ObjOpenSSL  Check-in [93fb0bd595]

Overview
Comment:Adjust to reworked exception API.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 93fb0bd59599fa2eaea75ae28c6d2a7072169199a939cfe6c5f9b20f371547b4
User & Date: js on 2013-06-23 11:10:33
Other Links: manifest | tags
Context
2013-11-22
20:15
Adjust exceptions to ObjFW API change. check-in: 81c23094bc user: js tags: trunk
2013-06-23
11:10
Adjust to reworked exception API. check-in: 93fb0bd595 user: js tags: trunk
2013-04-03
21:26
Disable -Werror until we fully conform to OFTLSSocket again check-in: 51a0e4d05b user: florob@babelmonkeys.de tags: trunk
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Modified configure.ac from [599766f81c] to [f962a94399].

︙
46
47
48
49
50
51
52
53

54
55
56
57
58
59
60

46
47
48
49
50
51
52

53
54
55
56
57
58
59
60








-
+








	AC_MSG_ERROR(No libz found! Please install zlib!)
])

AS_IF([test x"$GOBJC" = x"yes"], [
	OBJCFLAGS="$OBJCFLAGS -Wwrite-strings -Wpointer-arith"
	dnl We need -Wno-deprecated-declarations as OpenSSL is deprecated on
	dnl OS X.
	OBJCFLAGS="$OBJCFLAGS -Wno-deprecated-declarations" # -Werror
	OBJCFLAGS="$OBJCFLAGS -Wno-deprecated-declarations"
])

BUILDSYS_INIT
BUILDSYS_TOUCH_DEPS

dnl We don't call AC_PROG_CPP, but only AC_PROG_OBJCPP and set CPP to OBJCPP
dnl and add OBJCPPFLAGS to CPPFLAGS, thus we need to AC_SUBST these ourself.
︙

Modified src/SSLInvalidCertificateException.h from [047ae0bfe4] to [eb1ea7f340].

︙
29
30
31
32
33
34
35
36
37

38
39

40
41

29
30
31
32
33
34
35


36


37
38
39








-
-
+
-
-
+



	OFString *_reason;
}

#ifdef OF_HAVE_PROPERTIES
@property (readonly, assign) OFString *reason;
#endif

+ exceptionWithClass: (Class)class
	      reason: (OFString*)reason;
+ exceptionWithReason: (OFString*)reason;
- initWithClass: (Class)class
	 reason: (OFString*)reason;
- initWithReason: (OFString*)reason;
- (OFString*)reason;
@end

Modified src/SSLInvalidCertificateException.m from [55bf9206f9] to [f22e54e351].

︙
24
25
26
27
28
29
30
31
32

33
34

35
36
37
38

39
40
41
42
43
44
45
46
47
48
49
50
51

52
53

54
55
56
57
58
59
60

24
25
26
27
28
29
30


31
32

33

34
35

36
37
38
39
40
41
42
43
44
45
46
47


48
49

50
51
52
53
54
55
56
57








-
-
+

-
+
-


-
+











-
-
+

-
+








#include <stdlib.h>

#import "SSLInvalidCertificateException.h"

#import <ObjFW/macros.h>

@implementation SSLInvalidCertificateException
+ exceptionWithClass: (Class)class
	      reason: (OFString*)reason
+ exceptionWithReason: (OFString*)reason
{
	return [[[self alloc] initWithClass: class
	return [[[self alloc] initWithReason: reason] autorelease];
				     reason: reason] autorelease];
}

- initWithClass: (Class)class
- init
{
	@try {
		[self doesNotRecognizeSelector: _cmd];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	abort();
}

- initWithClass: (Class)class
	 reason: (OFString*)reason
- initWithReason: (OFString*)reason
{
	self = [super initWithClass: class];
	self = [super init];

	@try {
		_reason = [reason copy];
	} @catch (id e) {
		[self release];
		@throw e;
	}
︙
68
69
70
71
72
73
74
75

76
77
78
79
80
81
82
83

65
66
67
68
69
70
71

72

73
74
75
76
77
78
79








-
+
-









	[super dealloc];
}

- (OFString*)description
{
	return [OFString stringWithFormat:
	    @"Invalid certificate in class %@! Reason: %@", [self inClass],
	    @"Invalid certificate! Reason: %@", _reason];
	    _reason];
}

- (OFString*)reason
{
	OF_GETTER(_reason, false)
}
@end

Modified src/SSLSocket.m from [20965632b7] to [b84a6adf27].

︙
136
137
138
139
140
141
142
143
144



145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160



161
162
163
164
165
166
167
168
169
170
171
172
173

174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190

191
192
193
194
195
196
197
198
199
200
201
202
203
204
205

206
207
208
209
210
211
212
213

136
137
138
139
140
141
142


143
144
145


146
147
148
149
150
151
152
153
154
155
156
157


158
159
160


161
162
163
164
165
166
167
168
169


170







171
172
173
174
175
176
177
178
179

180

181
182
183
184
185
186
187
188
189
190
191
192
193

194

195
196
197
198
199
200
201








-
-
+
+
+
-
-












-
-
+
+
+
-
-









-
-
+
-
-
-
-
-
-
-









-
+
-













-
+
-








}

- (void)startTLS
{
	if ((_SSL = SSL_new(ctx)) == NULL || !SSL_set_fd(_SSL, _socket)) {
		[super close];
		@throw [OFConnectionFailedException
		    exceptionWithClass: [self class]
				socket: self
		    exceptionWithHost: nil
				 port: 0
			       socket: self];
				  host: nil
				  port: 0];
	}

	SSL_set_connect_state(_SSL);

	if ((_privateKeyFile != nil && !SSL_use_PrivateKey_file(_SSL,
	    [_privateKeyFile cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM)) || (_certificateFile != nil &&
	    !SSL_use_certificate_file(_SSL, [_certificateFile
	    cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM)) || SSL_connect(_SSL) != 1) {
		[super close];
		@throw [OFConnectionFailedException
		    exceptionWithClass: [self class]
				socket: self
		    exceptionWithHost: nil
				 port: 0
			       socket: self];
				  host: nil
				  port: 0];
	}
}

- (void)connectToHost: (OFString*)host
		 port: (uint16_t)port
{
	[super connectToHost: host
			port: port];

	@try {
		[self startTLS];
	[self startTLS];
	} @catch (OFConnectionFailedException *e) {
		@throw [OFConnectionFailedException
		    exceptionWithClass: [self class]
				socket: self
				  host: host
				  port: port];
	}
}

- (instancetype)accept
{
	SSLSocket *client = (SSLSocket*)[super accept];

	if ((client->_SSL = SSL_new(ctx)) == NULL ||
	    !SSL_set_fd(client->_SSL, client->_socket)) {
		[client SSL_super_close];
		@throw [OFAcceptFailedException exceptionWithClass: [self class]
		@throw [OFAcceptFailedException exceptionWithSocket: self];
							    socket: self];
	}

	if (_requestsClientCertificates)
		SSL_set_verify(client->_SSL, SSL_VERIFY_PEER, NULL);

	SSL_set_accept_state(client->_SSL);

	if (!SSL_use_PrivateKey_file(client->_SSL, [_privateKeyFile
	    cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM) || !SSL_use_certificate_file(client->_SSL,
	    [_certificateFile cStringWithEncoding: OF_STRING_ENCODING_NATIVE],
	    SSL_FILETYPE_PEM) || SSL_accept(client->_SSL) != 1) {
		[client SSL_super_close];
		@throw [OFAcceptFailedException exceptionWithClass: [self class]
		@throw [OFAcceptFailedException exceptionWithSocket: self];
							    socket: self];
	}

	return client;
}

- (void)close
{
︙
224
225
226
227
228
229
230
231

232
233
234

235
236
237
238
239
240

241
242

243
244
245
246
247
248
249
250
251
252
253
254
255
256

257
258

259
260
261
262
263
264
265
266
267
268
269
270
271

272
273
274

275
276
277
278
279
280

281
282

283
284
285
286
287
288
289
290
291
292
293
294

295
296

297
298
299
300
301
302
303

212
213
214
215
216
217
218

219
220
221

222

223
224
225
226

227


228
229
230
231
232
233
234
235
236
237
238
239
240
241

242


243
244
245
246
247
248
249
250
251
252
253
254
255

256
257
258

259

260
261
262
263

264


265
266
267
268
269
270
271
272
273
274
275
276

277


278
279
280
281
282
283
284
285








-
+


-
+
-




-
+
-
-
+













-
+
-
-
+












-
+


-
+
-




-
+
-
-
+











-
+
-
-
+









- (size_t)lowlevelReadIntoBuffer: (void*)buffer
			  length: (size_t)length
{
	ssize_t ret;

	if (length > INT_MAX)
		@throw [OFOutOfRangeException exceptionWithClass: [self class]];
		@throw [OFOutOfRangeException exception];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotConnectedException exceptionWithClass: [self class]
		@throw [OFNotConnectedException exceptionWithSocket: self];
							    socket: self];

	if (_atEndOfStream) {
		OFReadFailedException *e;

		e = [OFReadFailedException exceptionWithClass: [self class]
		e = [OFReadFailedException exceptionWithStream: self
						       stream: self
					      requestedLength: length];
					       requestedLength: length];
#ifndef _WIN32
		e->_errNo = ENOTCONN;
#else
		e->_errNo = WSAENOTCONN;
#endif

		@throw e;
	}

	if ((ret = SSL_read(_SSL, buffer, (int)length)) < 0) {
		if (SSL_get_error(_SSL, ret) ==  SSL_ERROR_WANT_READ)
			return 0;

		@throw [OFReadFailedException exceptionWithClass: [self class]
		@throw [OFReadFailedException exceptionWithStream: self
							  stream: self
						 requestedLength: length];
						  requestedLength: length];
	}

	if (ret == 0)
		_atEndOfStream = true;

	return ret;
}

- (void)lowlevelWriteBuffer: (const void*)buffer
		     length: (size_t)length
{
	if (length > INT_MAX)
		@throw [OFOutOfRangeException exceptionWithClass: [self class]];
		@throw [OFOutOfRangeException exception];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotConnectedException exceptionWithClass: [self class]
		@throw [OFNotConnectedException exceptionWithSocket: self];
							    socket: self];

	if (_atEndOfStream) {
		OFWriteFailedException *e;

		e = [OFWriteFailedException exceptionWithClass: [self class]
		e = [OFWriteFailedException exceptionWithStream: self
							stream: self
					       requestedLength: length];
						requestedLength: length];

#ifndef _WIN32
		e->_errNo = ENOTCONN;
#else
		e->_errNo = WSAENOTCONN;
#endif

		@throw e;
	}

	if (SSL_write(_SSL, buffer, (int)length) < length)
		@throw [OFWriteFailedException exceptionWithClass: [self class]
		@throw [OFWriteFailedException exceptionWithStream: self
							   stream: self
						  requestedLength: length];
						   requestedLength: length];
}

- (size_t)numberOfBytesInReadBuffer
{
	if (_SSL == NULL)
		return [super numberOfBytesInReadBuffer];
︙
361
362
363
364
365
366
367
368

369
370
371
372
373
374
375
376
377

343
344
345
346
347
348
349

350


351
352
353
354
355
356
357








-
+
-
-








- (OFDataArray*)channelBindingDataWithType: (OFString*)type
{
	size_t length;
	char buffer[64];
	OFDataArray *data;

	if (![type isEqual: @"tls-unique"])
		@throw [OFInvalidArgumentException
		@throw [OFInvalidArgumentException exception];
		    exceptionWithClass: [self class]
			      selector: _cmd];

	if (SSL_session_reused(_SSL) ^ !_listening) {
		/*
		 * We are either client or the session has been resumed
		 * => we have sent the finished message
		 */
		length = SSL_get_finished(_SSL, buffer, 64);
︙
403
404
405
406
407
408
409
410
411

412
413
414
415
416

417
418

383
384
385
386
387
388
389


390
391
392
393


394
395
396








-
-
+



-
-
+



	unsigned long ret;

	if (SSL_get_peer_certificate(_SSL) != NULL) {
		if ((ret = SSL_get_verify_result(_SSL)) != X509_V_OK) {
			const char *tmp = X509_verify_cert_error_string(ret);
			OFString *reason = [OFString stringWithUTF8String: tmp];
			@throw [SSLInvalidCertificateException
			    exceptionWithClass: [self class]
					reason: reason];
			    exceptionWithReason: reason];
		}
	} else
		@throw [SSLInvalidCertificateException
		    exceptionWithClass: [self class]
				reason: @"No certificate"];
		    exceptionWithReason: @"No certificate"];
}
@end

Modified src/X509Certificate.m from [ea8e8f249e] to [28ac2990f0].

︙
49
50
51
52
53
54
55
56

57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

76
77
78
79
80
81
82

49
50
51
52
53
54
55

56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

75
76
77
78
79
80
81
82








-
+


















-
+








		OFDataArray *data = [OFDataArray
		    dataArrayWithContentsOfFile: path];
		const unsigned char *dataCArray = [data items];

		_certificate = d2i_X509(NULL, &dataCArray, [data count]);
		if (_certificate == NULL)
			@throw [OFInitializationFailedException
				    exceptionWithClass: [self class]];
			    exceptionWithClass: [self class]];

		[pool release];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- initWithX509Struct: (X509*)certificate
{
	self = [self init];

	@try {
		_certificate = X509_dup(certificate);
		if (_certificate == NULL)
			@throw [OFInitializationFailedException
				    exceptionWithClass: [self class]];
			    exceptionWithClass: [self class]];
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}
︙
417
418
419
420
421
422
423
424

425
426
427
428
429
430
431
432

417
418
419
420
421
422
423

424

425
426
427
428
429
430
431








-
+
-









- (OFString*)X509_stringFromASN1String: (ASN1_STRING*)str
{
	OFString *ret;
	char *buffer;

	if (ASN1_STRING_to_UTF8((unsigned char**)&buffer, str) < 0)
		@throw [OFInvalidEncodingException
		@throw [OFInvalidEncodingException exception];
		    exceptionWithClass: [self class]];

	@try {
		ret = [OFString stringWithUTF8String: buffer];
	} @finally {
		OPENSSL_free(buffer);
	}
︙