ObjOpenSSL  Check-in [93fb0bd595]

Overview
Comment:Adjust to reworked exception API.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 93fb0bd59599fa2eaea75ae28c6d2a7072169199a939cfe6c5f9b20f371547b4
User & Date: js on 2013-06-23 11:10:33
Other Links: manifest | tags
Context
2013-11-22
20:15
Adjust exceptions to ObjFW API change. check-in: 81c23094bc user: js tags: trunk
2013-06-23
11:10
Adjust to reworked exception API. check-in: 93fb0bd595 user: js tags: trunk
2013-04-03
21:26
Disable -Werror until we fully conform to OFTLSSocket again check-in: 51a0e4d05b user: florob@babelmonkeys.de tags: trunk
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Modified configure.ac from [599766f81c] to [f962a94399].

︙︙
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

	AC_MSG_ERROR(No libz found! Please install zlib!)
])

AS_IF([test x"$GOBJC" = x"yes"], [
	OBJCFLAGS="$OBJCFLAGS -Wwrite-strings -Wpointer-arith"
	dnl We need -Wno-deprecated-declarations as OpenSSL is deprecated on
	dnl OS X.
	OBJCFLAGS="$OBJCFLAGS -Wno-deprecated-declarations" # -Werror
])

BUILDSYS_INIT
BUILDSYS_TOUCH_DEPS

dnl We don't call AC_PROG_CPP, but only AC_PROG_OBJCPP and set CPP to OBJCPP
dnl and add OBJCPPFLAGS to CPPFLAGS, thus we need to AC_SUBST these ourself.








|








46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

	AC_MSG_ERROR(No libz found! Please install zlib!)
])

AS_IF([test x"$GOBJC" = x"yes"], [
	OBJCFLAGS="$OBJCFLAGS -Wwrite-strings -Wpointer-arith"
	dnl We need -Wno-deprecated-declarations as OpenSSL is deprecated on
	dnl OS X.
	OBJCFLAGS="$OBJCFLAGS -Wno-deprecated-declarations"
])

BUILDSYS_INIT
BUILDSYS_TOUCH_DEPS

dnl We don't call AC_PROG_CPP, but only AC_PROG_OBJCPP and set CPP to OBJCPP
dnl and add OBJCPPFLAGS to CPPFLAGS, thus we need to AC_SUBST these ourself.
︙︙

Modified src/SSLInvalidCertificateException.h from [047ae0bfe4] to [eb1ea7f340].

︙︙
29
30
31
32
33
34
35
36
37
38
39
40
41

	OFString *_reason;
}

#ifdef OF_HAVE_PROPERTIES
@property (readonly, assign) OFString *reason;
#endif

+ exceptionWithClass: (Class)class
	      reason: (OFString*)reason;
- initWithClass: (Class)class
	 reason: (OFString*)reason;
- (OFString*)reason;
@end








<
|
<
|



29
30
31
32
33
34
35

36

37
38
39

	OFString *_reason;
}

#ifdef OF_HAVE_PROPERTIES
@property (readonly, assign) OFString *reason;
#endif


+ exceptionWithReason: (OFString*)reason;

- initWithReason: (OFString*)reason;
- (OFString*)reason;
@end

Modified src/SSLInvalidCertificateException.m from [55bf9206f9] to [f22e54e351].

︙︙
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

#include <stdlib.h>

#import "SSLInvalidCertificateException.h"

#import <ObjFW/macros.h>

@implementation SSLInvalidCertificateException
+ exceptionWithClass: (Class)class
	      reason: (OFString*)reason
{
	return [[[self alloc] initWithClass: class
				     reason: reason] autorelease];
}

- initWithClass: (Class)class
{
	@try {
		[self doesNotRecognizeSelector: _cmd];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	abort();
}

- initWithClass: (Class)class
	 reason: (OFString*)reason
{
	self = [super initWithClass: class];

	@try {
		_reason = [reason copy];
	} @catch (id e) {
		[self release];
		@throw e;
	}








<
|

|
<


|











<
|

|








24
25
26
27
28
29
30

31
32
33

34
35
36
37
38
39
40
41
42
43
44
45
46
47

48
49
50
51
52
53
54
55
56
57

#include <stdlib.h>

#import "SSLInvalidCertificateException.h"

#import <ObjFW/macros.h>

@implementation SSLInvalidCertificateException

+ exceptionWithReason: (OFString*)reason
{
	return [[[self alloc] initWithReason: reason] autorelease];

}

- init
{
	@try {
		[self doesNotRecognizeSelector: _cmd];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	abort();
}


- initWithReason: (OFString*)reason
{
	self = [super init];

	@try {
		_reason = [reason copy];
	} @catch (id e) {
		[self release];
		@throw e;
	}
︙︙
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83


	[super dealloc];
}

- (OFString*)description
{
	return [OFString stringWithFormat:
	    @"Invalid certificate in class %@! Reason: %@", [self inClass],
	    _reason];
}

- (OFString*)reason
{
	OF_GETTER(_reason, false)
}
@end








|
<








65
66
67
68
69
70
71
72

73
74
75
76
77
78
79


	[super dealloc];
}

- (OFString*)description
{
	return [OFString stringWithFormat:
	    @"Invalid certificate! Reason: %@", _reason];

}

- (OFString*)reason
{
	OF_GETTER(_reason, false)
}
@end

Modified src/SSLSocket.m from [20965632b7] to [b84a6adf27].

︙︙
136
137
138
139
140
141
142
143

144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159

160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213

}

- (void)startTLS
{
	if ((_SSL = SSL_new(ctx)) == NULL || !SSL_set_fd(_SSL, _socket)) {
		[super close];
		@throw [OFConnectionFailedException
		    exceptionWithClass: [self class]

				socket: self
				  host: nil
				  port: 0];
	}

	SSL_set_connect_state(_SSL);

	if ((_privateKeyFile != nil && !SSL_use_PrivateKey_file(_SSL,
	    [_privateKeyFile cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM)) || (_certificateFile != nil &&
	    !SSL_use_certificate_file(_SSL, [_certificateFile
	    cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM)) || SSL_connect(_SSL) != 1) {
		[super close];
		@throw [OFConnectionFailedException
		    exceptionWithClass: [self class]

				socket: self
				  host: nil
				  port: 0];
	}
}

- (void)connectToHost: (OFString*)host
		 port: (uint16_t)port
{
	[super connectToHost: host
			port: port];

	@try {
		[self startTLS];
	} @catch (OFConnectionFailedException *e) {
		@throw [OFConnectionFailedException
		    exceptionWithClass: [self class]
				socket: self
				  host: host
				  port: port];
	}
}

- (instancetype)accept
{
	SSLSocket *client = (SSLSocket*)[super accept];

	if ((client->_SSL = SSL_new(ctx)) == NULL ||
	    !SSL_set_fd(client->_SSL, client->_socket)) {
		[client SSL_super_close];
		@throw [OFAcceptFailedException exceptionWithClass: [self class]
							    socket: self];
	}

	if (_requestsClientCertificates)
		SSL_set_verify(client->_SSL, SSL_VERIFY_PEER, NULL);

	SSL_set_accept_state(client->_SSL);

	if (!SSL_use_PrivateKey_file(client->_SSL, [_privateKeyFile
	    cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM) || !SSL_use_certificate_file(client->_SSL,
	    [_certificateFile cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM) || SSL_accept(client->_SSL) != 1) {
		[client SSL_super_close];
		@throw [OFAcceptFailedException exceptionWithClass: [self class]
							    socket: self];
	}

	return client;
}

- (void)close
{








|
>
|
<
<












|
>
|
<
<









<
|
<
<
<
<
<
<
<









|
<













|
<








136
137
138
139
140
141
142
143
144
145


146
147
148
149
150
151
152
153
154
155
156
157
158
159
160


161
162
163
164
165
166
167
168
169

170







171
172
173
174
175
176
177
178
179
180

181
182
183
184
185
186
187
188
189
190
191
192
193
194

195
196
197
198
199
200
201

}

- (void)startTLS
{
	if ((_SSL = SSL_new(ctx)) == NULL || !SSL_set_fd(_SSL, _socket)) {
		[super close];
		@throw [OFConnectionFailedException
		    exceptionWithHost: nil
				 port: 0
			       socket: self];


	}

	SSL_set_connect_state(_SSL);

	if ((_privateKeyFile != nil && !SSL_use_PrivateKey_file(_SSL,
	    [_privateKeyFile cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM)) || (_certificateFile != nil &&
	    !SSL_use_certificate_file(_SSL, [_certificateFile
	    cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM)) || SSL_connect(_SSL) != 1) {
		[super close];
		@throw [OFConnectionFailedException
		    exceptionWithHost: nil
				 port: 0
			       socket: self];


	}
}

- (void)connectToHost: (OFString*)host
		 port: (uint16_t)port
{
	[super connectToHost: host
			port: port];


	[self startTLS];







}

- (instancetype)accept
{
	SSLSocket *client = (SSLSocket*)[super accept];

	if ((client->_SSL = SSL_new(ctx)) == NULL ||
	    !SSL_set_fd(client->_SSL, client->_socket)) {
		[client SSL_super_close];
		@throw [OFAcceptFailedException exceptionWithSocket: self];

	}

	if (_requestsClientCertificates)
		SSL_set_verify(client->_SSL, SSL_VERIFY_PEER, NULL);

	SSL_set_accept_state(client->_SSL);

	if (!SSL_use_PrivateKey_file(client->_SSL, [_privateKeyFile
	    cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM) || !SSL_use_certificate_file(client->_SSL,
	    [_certificateFile cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM) || SSL_accept(client->_SSL) != 1) {
		[client SSL_super_close];
		@throw [OFAcceptFailedException exceptionWithSocket: self];

	}

	return client;
}

- (void)close
{
︙︙
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303


- (size_t)lowlevelReadIntoBuffer: (void*)buffer
			  length: (size_t)length
{
	ssize_t ret;

	if (length > INT_MAX)
		@throw [OFOutOfRangeException exceptionWithClass: [self class]];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotConnectedException exceptionWithClass: [self class]
							    socket: self];

	if (_atEndOfStream) {
		OFReadFailedException *e;

		e = [OFReadFailedException exceptionWithClass: [self class]
						       stream: self
					      requestedLength: length];
#ifndef _WIN32
		e->_errNo = ENOTCONN;
#else
		e->_errNo = WSAENOTCONN;
#endif

		@throw e;
	}

	if ((ret = SSL_read(_SSL, buffer, (int)length)) < 0) {
		if (SSL_get_error(_SSL, ret) ==  SSL_ERROR_WANT_READ)
			return 0;

		@throw [OFReadFailedException exceptionWithClass: [self class]
							  stream: self
						 requestedLength: length];
	}

	if (ret == 0)
		_atEndOfStream = true;

	return ret;
}

- (void)lowlevelWriteBuffer: (const void*)buffer
		     length: (size_t)length
{
	if (length > INT_MAX)
		@throw [OFOutOfRangeException exceptionWithClass: [self class]];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotConnectedException exceptionWithClass: [self class]
							    socket: self];

	if (_atEndOfStream) {
		OFWriteFailedException *e;

		e = [OFWriteFailedException exceptionWithClass: [self class]
							stream: self
					       requestedLength: length];

#ifndef _WIN32
		e->_errNo = ENOTCONN;
#else
		e->_errNo = WSAENOTCONN;
#endif

		@throw e;
	}

	if (SSL_write(_SSL, buffer, (int)length) < length)
		@throw [OFWriteFailedException exceptionWithClass: [self class]
							   stream: self
						  requestedLength: length];
}

- (size_t)numberOfBytesInReadBuffer
{
	if (_SSL == NULL)
		return [super numberOfBytesInReadBuffer];









|


|
<




|
<
|













|
<
|












|


|
<




|
<
|











|
<
|








212
213
214
215
216
217
218
219
220
221
222

223
224
225
226
227

228
229
230
231
232
233
234
235
236
237
238
239
240
241
242

243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259

260
261
262
263
264

265
266
267
268
269
270
271
272
273
274
275
276
277

278
279
280
281
282
283
284
285


- (size_t)lowlevelReadIntoBuffer: (void*)buffer
			  length: (size_t)length
{
	ssize_t ret;

	if (length > INT_MAX)
		@throw [OFOutOfRangeException exception];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotConnectedException exceptionWithSocket: self];


	if (_atEndOfStream) {
		OFReadFailedException *e;

		e = [OFReadFailedException exceptionWithStream: self

					       requestedLength: length];
#ifndef _WIN32
		e->_errNo = ENOTCONN;
#else
		e->_errNo = WSAENOTCONN;
#endif

		@throw e;
	}

	if ((ret = SSL_read(_SSL, buffer, (int)length)) < 0) {
		if (SSL_get_error(_SSL, ret) ==  SSL_ERROR_WANT_READ)
			return 0;

		@throw [OFReadFailedException exceptionWithStream: self

						  requestedLength: length];
	}

	if (ret == 0)
		_atEndOfStream = true;

	return ret;
}

- (void)lowlevelWriteBuffer: (const void*)buffer
		     length: (size_t)length
{
	if (length > INT_MAX)
		@throw [OFOutOfRangeException exception];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotConnectedException exceptionWithSocket: self];


	if (_atEndOfStream) {
		OFWriteFailedException *e;

		e = [OFWriteFailedException exceptionWithStream: self

						requestedLength: length];

#ifndef _WIN32
		e->_errNo = ENOTCONN;
#else
		e->_errNo = WSAENOTCONN;
#endif

		@throw e;
	}

	if (SSL_write(_SSL, buffer, (int)length) < length)
		@throw [OFWriteFailedException exceptionWithStream: self

						   requestedLength: length];
}

- (size_t)numberOfBytesInReadBuffer
{
	if (_SSL == NULL)
		return [super numberOfBytesInReadBuffer];
︙︙
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377

- (OFDataArray*)channelBindingDataWithType: (OFString*)type
{
	size_t length;
	char buffer[64];
	OFDataArray *data;

	if (![type isEqual: @"tls-unique"])
		@throw [OFInvalidArgumentException
		    exceptionWithClass: [self class]
			      selector: _cmd];

	if (SSL_session_reused(_SSL) ^ !_listening) {
		/*
		 * We are either client or the session has been resumed
		 * => we have sent the finished message
		 */
		length = SSL_get_finished(_SSL, buffer, 64);








|
<
<








343
344
345
346
347
348
349
350


351
352
353
354
355
356
357

- (OFDataArray*)channelBindingDataWithType: (OFString*)type
{
	size_t length;
	char buffer[64];
	OFDataArray *data;

	if (![type isEqual: @"tls-unique"])
		@throw [OFInvalidArgumentException exception];



	if (SSL_session_reused(_SSL) ^ !_listening) {
		/*
		 * We are either client or the session has been resumed
		 * => we have sent the finished message
		 */
		length = SSL_get_finished(_SSL, buffer, 64);
︙︙
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418

	unsigned long ret;

	if (SSL_get_peer_certificate(_SSL) != NULL) {
		if ((ret = SSL_get_verify_result(_SSL)) != X509_V_OK) {
			const char *tmp = X509_verify_cert_error_string(ret);
			OFString *reason = [OFString stringWithUTF8String: tmp];
			@throw [SSLInvalidCertificateException
			    exceptionWithClass: [self class]
					reason: reason];
		}
	} else
		@throw [SSLInvalidCertificateException
		    exceptionWithClass: [self class]
				reason: @"No certificate"];
}
@end








<
|



<
|



383
384
385
386
387
388
389

390
391
392
393

394
395
396

	unsigned long ret;

	if (SSL_get_peer_certificate(_SSL) != NULL) {
		if ((ret = SSL_get_verify_result(_SSL)) != X509_V_OK) {
			const char *tmp = X509_verify_cert_error_string(ret);
			OFString *reason = [OFString stringWithUTF8String: tmp];
			@throw [SSLInvalidCertificateException

			    exceptionWithReason: reason];
		}
	} else
		@throw [SSLInvalidCertificateException

		    exceptionWithReason: @"No certificate"];
}
@end

Modified src/X509Certificate.m from [ea8e8f249e] to [28ac2990f0].

︙︙
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

		OFDataArray *data = [OFDataArray
		    dataArrayWithContentsOfFile: path];
		const unsigned char *dataCArray = [data items];

		_certificate = d2i_X509(NULL, &dataCArray, [data count]);
		if (_certificate == NULL)
			@throw [OFInitializationFailedException
				    exceptionWithClass: [self class]];

		[pool release];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- initWithX509Struct: (X509*)certificate
{
	self = [self init];

	@try {
		_certificate = X509_dup(certificate);
		if (_certificate == NULL)
			@throw [OFInitializationFailedException
				    exceptionWithClass: [self class]];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}








|


















|








49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

		OFDataArray *data = [OFDataArray
		    dataArrayWithContentsOfFile: path];
		const unsigned char *dataCArray = [data items];

		_certificate = d2i_X509(NULL, &dataCArray, [data count]);
		if (_certificate == NULL)
			@throw [OFInitializationFailedException
			    exceptionWithClass: [self class]];

		[pool release];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- initWithX509Struct: (X509*)certificate
{
	self = [self init];

	@try {
		_certificate = X509_dup(certificate);
		if (_certificate == NULL)
			@throw [OFInitializationFailedException
			    exceptionWithClass: [self class]];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}
︙︙
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432


- (OFString*)X509_stringFromASN1String: (ASN1_STRING*)str
{
	OFString *ret;
	char *buffer;

	if (ASN1_STRING_to_UTF8((unsigned char**)&buffer, str) < 0)
		@throw [OFInvalidEncodingException
		    exceptionWithClass: [self class]];

	@try {
		ret = [OFString stringWithUTF8String: buffer];
	} @finally {
		OPENSSL_free(buffer);
	}









|
<








417
418
419
420
421
422
423
424

425
426
427
428
429
430
431


- (OFString*)X509_stringFromASN1String: (ASN1_STRING*)str
{
	OFString *ret;
	char *buffer;

	if (ASN1_STRING_to_UTF8((unsigned char**)&buffer, str) < 0)
		@throw [OFInvalidEncodingException exception];


	@try {
		ret = [OFString stringWithUTF8String: buffer];
	} @finally {
		OPENSSL_free(buffer);
	}
︙︙