
	 * There is no SSL session yet. However, it might be necessary to read
	 * from and write to the socket before negotiating an SSL session: For
	 * example, the socket might be connected to a SOCKS5 proxy and needs
	 * to establish a SOCKS5 connection before negotiating an SSL session.
	 */
	if (_SSL == NULL)
		return [super lowlevelReadIntoBuffer: buffer length: length];
		return [self lowlevelTCPReadIntoBuffer: buffer length: length];

	if (length > INT_MAX)
		@throw [OFOutOfRangeException exception];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotOpenException exceptionWithObject: self];

472
473
474
475
476
477
478
479

480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496

497
498
499

500
501
502
503

504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
330
331
332
333
334
335
336

337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353

354
355
356

357
358



359





































360
361
362
363
364
365
366







-
+
















-
+


-
+

-
-
-
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-







	 * to establish a SOCKS5 connection before negotiating an SSL session.
	 *
	 * TODO: Think of a way to make this safer, so that it's impossible to
	 * forget to establish an SSL session and then send unencrypted data by
	 * accident.
	 */
	if (_SSL == NULL)
		return [super lowlevelWriteBuffer: buffer length: length];
		return [self lowlevelTCPWriteBuffer: buffer length: length];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotOpenException exceptionWithObject: self];

	if (length > INT_MAX)
		@throw [OFOutOfRangeException exception];

	if ((bytesWritten = SSL_write(_SSL, buffer, (int)length)) < 0)
		@throw [OFWriteFailedException exceptionWithObject: self
						   requestedLength: length
						      bytesWritten: 0
							     errNo: 0];

	return bytesWritten;
}

- (bool)hasDataInReadBuffer
- (bool)lowlevelIsAtEndOfStream
{
	if (_SSL != NULL && SSL_pending(_SSL) > 0)
		return true;
		return false;

	return super.hasDataInReadBuffer;
}

	return [self lowlevelTCPIsAtEndOfStream];
- (void)setCertificateFile: (OFString *)certificateFile
		forSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (OFString *)certificateFileForSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (void)setPrivateKeyFile: (OFString *)privateKeyFile
	       forSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (OFString *)privateKeyFileForSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (void)setPrivateKeyPassphrase: (const char *)privateKeyPassphrase
		     forSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (const char *)privateKeyPassphraseForSNIHost: (OFString *)SNIHost
{
	/* TODO */
	OF_UNRECOGNIZED_SELECTOR
}

- (OFData *)channelBindingDataWithType: (OFString *)type
{
	size_t length;
	char buffer[64];