ObjOpenSSL  Check-in [e5b470a14c]

Overview
Comment:Adjust to ObjFW coding style
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: e5b470a14cfece6b58181af0cfe2d27c2f825ce241b240dd74638bb7d836a4c2
User & Date: js on 2021-04-03 20:16:07
Other Links: manifest | tags
Context
2021-04-25
20:41
Adjust to ObjFW changes check-in: a64206ee2e user: js tags: trunk
2021-04-03
20:16
Adjust to ObjFW coding style check-in: e5b470a14c user: js tags: trunk
19:48
Update buildsys check-in: 3f1ad168e1 user: js tags: trunk
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Modified src/ObjOpenSSL.h from [be6adf410d] to [5a65d1c0e8].

︙
17
18
19
20
21
22
23





17
18
19
20
21
22
23
24
25
26
27








+
+
+
+

 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#import "SSLSocket.h"
#import "X509Certificate.h"

#import "SSLConnectionFailedException.h"
#import "SSLInvalidCertificateException.h"

Modified src/SSLConnectionFailedException.m from [7fa0a8e9f5] to [a49752ab3b].

︙
78
79
80
81
82
83
84
85
86
87



88
89
90
91
92
93
94
95




96
97
98
99
100
101
102
103




104
105
106
107
108
109
110
111
112
113
114
115
116





117
118

119
120
121
122
123
124
125
126
127
128

78
79
80
81
82
83
84



85
86
87
88
89
90
91




92
93
94
95
96
97
98
99




100
101
102
103
104
105
106
107
108
109
110
111





112
113
114
115
116
117

118



119
120
121
122
123
124
125








-
-
-
+
+
+




-
-
-
-
+
+
+
+




-
-
-
-
+
+
+
+








-
-
-
-
-
+
+
+
+
+

-
+
-
-
-








	return [[[self alloc] initWithHost: host
				      port: port
				    socket: socket
				  SSLError: SSLError
			      verifyResult: verifyResult] autorelease];
}

- initWithHost: (OFString *)host
	  port: (uint16_t)port
	socket: (id)socket
- (instancetype)initWithHost: (OFString *)host
			port: (uint16_t)port
		      socket: (id)socket
{
	OF_INVALID_INIT_METHOD
}

- initWithHost: (OFString *)host
	  port: (uint16_t)port
	socket: (id)socket
	 errNo: (int)errNo
- (instancetype)initWithHost: (OFString *)host
			port: (uint16_t)port
		      socket: (id)socket
		       errNo: (int)errNo
{
	OF_INVALID_INIT_METHOD
}

- initWithHost: (OFString *)host
	  port: (uint16_t)port
	socket: (SSLSocket *)socket
      SSLError: (unsigned long)SSLError
- (instancetype)initWithHost: (OFString *)host
			port: (uint16_t)port
		      socket: (SSLSocket *)socket
		    SSLError: (unsigned long)SSLError
{
	return [self initWithHost: host
			     port: port
			   socket: socket
			 SSLError: SSLError
		     verifyResult: 0];
}

- initWithHost: (OFString *)host
	  port: (uint16_t)port
	socket: (SSLSocket *)socket
      SSLError: (unsigned long)SSLError
  verifyResult: (long)verifyResult
- (instancetype)initWithHost: (OFString *)host
			port: (uint16_t)port
		      socket: (SSLSocket *)socket
		    SSLError: (unsigned long)SSLError
		verifyResult: (long)verifyResult
{
	self = [super initWithHost: host
	self = [super initWithHost: host port: port socket: socket errNo: 0];
			      port: port
			    socket: socket
			     errNo: 0];

	_SSLError = SSLError;
	_verifyResult = verifyResult;

	return self;
}
︙

Modified src/SSLInvalidCertificateException.h from [5d12c58480] to [31c8be5e77].

︙
31
32
33
34
35
36
37
38
39


40
41
42

31
32
33
34
35
36
37


38
39
40
41
42








-
-
+
+




	OFString *_reason;
}

@property (readonly, nonatomic) OFString *reason;

+ (instancetype)exception;
+ (instancetype)exceptionWithReason: (OFString *)reason;
- init OF_UNAVAILABLE;
- initWithReason: (OFString *)reason OF_DESIGNATED_INITIALIZER;
- (instancetype)init OF_UNAVAILABLE;
- (instancetype)initWithReason: (OFString *)reason OF_DESIGNATED_INITIALIZER;
@end

OF_ASSUME_NONNULL_END

Modified src/SSLInvalidCertificateException.m from [53d49dda97] to [53b2485fef].

︙
36
37
38
39
40
41
42
43

44
45
46
47
48

49
50
51
52
53
54
55

36
37
38
39
40
41
42

43
44
45
46
47

48
49
50
51
52
53
54
55








-
+




-
+








}

+ (instancetype)exceptionWithReason: (OFString *)reason
{
	return [[[self alloc] initWithReason: reason] autorelease];
}

- init
- (instancetype)init
{
	OF_INVALID_INIT_METHOD
}

- initWithReason: (OFString *)reason
- (instancetype)initWithReason: (OFString *)reason
{
	self = [super init];

	@try {
		_reason = [reason copy];
	} @catch (id e) {
		[self release];
︙

Modified src/SSLSocket.m from [18992aefde] to [7d89379347].

︙
87
88
89
90
91
92
93
94

95
96
97
98
99
100
101
102

87
88
89
90
91
92
93

94

95
96
97
98
99
100
101








-
+
-








	if (mode & CRYPTO_LOCK)
		of_mutex_lock(&ssl_mutexes[n]);
	else
		of_mutex_unlock(&ssl_mutexes[n]);
}

@interface SSLSocket ()
- (void)SSL_startTLSWithExpectedHost: (OFString *)host
- (void)SSL_startTLSWithExpectedHost: (OFString *)host port: (uint16_t)port;
				port: (uint16_t)port;
- (void)SSL_super_close;
@end

@interface SSLSocket_ConnectDelegate: OFObject <OFTLSSocketDelegate>
{
	SSLSocket *_socket;
	OFString *_host;
︙
250
251
252
253
254
255
256
257

258
259
260
261
262
263
264
265

249
250
251
252
253
254
255

256

257
258
259
260
261
262
263








-
+
-









	[super dealloc];

	if (SSL_ != NULL)
		SSL_free(SSL_);
}

- (void)SSL_startTLSWithExpectedHost: (OFString *)host
- (void)SSL_startTLSWithExpectedHost: (OFString *)host port: (uint16_t)port
				port: (uint16_t)port
{
	of_string_encoding_t encoding;

	if ((_SSL = SSL_new(ctx)) == NULL || SSL_set_fd(_SSL, _socket) != 1) {
		unsigned long error = ERR_get_error();

		[super close];
︙
344
345
346
347
348
349
350
351

352
353
354
355
356
357
358
359
360
361
362
363
364
365
366

367
368
369
370
371
372
373
374
375

342
343
344
345
346
347
348

349

350
351
352
353
354
355
356
357
358
359
360
361
362

363


364
365
366
367
368
369
370








-
+
-













-
+
-
-








				       socket: self
				     SSLError: error];
	}
}

- (void)startTLSWithExpectedHost: (OFString *)host
{
	[self SSL_startTLSWithExpectedHost: host
	[self SSL_startTLSWithExpectedHost: host port: 0];
				      port: 0];
}

- (void)asyncConnectToHost: (OFString *)host
		      port: (uint16_t)port
	       runLoopMode: (of_run_loop_mode_t)runLoopMode
{
	void *pool = objc_autoreleasePoolPush();

	[[[SSLSocket_ConnectDelegate alloc]
	    initWithSocket: self
		      host: host
		      port: port
		  delegate: _delegate] autorelease];
	[super asyncConnectToHost: host
	[super asyncConnectToHost: host port: port runLoopMode: runLoopMode];
			     port: port
		      runLoopMode: runLoopMode];

	objc_autoreleasePoolPop(pool);
}

#ifdef OF_HAVE_BLOCKS
- (void)asyncConnectToHost: (OFString *)host
		      port: (uint16_t)port
︙
438
439
440
441
442
443
444
445

446
447
448
449
450
451
452
453
454
455
456
457

458
459
460
461
462
463
464
465

433
434
435
436
437
438
439

440

441
442
443
444
445
446
447
448
449
450

451

452
453
454
455
456
457
458








-
+
-










-
+
-








}

- (void)SSL_super_close
{
	[super close];
}

- (size_t)lowlevelReadIntoBuffer: (void *)buffer
- (size_t)lowlevelReadIntoBuffer: (void *)buffer length: (size_t)length
			  length: (size_t)length
{
	ssize_t ret;

	/*
	 * There is no SSL session yet. However, it might be necessary to read
	 * from and write to the socket before negotiating an SSL session: For
	 * example, the socket might be connected to a SOCKS5 proxy and needs
	 * to establish a SOCKS5 connection before negotiating an SSL session.
	 */
	if (_SSL == NULL)
		return [super lowlevelReadIntoBuffer: buffer
		return [super lowlevelReadIntoBuffer: buffer length: length];
					      length: length];

	if (length > INT_MAX)
		@throw [OFOutOfRangeException exception];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotOpenException exceptionWithObject: self];
︙
479
480
481
482
483
484
485
486

487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502

503
504
505
506
507
508
509
510

472
473
474
475
476
477
478

479

480
481
482
483
484
485
486
487
488
489
490
491
492
493

494

495
496
497
498
499
500
501








-
+
-














-
+
-









	if (ret == 0)
		_atEndOfStream = true;

	return ret;
}

- (size_t)lowlevelWriteBuffer: (const void *)buffer
- (size_t)lowlevelWriteBuffer: (const void *)buffer length: (size_t)length
		       length: (size_t)length
{
	int bytesWritten;

	/*
	 * There is no SSL session yet. However, it might be necessary to read
	 * from and write to the socket before negotiating an SSL session: For
	 * example, the socket might be connected to a SOCKS5 proxy and needs
	 * to establish a SOCKS5 connection before negotiating an SSL session.
	 *
	 * TODO: Think of a way to make this safer, so that it's impossible to
	 * forget to establish an SSL session and then send unencrypted data by
	 * accident.
	 */
	if (_SSL == NULL)
		return [super lowlevelWriteBuffer: buffer
		return [super lowlevelWriteBuffer: buffer length: length];
					   length: length];

	if (_socket == INVALID_SOCKET)
		@throw [OFNotOpenException exceptionWithObject: self];

	if (length > INT_MAX)
		@throw [OFOutOfRangeException exception];
︙
579
580
581
582
583
584
585
586

587
588
589
590
591
592
593
594

570
571
572
573
574
575
576

577

578
579
580
581
582
583
584








-
+
-








		 */
		length = SSL_get_finished(_SSL, buffer, 64);
	} else {
		/* peer sent the finished message */
		length = SSL_get_peer_finished(_SSL, buffer, 64);
	}

	return [OFData dataWithItems: buffer
	return [OFData dataWithItems: buffer count: length];
			       count: length];
}

- (X509Certificate *)peerCertificate
{
	X509 *certificate = SSL_get_peer_certificate(_SSL);

	if (certificate == NULL)
︙

Modified src/X509Certificate.h from [406cc0c045] to [020cde7269].

︙
44
45
46
47
48
49
50
51
52



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69



70
71
72
73
74
75
76

44
45
46
47
48
49
50


51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67



68
69
70
71
72
73
74
75
76
77








-
-
+
+
+














-
-
-
+
+
+








@class OFDictionary;

@interface X509OID: OFObject <OFCopying>
{
	OFString *_string;
}

- init OF_UNAVAILABLE;
- initWithUTF8String: (const char *)string OF_DESIGNATED_INITIALIZER;
- (instancetype)init OF_UNAVAILABLE;
- (instancetype)initWithUTF8String: (const char *)string
    OF_DESIGNATED_INITIALIZER;
@end

@interface X509Certificate: OFObject
{
	X509 *_certificate;
	OFDictionary *_issuer;
	OFDictionary *_subject;
	OFDictionary *_subjectAlternativeName;
}

@property (readonly, nonatomic) OFDictionary *issuer;
@property (readonly, nonatomic) OFDictionary *subject;
@property (readonly, nonatomic) OFDictionary *subjectAlternativeName;

- init OF_UNAVAILABLE;
- initWithFile: (OFString *)file;
- initWithX509Struct: (X509 *)cert;
- (instancetype)init OF_UNAVAILABLE;
- (instancetype)initWithFile: (OFString *)file;
- (instancetype)initWithX509Struct: (X509 *)cert;
- (bool)hasCommonNameMatchingDomain: (OFString *)domain;
- (bool)hasDNSNameMatchingDomain: (OFString *)domain;
- (bool)hasSRVNameMatchingDomain: (OFString *)domain
			 service: (OFString *)service;
@end

OF_ASSUME_NONNULL_END

Modified src/X509Certificate.m from [48c2a42784] to [adabc1fce4].

︙
61
62
63
64
65
66
67
68

69
70
71
72
73

74
75
76
77
78
79
80

61
62
63
64
65
66
67

68
69
70
71
72

73
74
75
76
77
78
79
80








-
+




-
+








- (X509OID *)X509_stringFromASN1Object: (ASN1_OBJECT *)obj;
- (OFString *)X509_stringFromASN1String: (ASN1_STRING *)str;
@end

OF_ASSUME_NONNULL_END

@implementation X509Certificate
- init
- (instancetype)init
{
	OF_INVALID_INIT_METHOD
}

- initWithFile: (OFString *)path
- (instancetype)initWithFile: (OFString *)path
{
	self = [super init];

	@try {
		void *pool = objc_autoreleasePoolPush();
		OFData *data = [OFData dataWithContentsOfFile: path];
		const unsigned char *dataItems = data.items;
︙
89
90
91
92
93
94
95
96

97
98
99
100
101
102
103

89
90
91
92
93
94
95

96
97
98
99
100
101
102
103








-
+








		[self release];
		@throw e;
	}

	return self;
}

- initWithX509Struct: (X509 *)certificate
- (instancetype)initWithX509Struct: (X509 *)certificate
{
	self = [super init];

	@try {
		_certificate = X509_dup(certificate);
		if (_certificate == NULL)
			@throw [OFInitializationFailedException
︙
209
210
211
212
213
214
215
216

217
218
219
220
221
222
223
224

209
210
211
212
213
214
215

216

217
218
219
220
221
222
223








-
+
-








				}

				key = [self X509_stringFromASN1Object:
					otherName->type_id];
				list = [types objectForKey: key];
				if (list == nil) {
					list = [OFList list];
					[types setObject: list
					[types setObject: list forKey: key];
						  forKey: key];
				}

				[list appendObject:
				    [self X509_stringFromASN1String:
					otherName->value->value.asn1_string]];
				break;
			case GEN_EMAIL:
︙
284
285
286
287
288
289
290
291
292


293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309


310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327

328
329
330
331
332
333
334

283
284
285
286
287
288
289


290
291

292
293
294
295
296
297
298
299
300
301
302
303
304
305


306
307

308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323

324
325
326
327
328
329
330
331








-
-
+
+
-














-
-
+
+
-
















-
+








	return ret;
}

- (bool)hasCommonNameMatchingDomain: (OFString *)domain
{
	void *pool = objc_autoreleasePoolPush();

	for (OFString *name in [[self subject] objectForKey: OID_commonName]) {
		if ([self X509_isAssertedDomain: name
	for (OFString *name in [self.subject objectForKey: OID_commonName]) {
		if ([self X509_isAssertedDomain: name equalDomain: domain]) {
				    equalDomain: domain]) {
			objc_autoreleasePoolPop(pool);
			return true;
		}
	}

	objc_autoreleasePoolPop(pool);
	return false;
}

- (bool)hasDNSNameMatchingDomain: (OFString *)domain
{
	void *pool = objc_autoreleasePoolPush();

	for (OFString *name in
	    [[self subjectAlternativeName] objectForKey: @"dNSName"]) {
		if ([self X509_isAssertedDomain: name
	    [self.subjectAlternativeName objectForKey: @"dNSName"]) {
		if ([self X509_isAssertedDomain: name equalDomain: domain]) {
				    equalDomain: domain]) {
			objc_autoreleasePoolPop(pool);
			return true;
		}
	}

	objc_autoreleasePoolPop(pool);
	return false;
}

- (bool)hasSRVNameMatchingDomain: (OFString *)domain
			 service: (OFString *)service
{
	size_t serviceLength;
	void *pool = objc_autoreleasePoolPush();
	OFDictionary *SANs = self.subjectAlternativeName;
	OFList *assertedNames = [[SANs objectForKey: @"otherName"]
				       objectForKey: OID_SRVName];
	    objectForKey: OID_SRVName];

	if (![service hasPrefix: @"_"])
		service = [service stringByPrependingString: @"_"];

	service = [service stringByAppendingString: @"."];
	serviceLength = service.length;
︙
373
374
375
376
377
378
379
380

381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401

402
403
404
405
406
407
408
409

370
371
372
373
374
375
376

377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397

398

399
400
401
402
403
404
405








-
+




















-
+
-








	firstDot = [domain rangeOfString: @"."].location;
	if (firstDot == OF_NOT_FOUND)
		return false;

	domain = [domain substringWithRange:
	    of_range(firstDot + 1, domain.length - firstDot - 1)];

	if (![asserted caseInsensitiveCompare: domain])
	if ([asserted caseInsensitiveCompare: domain] == 0)
		return true;

	return false;
}

- (OFDictionary *)X509_dictionaryFromX509Name: (X509_NAME *)name
{
	OFMutableDictionary *dict = [OFMutableDictionary dictionary];
	int i, count = X509_NAME_entry_count(name);

	for (i = 0; i < count; i++) {
		void *pool = objc_autoreleasePoolPush();
		X509OID *key;
		OFString *value;
		X509_NAME_ENTRY *entry = X509_NAME_get_entry(name, i);
		ASN1_OBJECT *obj = X509_NAME_ENTRY_get_object(entry);
		ASN1_STRING *str = X509_NAME_ENTRY_get_data(entry);
		key = [self X509_stringFromASN1Object: obj];

		if ([dict objectForKey: key] == nil)
			[dict setObject: [OFList list]
			[dict setObject: [OFList list] forKey: key];
				 forKey: key];

		value = [self X509_stringFromASN1String: str];
		[[dict objectForKey: key] appendObject: value];

		objc_autoreleasePoolPop(pool);
	}
︙
449
450
451
452
453
454
455
456

457
458
459
460
461

462
463
464
465
466
467
468

445
446
447
448
449
450
451

452
453
454
455
456

457
458
459
460
461
462
463
464








-
+




-
+








	}

	return ret;
}
@end

@implementation X509OID
- init
- (instancetype)init
{
	OF_INVALID_INIT_METHOD
}

- initWithUTF8String: (const char *)string
- (instancetype)initWithUTF8String: (const char *)string
{
	self = [super init];

	@try {
		_string = [[OFString alloc] initWithUTF8String: string];
	} @catch (id e) {
		[self release];
︙
500
501
502
503
504
505
506
507

508
509
510
511

496
497
498
499
500
501
502

503
504
505
506
507








-
+





}

- (unsigned long)hash
{
	return _string.hash;
}

- copy
- (id)copy
{
	return [self retain];
}
@end