Overview
Context
Changes
Modified src/ObjOpenSSL.h
from [be6adf410d]
to [5a65d1c0e8].
︙ | | |
17
18
19
20
21
22
23
|
17
18
19
20
21
22
23
24
25
26
27
|
+
+
+
+
|
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#import "SSLSocket.h"
#import "X509Certificate.h"
#import "SSLConnectionFailedException.h"
#import "SSLInvalidCertificateException.h"
|
Modified src/SSLConnectionFailedException.m
from [7fa0a8e9f5]
to [a49752ab3b].
︙ | | |
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
-
+
-
+
-
+
-
+
-
+
-
-
-
|
return [[[self alloc] initWithHost: host
port: port
socket: socket
SSLError: SSLError
verifyResult: verifyResult] autorelease];
}
- initWithHost: (OFString *)host
- (instancetype)initWithHost: (OFString *)host
port: (uint16_t)port
socket: (id)socket
{
OF_INVALID_INIT_METHOD
}
- initWithHost: (OFString *)host
- (instancetype)initWithHost: (OFString *)host
port: (uint16_t)port
socket: (id)socket
errNo: (int)errNo
{
OF_INVALID_INIT_METHOD
}
- initWithHost: (OFString *)host
- (instancetype)initWithHost: (OFString *)host
port: (uint16_t)port
socket: (SSLSocket *)socket
SSLError: (unsigned long)SSLError
{
return [self initWithHost: host
port: port
socket: socket
SSLError: SSLError
verifyResult: 0];
}
- initWithHost: (OFString *)host
- (instancetype)initWithHost: (OFString *)host
port: (uint16_t)port
socket: (SSLSocket *)socket
SSLError: (unsigned long)SSLError
verifyResult: (long)verifyResult
{
self = [super initWithHost: host
self = [super initWithHost: host port: port socket: socket errNo: 0];
port: port
socket: socket
errNo: 0];
_SSLError = SSLError;
_verifyResult = verifyResult;
return self;
}
|
︙ | | |
Modified src/SSLInvalidCertificateException.h
from [5d12c58480]
to [31c8be5e77].
︙ | | |
31
32
33
34
35
36
37
38
39
40
41
42
|
31
32
33
34
35
36
37
38
39
40
41
42
|
-
-
+
+
|
OFString *_reason;
}
@property (readonly, nonatomic) OFString *reason;
+ (instancetype)exception;
+ (instancetype)exceptionWithReason: (OFString *)reason;
- init OF_UNAVAILABLE;
- initWithReason: (OFString *)reason OF_DESIGNATED_INITIALIZER;
- (instancetype)init OF_UNAVAILABLE;
- (instancetype)initWithReason: (OFString *)reason OF_DESIGNATED_INITIALIZER;
@end
OF_ASSUME_NONNULL_END
|
Modified src/SSLInvalidCertificateException.m
from [53d49dda97]
to [53b2485fef].
︙ | | |
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
-
+
-
+
|
}
+ (instancetype)exceptionWithReason: (OFString *)reason
{
return [[[self alloc] initWithReason: reason] autorelease];
}
- init
- (instancetype)init
{
OF_INVALID_INIT_METHOD
}
- initWithReason: (OFString *)reason
- (instancetype)initWithReason: (OFString *)reason
{
self = [super init];
@try {
_reason = [reason copy];
} @catch (id e) {
[self release];
|
︙ | | |
Modified src/SSLSocket.m
from [18992aefde]
to [7d89379347].
︙ | | |
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
-
+
-
|
if (mode & CRYPTO_LOCK)
of_mutex_lock(&ssl_mutexes[n]);
else
of_mutex_unlock(&ssl_mutexes[n]);
}
@interface SSLSocket ()
- (void)SSL_startTLSWithExpectedHost: (OFString *)host
- (void)SSL_startTLSWithExpectedHost: (OFString *)host port: (uint16_t)port;
port: (uint16_t)port;
- (void)SSL_super_close;
@end
@interface SSLSocket_ConnectDelegate: OFObject <OFTLSSocketDelegate>
{
SSLSocket *_socket;
OFString *_host;
|
︙ | | |
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
|
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
|
-
+
-
|
[super dealloc];
if (SSL_ != NULL)
SSL_free(SSL_);
}
- (void)SSL_startTLSWithExpectedHost: (OFString *)host
- (void)SSL_startTLSWithExpectedHost: (OFString *)host port: (uint16_t)port
port: (uint16_t)port
{
of_string_encoding_t encoding;
if ((_SSL = SSL_new(ctx)) == NULL || SSL_set_fd(_SSL, _socket) != 1) {
unsigned long error = ERR_get_error();
[super close];
|
︙ | | |
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
|
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
|
-
+
-
-
+
-
-
|
socket: self
SSLError: error];
}
}
- (void)startTLSWithExpectedHost: (OFString *)host
{
[self SSL_startTLSWithExpectedHost: host
[self SSL_startTLSWithExpectedHost: host port: 0];
port: 0];
}
- (void)asyncConnectToHost: (OFString *)host
port: (uint16_t)port
runLoopMode: (of_run_loop_mode_t)runLoopMode
{
void *pool = objc_autoreleasePoolPush();
[[[SSLSocket_ConnectDelegate alloc]
initWithSocket: self
host: host
port: port
delegate: _delegate] autorelease];
[super asyncConnectToHost: host
[super asyncConnectToHost: host port: port runLoopMode: runLoopMode];
port: port
runLoopMode: runLoopMode];
objc_autoreleasePoolPop(pool);
}
#ifdef OF_HAVE_BLOCKS
- (void)asyncConnectToHost: (OFString *)host
port: (uint16_t)port
|
︙ | | |
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
|
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
|
-
+
-
-
+
-
|
}
- (void)SSL_super_close
{
[super close];
}
- (size_t)lowlevelReadIntoBuffer: (void *)buffer
- (size_t)lowlevelReadIntoBuffer: (void *)buffer length: (size_t)length
length: (size_t)length
{
ssize_t ret;
/*
* There is no SSL session yet. However, it might be necessary to read
* from and write to the socket before negotiating an SSL session: For
* example, the socket might be connected to a SOCKS5 proxy and needs
* to establish a SOCKS5 connection before negotiating an SSL session.
*/
if (_SSL == NULL)
return [super lowlevelReadIntoBuffer: buffer
return [super lowlevelReadIntoBuffer: buffer length: length];
length: length];
if (length > INT_MAX)
@throw [OFOutOfRangeException exception];
if (_socket == INVALID_SOCKET)
@throw [OFNotOpenException exceptionWithObject: self];
|
︙ | | |
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
|
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
|
-
+
-
-
+
-
|
if (ret == 0)
_atEndOfStream = true;
return ret;
}
- (size_t)lowlevelWriteBuffer: (const void *)buffer
- (size_t)lowlevelWriteBuffer: (const void *)buffer length: (size_t)length
length: (size_t)length
{
int bytesWritten;
/*
* There is no SSL session yet. However, it might be necessary to read
* from and write to the socket before negotiating an SSL session: For
* example, the socket might be connected to a SOCKS5 proxy and needs
* to establish a SOCKS5 connection before negotiating an SSL session.
*
* TODO: Think of a way to make this safer, so that it's impossible to
* forget to establish an SSL session and then send unencrypted data by
* accident.
*/
if (_SSL == NULL)
return [super lowlevelWriteBuffer: buffer
return [super lowlevelWriteBuffer: buffer length: length];
length: length];
if (_socket == INVALID_SOCKET)
@throw [OFNotOpenException exceptionWithObject: self];
if (length > INT_MAX)
@throw [OFOutOfRangeException exception];
|
︙ | | |
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
|
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
|
-
+
-
|
*/
length = SSL_get_finished(_SSL, buffer, 64);
} else {
/* peer sent the finished message */
length = SSL_get_peer_finished(_SSL, buffer, 64);
}
return [OFData dataWithItems: buffer
return [OFData dataWithItems: buffer count: length];
count: length];
}
- (X509Certificate *)peerCertificate
{
X509 *certificate = SSL_get_peer_certificate(_SSL);
if (certificate == NULL)
|
︙ | | |
Modified src/X509Certificate.h
from [406cc0c045]
to [020cde7269].
︙ | | |
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
-
-
+
+
+
-
-
-
+
+
+
|
@class OFDictionary;
@interface X509OID: OFObject <OFCopying>
{
OFString *_string;
}
- init OF_UNAVAILABLE;
- initWithUTF8String: (const char *)string OF_DESIGNATED_INITIALIZER;
- (instancetype)init OF_UNAVAILABLE;
- (instancetype)initWithUTF8String: (const char *)string
OF_DESIGNATED_INITIALIZER;
@end
@interface X509Certificate: OFObject
{
X509 *_certificate;
OFDictionary *_issuer;
OFDictionary *_subject;
OFDictionary *_subjectAlternativeName;
}
@property (readonly, nonatomic) OFDictionary *issuer;
@property (readonly, nonatomic) OFDictionary *subject;
@property (readonly, nonatomic) OFDictionary *subjectAlternativeName;
- init OF_UNAVAILABLE;
- initWithFile: (OFString *)file;
- initWithX509Struct: (X509 *)cert;
- (instancetype)init OF_UNAVAILABLE;
- (instancetype)initWithFile: (OFString *)file;
- (instancetype)initWithX509Struct: (X509 *)cert;
- (bool)hasCommonNameMatchingDomain: (OFString *)domain;
- (bool)hasDNSNameMatchingDomain: (OFString *)domain;
- (bool)hasSRVNameMatchingDomain: (OFString *)domain
service: (OFString *)service;
@end
OF_ASSUME_NONNULL_END
|
Modified src/X509Certificate.m
from [48c2a42784]
to [adabc1fce4].
︙ | | |
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
-
+
-
+
|
- (X509OID *)X509_stringFromASN1Object: (ASN1_OBJECT *)obj;
- (OFString *)X509_stringFromASN1String: (ASN1_STRING *)str;
@end
OF_ASSUME_NONNULL_END
@implementation X509Certificate
- init
- (instancetype)init
{
OF_INVALID_INIT_METHOD
}
- initWithFile: (OFString *)path
- (instancetype)initWithFile: (OFString *)path
{
self = [super init];
@try {
void *pool = objc_autoreleasePoolPush();
OFData *data = [OFData dataWithContentsOfFile: path];
const unsigned char *dataItems = data.items;
|
︙ | | |
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
-
+
|
[self release];
@throw e;
}
return self;
}
- initWithX509Struct: (X509 *)certificate
- (instancetype)initWithX509Struct: (X509 *)certificate
{
self = [super init];
@try {
_certificate = X509_dup(certificate);
if (_certificate == NULL)
@throw [OFInitializationFailedException
|
︙ | | |
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
|
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
|
-
+
-
|
}
key = [self X509_stringFromASN1Object:
otherName->type_id];
list = [types objectForKey: key];
if (list == nil) {
list = [OFList list];
[types setObject: list
[types setObject: list forKey: key];
forKey: key];
}
[list appendObject:
[self X509_stringFromASN1String:
otherName->value->value.asn1_string]];
break;
case GEN_EMAIL:
|
︙ | | |
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
|
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
|
-
-
+
+
-
-
-
+
+
-
|
return ret;
}
- (bool)hasCommonNameMatchingDomain: (OFString *)domain
{
void *pool = objc_autoreleasePoolPush();
for (OFString *name in [[self subject] objectForKey: OID_commonName]) {
if ([self X509_isAssertedDomain: name
for (OFString *name in [self.subject objectForKey: OID_commonName]) {
if ([self X509_isAssertedDomain: name equalDomain: domain]) {
equalDomain: domain]) {
objc_autoreleasePoolPop(pool);
return true;
}
}
objc_autoreleasePoolPop(pool);
return false;
}
- (bool)hasDNSNameMatchingDomain: (OFString *)domain
{
void *pool = objc_autoreleasePoolPush();
for (OFString *name in
[[self subjectAlternativeName] objectForKey: @"dNSName"]) {
if ([self X509_isAssertedDomain: name
[self.subjectAlternativeName objectForKey: @"dNSName"]) {
if ([self X509_isAssertedDomain: name equalDomain: domain]) {
equalDomain: domain]) {
objc_autoreleasePoolPop(pool);
return true;
}
}
objc_autoreleasePoolPop(pool);
return false;
|
︙ | | |
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
|
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
|
-
+
-
+
-
|
firstDot = [domain rangeOfString: @"."].location;
if (firstDot == OF_NOT_FOUND)
return false;
domain = [domain substringWithRange:
of_range(firstDot + 1, domain.length - firstDot - 1)];
if (![asserted caseInsensitiveCompare: domain])
if ([asserted caseInsensitiveCompare: domain] == 0)
return true;
return false;
}
- (OFDictionary *)X509_dictionaryFromX509Name: (X509_NAME *)name
{
OFMutableDictionary *dict = [OFMutableDictionary dictionary];
int i, count = X509_NAME_entry_count(name);
for (i = 0; i < count; i++) {
void *pool = objc_autoreleasePoolPush();
X509OID *key;
OFString *value;
X509_NAME_ENTRY *entry = X509_NAME_get_entry(name, i);
ASN1_OBJECT *obj = X509_NAME_ENTRY_get_object(entry);
ASN1_STRING *str = X509_NAME_ENTRY_get_data(entry);
key = [self X509_stringFromASN1Object: obj];
if ([dict objectForKey: key] == nil)
[dict setObject: [OFList list]
[dict setObject: [OFList list] forKey: key];
forKey: key];
value = [self X509_stringFromASN1String: str];
[[dict objectForKey: key] appendObject: value];
objc_autoreleasePoolPop(pool);
}
|
︙ | | |
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
|
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
|
-
+
-
+
|
}
return ret;
}
@end
@implementation X509OID
- init
- (instancetype)init
{
OF_INVALID_INIT_METHOD
}
- initWithUTF8String: (const char *)string
- (instancetype)initWithUTF8String: (const char *)string
{
self = [super init];
@try {
_string = [[OFString alloc] initWithUTF8String: string];
} @catch (id e) {
[self release];
|
︙ | | |
500
501
502
503
504
505
506
507
508
509
510
511
|
496
497
498
499
500
501
502
503
504
505
506
507
|
-
+
|
}
- (unsigned long)hash
{
return _string.hash;
}
- copy
- (id)copy
{
return [self retain];
}
@end
|