ObjFW  Check-in [2cb48ceaf1]

Overview
Comment:OFGnuTLSTLSStream: Add server support
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | tls-server
Files: files | file ages | folders
SHA3-256: 2cb48ceaf1d0c54a929080b17bcf0f994335809830ae6d0cbd8ae81dc9f2644b
User & Date: js on 2024-11-18 00:38:04
Other Links: branch diff | manifest | tags
Context
2024-11-18
00:47
Make GCC happy again Leaf check-in: f6cc2092af user: js tags: tls-server
00:38
OFGnuTLSTLSStream: Add server support check-in: 2cb48ceaf1 user: js tags: tls-server
2024-11-16
22:36
OFTLSStream: Add API for server mode check-in: 43864736e7 user: js tags: tls-server
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Modified src/Makefile from [486aeb0a5d] to [6a4c7a76fd].

︙︙
149
150
151
152
153
154
155

156
157
158
159
160
161
162

	       OFSystemInfo+NetworkInterfaces.m	\
	       OFTCPSocket.m			\
	       OFTLSStream.m			\
	       OFTXTDNSResourceRecord.m		\
	       OFUDPSocket.m			\
	       OFURIDNSResourceRecord.m		\
	       OFX509Certificate.m		\

	       ${USE_SRCS_APPLETALK}		\
	       ${USE_SRCS_IPX}			\
	       ${USE_SRCS_SCTP}			\
	       ${USE_SRCS_UNIX_SOCKETS}
SRCS_APPLETALK = OFDDPSocket.m
SRCS_IPX = OFIPXSocket.m	\
	   OFSPXSocket.m	\








>








149
150
151
152
153
154
155
156
157
158
159
160
161
162
163

	       OFSystemInfo+NetworkInterfaces.m	\
	       OFTCPSocket.m			\
	       OFTLSStream.m			\
	       OFTXTDNSResourceRecord.m		\
	       OFUDPSocket.m			\
	       OFURIDNSResourceRecord.m		\
	       OFX509Certificate.m		\
	       OFX509CertificatePrivateKey.m	\
	       ${USE_SRCS_APPLETALK}		\
	       ${USE_SRCS_IPX}			\
	       ${USE_SRCS_SCTP}			\
	       ${USE_SRCS_UNIX_SOCKETS}
SRCS_APPLETALK = OFDDPSocket.m
SRCS_IPX = OFIPXSocket.m	\
	   OFSPXSocket.m	\
︙︙

Modified src/OFTLSStream.h from [1a6c8de484] to [73461e1dca].

︙︙
15
16
17
18
19
20
21


22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFStream.h"
#import "OFRunLoop.h"



OF_ASSUME_NONNULL_BEGIN

/** @file */

@class OFArray OF_GENERIC(ObjectType);
@class OFTLSStream;
@class OFX509Certificate;

/**
 * @brief An enum representing an error of an OFTLSStream.
 */
typedef enum {
	/** @brief An unknown error. */
	OFTLSStreamErrorCodeUnknown,








>
>







<








15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

31
32
33
34
35
36
37

 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFStream.h"
#import "OFRunLoop.h"
#import "OFX509Certificate.h"
#import "OFX509CertificatePrivateKey.h"

OF_ASSUME_NONNULL_BEGIN

/** @file */

@class OFArray OF_GENERIC(ObjectType);
@class OFTLSStream;


/**
 * @brief An enum representing an error of an OFTLSStream.
 */
typedef enum {
	/** @brief An unknown error. */
	OFTLSStreamErrorCodeUnknown,
︙︙
98
99
100
101
102
103
104

105

106
107
108
109
110
111
112
113

 */
@interface OFTLSStream: OFStream <OFReadyForReadingObserving,
    OFReadyForWritingObserving>
{
	OFStream <OFReadyForReadingObserving, OFReadyForWritingObserving>
	    *_underlyingStream;
	bool _verifiesCertificates;

	OFArray OF_GENERIC(OFX509Certificate *) *_Nullable _certificateChain;

	OF_RESERVE_IVARS(OFTLSStream, 3)
}

/**
 * @brief The underlying stream.
 */
@property (readonly, nonatomic) OFStream <OFReadyForReadingObserving,
    OFReadyForWritingObserving> *underlyingStream;








>
|
>
|








99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

 */
@interface OFTLSStream: OFStream <OFReadyForReadingObserving,
    OFReadyForWritingObserving>
{
	OFStream <OFReadyForReadingObserving, OFReadyForWritingObserving>
	    *_underlyingStream;
	bool _verifiesCertificates;
	OFArray OF_GENERIC(OF_KINDOF(OFX509Certificate *)) *_Nullable
	    _certificateChain;
	OF_KINDOF(OFX509CertificatePrivateKey *) _Nullable _privateKey;
	OF_RESERVE_IVARS(OFTLSStream, 2)
}

/**
 * @brief The underlying stream.
 */
@property (readonly, nonatomic) OFStream <OFReadyForReadingObserving,
    OFReadyForWritingObserving> *underlyingStream;
︙︙
128
129
130
131
132
133
134






135
136
137
138
139
140
141


/**
 * @brief The certificate chain to use.
 */
@property OF_NULLABLE_PROPERTY (copy, nonatomic)
    OFArray OF_GENERIC(OFX509Certificate *) *certificateChain;







- (instancetype)init OF_UNAVAILABLE;

/**
 * @brief Creates a new TLS stream with the specified stream as its underlying
 *	  stream.
 *
 * @param stream The stream to use as underlying stream. Must not be closed








>
>
>
>
>
>








131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150


/**
 * @brief The certificate chain to use.
 */
@property OF_NULLABLE_PROPERTY (copy, nonatomic)
    OFArray OF_GENERIC(OFX509Certificate *) *certificateChain;

/**
 * @brief The private key to use.
 */
@property OF_NULLABLE_PROPERTY (retain, nonatomic)
    OFX509CertificatePrivateKey *privateKey;

- (instancetype)init OF_UNAVAILABLE;

/**
 * @brief Creates a new TLS stream with the specified stream as its underlying
 *	  stream.
 *
 * @param stream The stream to use as underlying stream. Must not be closed
︙︙
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238

#ifdef __cplusplus
extern "C" {
#endif
/**
 * @brief The implementation for OFTLSStream to use.
 *
 * This can be set to a class that is always used for OFTLSStream. This is
 * useful to either force a specific implementation or use one that ObjFW does
 * not know about.
 */
extern Class OFTLSStreamImplementation;

/**
 * @brief Returns a string description for the TLS stream error code.
 *
 * @param errorCode The error code to return the description for








|
|








232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247

#ifdef __cplusplus
extern "C" {
#endif
/**
 * @brief The implementation for OFTLSStream to use.
 *
 * This can be set to a class that is always used for OFTLSStream. This is
 * useful to either force a specific implementation or to use one that ObjFW
 * does not know about.
 */
extern Class OFTLSStreamImplementation;

/**
 * @brief Returns a string description for the TLS stream error code.
 *
 * @param errorCode The error code to return the description for
︙︙

Modified src/OFTLSStream.m from [3b181aebf6] to [0875600981].

︙︙
93
94
95
96
97
98
99

100
101
102
103
104
105
106

}
@end

@implementation OFTLSStream
@synthesize underlyingStream = _underlyingStream;
@dynamic delegate;
@synthesize verifiesCertificates = _verifiesCertificates;


+ (instancetype)alloc
{
	if (self == [OFTLSStream class]) {
		if (OFTLSStreamImplementation != Nil)
			return [OFTLSStreamImplementation alloc];









>








93
94
95
96
97
98
99
100
101
102
103
104
105
106
107

}
@end

@implementation OFTLSStream
@synthesize underlyingStream = _underlyingStream;
@dynamic delegate;
@synthesize verifiesCertificates = _verifiesCertificates;
@synthesize privateKey = _privateKey;

+ (instancetype)alloc
{
	if (self == [OFTLSStream class]) {
		if (OFTLSStreamImplementation != Nil)
			return [OFTLSStreamImplementation alloc];
︙︙

Modified src/OFX509Certificate.h from [bbdec4f618] to [6f5ea71b48].

︙︙
17
18
19
20
21
22
23



24
25
26
27
28
29
30
31
32













33















34
35

 * <https://www.gnu.org/licenses/>.
 */

#import "OFObject.h"

OF_ASSUME_NONNULL_BEGIN




/**
 * @class OFX509Certificate OFX509Certificate.h ObjFW/ObjFW.h
 *
 * @brief An X.509 certificate.
 */
@interface OFX509Certificate: OFObject
{
	OF_RESERVE_IVARS(OFX509Certificate, 4)
}













@end
















OF_ASSUME_NONNULL_END








>
>
>









>
>
>
>
>
>
>
>
>
>
>
>
>

>
>
>
>
>
>
>
>
>
>
>
>
>
>
>



17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

 * <https://www.gnu.org/licenses/>.
 */

#import "OFObject.h"

OF_ASSUME_NONNULL_BEGIN

@class OFArray OF_GENERIC(ObjectType);
@class OFIRI;

/**
 * @class OFX509Certificate OFX509Certificate.h ObjFW/ObjFW.h
 *
 * @brief An X.509 certificate.
 */
@interface OFX509Certificate: OFObject
{
	OF_RESERVE_IVARS(OFX509Certificate, 4)
}

/**
 * @brief Returns a certificate chain from the specified IRI.
 *
 * @param IRI The IRI to retrieve the certificate chain from
 *
 * @throw OFOpenItemFailedException Opening the item failed
 * @throw OFUnsupportedProtocolException The specified IRI is not supported
 * @throw OFReadFailedException Reading the item failed
 * @throw OFInvalidFormatException The format of the item is invalid
 */
+ (OFArray OF_GENERIC(OFX509Certificate *) *)
    certificateChainFromIRI: (OFIRI *)IRI;
@end

#ifdef __cplusplus
extern "C" {
#endif
/**
 * @brief The implementation for OFX509Certificate to use.
 *
 * This can be set to a class that is always used for OFX509Certificate. This
 * is useful to either force a specific implementation or to use one that ObjFW
 * does not know about.
 */
extern Class OFX509CertificateImplementation;
#ifdef __cplusplus
}
#endif

OF_ASSUME_NONNULL_END

Modified src/OFX509Certificate.m from [bef6dd357c] to [020fab5772].

︙︙
34
35
36
37
38
39
40










41


		@throw [OFNotImplementedException exceptionWithSelector: _cmd
								 object: self];
	}

	return [super alloc];
}










@end








>
>
>
>
>
>
>
>
>
>


34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


		@throw [OFNotImplementedException exceptionWithSelector: _cmd
								 object: self];
	}

	return [super alloc];
}

+ (OFArray OF_GENERIC(OFX509Certificate *) *)
    certificateChainFromIRI: (OFIRI *)IRI
{
	if (OFX509CertificateImplementation != Nil)
		return [OFX509CertificateImplementation
		    certificateChainFromIRI: IRI];

	OF_UNRECOGNIZED_SELECTOR
}
@end

Added src/OFX509CertificatePrivateKey.h version [c6b920cf5c]. 







































































































































>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFObject.h"

OF_ASSUME_NONNULL_BEGIN

@class OFIRI;

/**
 * @class OFX509CertificatePrivateKey \
 *	  OFX509CertificatePrivateKey.h ObjFW/ObjFW.h
 *
 * @brief The private key for an X.509 certificate.
 */
@interface OFX509CertificatePrivateKey: OFObject
{
	OF_RESERVE_IVARS(OFX509Certificate, 4)
}

/**
 * @brief Returns a private key from the specified IRI.
 *
 * @param IRI The IRI to retrieve the private key from
 *
 * @throw OFInitializationFailedException Initializing the private key failed
 * @throw OFOpenItemFailedException Opening the item failed
 * @throw OFUnsupportedProtocolException The specified IRI is not supported
 * @throw OFReadFailedException Reading the item failed
 * @throw OFInvalidFormatException The format of the item is invalid
 */
+ (instancetype)privateKeyFromIRI: (OFIRI *)IRI;
@end

#ifdef __cplusplus
extern "C" {
#endif
/**
 * @brief The implementation for OFX509CertificatePrivateKey to use.
 *
 * This can be set to a class that is always used for
 * OFX509CertificatePrivateKey. This is useful to either force a specific
 * implementation or to use one that ObjFW does not know about.
 */
extern Class OFX509CertificatePrivateKeyImplementation;
#ifdef __cplusplus
}
#endif

OF_ASSUME_NONNULL_END

Added src/OFX509CertificatePrivateKey.m version [89a24cbac0]. 









































































































>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#include "config.h"

#import "OFX509CertificatePrivateKey.h"

#import "OFNotImplementedException.h"

Class OFX509CertificatePrivateKeyImplementation = Nil;

@implementation OFX509CertificatePrivateKey
+ (instancetype)alloc
{
	if (self == [OFX509CertificatePrivateKey class]) {
		if (OFX509CertificatePrivateKeyImplementation != Nil)
			return
			    [OFX509CertificatePrivateKeyImplementation alloc];

		@throw [OFNotImplementedException exceptionWithSelector: _cmd
								 object: self];
	}

	return [super alloc];
}

+ (instancetype)privateKeyFromIRI: (OFIRI *)IRI
{
	if (OFX509CertificatePrivateKeyImplementation != Nil)
		return [OFX509CertificatePrivateKeyImplementation
		    privateKeyFromIRI: IRI];

	OF_UNRECOGNIZED_SELECTOR
}
@end

Modified src/ObjFW.h from [700d623d15] to [e5760f4c54].

︙︙
82
83
84
85
86
87
88


89
90
91
92
93
94
95

#ifdef OF_HAVE_SOCKETS
# import "OFStreamSocket.h"
# import "OFDatagramSocket.h"
# import "OFSequencedPacketSocket.h"
# import "OFTCPSocket.h"
# import "OFUDPSocket.h"
# import "OFTLSStream.h"


# import "OFKernelEventObserver.h"
# import "OFDNSQuery.h"
# import "OFDNSResourceRecord.h"
# import "OFDNSResponse.h"
# import "OFDNSResolver.h"
# ifdef OF_HAVE_SCTP
#  import "OFSCTPSocket.h"








>
>








82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

#ifdef OF_HAVE_SOCKETS
# import "OFStreamSocket.h"
# import "OFDatagramSocket.h"
# import "OFSequencedPacketSocket.h"
# import "OFTCPSocket.h"
# import "OFUDPSocket.h"
# import "OFTLSStream.h"
# import "OFX509Certificate.h"
# import "OFX509CertificatePrivateKey.h"
# import "OFKernelEventObserver.h"
# import "OFDNSQuery.h"
# import "OFDNSResourceRecord.h"
# import "OFDNSResponse.h"
# import "OFDNSResolver.h"
# ifdef OF_HAVE_SCTP
#  import "OFSCTPSocket.h"
︙︙

Modified src/tls/Makefile from [24a2c6b174] to [6ba02952f9].

︙︙
11
12
13
14
15
16
17
18


19
20
21
22
23
24
25


INCLUDES := ObjFWTLS.h
SRCS = ${USE_SRCS_GNUTLS}		\
       ${USE_SRCS_MBEDTLS}		\
       ${USE_SRCS_OPENSSL}		\
       ${USE_SRCS_SECURETRANSPORT}

SRCS_GNUTLS = OFGnuTLSTLSStream.m


SRCS_MBEDTLS = OFMbedTLSTLSStream.m
SRCS_OPENSSL = OFOpenSSLTLSStream.m
SRCS_SECURETRANSPORT = OFSecureTransportTLSStream.m

includesubdir = ObjFWTLS

include ../../buildsys.mk








|
>
>








11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


INCLUDES := ObjFWTLS.h
SRCS = ${USE_SRCS_GNUTLS}		\
       ${USE_SRCS_MBEDTLS}		\
       ${USE_SRCS_OPENSSL}		\
       ${USE_SRCS_SECURETRANSPORT}

SRCS_GNUTLS = OFGnuTLSTLSStream.m			\
	      OFGnuTLSX509Certificate.m			\
	      OFGnuTLSX509CertificatePrivateKey.m
SRCS_MBEDTLS = OFMbedTLSTLSStream.m
SRCS_OPENSSL = OFOpenSSLTLSStream.m
SRCS_SECURETRANSPORT = OFSecureTransportTLSStream.m

includesubdir = ObjFWTLS

include ../../buildsys.mk
︙︙

Modified src/tls/OFGnuTLSTLSStream.h from [ad70118309] to [319a08ef71].

︙︙
19
20
21
22
23
24
25

26
27
28
29

30
31
32
33
34


#import "OFTLSStream.h"

#include <gnutls/gnutls.h>

OF_ASSUME_NONNULL_BEGIN


@interface OFGnuTLSTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _initialized, _handshakeDone;
	gnutls_session_t _session;

	OFString *_host;
}
@end

OF_ASSUME_NONNULL_END








>


|

>






19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


#import "OFTLSStream.h"

#include <gnutls/gnutls.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFGnuTLSTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _server, _handshakeDone;
	gnutls_session_t _session;
	gnutls_certificate_credentials_t _credentials;
	OFString *_host;
}
@end

OF_ASSUME_NONNULL_END

Modified src/tls/OFGnuTLSTLSStream.m from [84d62d35d3] to [2feefe95de].

︙︙
18
19
20
21
22
23
24

25


26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

 */

#include "config.h"

#include <errno.h>

#import "OFGnuTLSTLSStream.h"

#import "OFData.h"



#import "OFAlreadyOpenException.h"
#import "OFInitializationFailedException.h"
#import "OFNotOpenException.h"
#import "OFReadFailedException.h"
#import "OFTLSHandshakeFailedException.h"
#import "OFWriteFailedException.h"

int _ObjFWTLS_reference;
static gnutls_certificate_credentials_t systemTrustCreds;

#ifndef GNUTLS_SAFE_PADDING_CHECK
/* Some older versions don't have it. */
# define GNUTLS_SAFE_PADDING_CHECK 0
#endif

static OFTLSStreamErrorCode








>

>
>









<








18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

38
39
40
41
42
43
44

 */

#include "config.h"

#include <errno.h>

#import "OFGnuTLSTLSStream.h"
#import "OFArray.h"
#import "OFData.h"
#import "OFGnuTLSX509Certificate.h"
#import "OFGnuTLSX509CertificatePrivateKey.h"

#import "OFAlreadyOpenException.h"
#import "OFInitializationFailedException.h"
#import "OFNotOpenException.h"
#import "OFReadFailedException.h"
#import "OFTLSHandshakeFailedException.h"
#import "OFWriteFailedException.h"

int _ObjFWTLS_reference;


#ifndef GNUTLS_SAFE_PADDING_CHECK
/* Some older versions don't have it. */
# define GNUTLS_SAFE_PADDING_CHECK 0
#endif

static OFTLSStreamErrorCode
︙︙
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

148






149
150
151
152
153
154
155
156


+ (void)load
{
	if (OFTLSStreamImplementation == Nil)
		OFTLSStreamImplementation = self;
}

+ (void)initialize
{
	if (self != [OFGnuTLSTLSStream class])
		return;

	if (gnutls_certificate_allocate_credentials(&systemTrustCreds) !=
	    GNUTLS_E_SUCCESS ||
	    gnutls_certificate_set_x509_system_trust(systemTrustCreds) < 0)
		@throw [OFInitializationFailedException exception];
}

- (instancetype)initWithStream: (OFStream <OFReadyForReadingObserving,
				     OFReadyForWritingObserving> *)stream
{
	self = [super initWithStream: stream];

	@try {
		_underlyingStream.delegate = self;
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- (void)dealloc
{
	if (_initialized)
		[self close];

	[_host release];

	[super dealloc];
}

- (void)close
{
	if (!_initialized)
		@throw [OFNotOpenException exceptionWithObject: self];

	if (_handshakeDone)
		gnutls_bye(_session, GNUTLS_SHUT_WR);


	gnutls_deinit(_session);






	_initialized = _handshakeDone = false;

	[_host release];
	_host = nil;

	[super close];
}









<
<
<
<
<
<
<
<
<
<
<

















<
|








<
<
<



>
|
>
>
>
>
>
>
|








99
100
101
102
103
104
105











106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

123
124
125
126
127
128
129
130
131



132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150


+ (void)load
{
	if (OFTLSStreamImplementation == Nil)
		OFTLSStreamImplementation = self;
}












- (instancetype)initWithStream: (OFStream <OFReadyForReadingObserving,
				     OFReadyForWritingObserving> *)stream
{
	self = [super initWithStream: stream];

	@try {
		_underlyingStream.delegate = self;
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- (void)dealloc
{

	[self close];

	[_host release];

	[super dealloc];
}

- (void)close
{



	if (_handshakeDone)
		gnutls_bye(_session, GNUTLS_SHUT_WR);

	if (_session != NULL)
		gnutls_deinit(_session);

	if (_credentials != NULL)
		gnutls_certificate_free_credentials(_credentials);

	_session = NULL;
	_credentials = NULL;
	_handshakeDone = false;

	[_host release];
	_host = nil;

	[super close];
}
︙︙
206
207
208
209
210
211
212
213

214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240

241
242
243
244
245
246

247

248
249
































250
251
252
253
254
255
256
257
258
259
260
261
262
263
264


- (bool)lowlevelHasDataInReadBuffer
{
	return (_underlyingStream.hasDataInReadBuffer ||
	    gnutls_record_check_pending(_session) > 0);
}

- (void)asyncPerformClientHandshakeWithHost: (OFString *)host

				runLoopMode: (OFRunLoopMode)runLoopMode
{
	static const OFTLSStreamErrorCode initFailedErrorCode =
	    OFTLSStreamErrorCodeInitializationFailed;
	void *pool = objc_autoreleasePoolPush();
	id exception = nil;
	int status;

	if (_initialized)
		@throw [OFAlreadyOpenException exceptionWithObject: self];

	if (gnutls_init(&_session, GNUTLS_CLIENT | GNUTLS_NONBLOCK |
	    GNUTLS_SAFE_PADDING_CHECK) != GNUTLS_E_SUCCESS)
		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];

	_initialized = true;

	gnutls_transport_set_ptr(_session, self);
	gnutls_transport_set_pull_function(_session, readFunc);
	gnutls_transport_set_push_function(_session, writeFunc);

	if (gnutls_set_default_priority(_session) != GNUTLS_E_SUCCESS ||
	    gnutls_credentials_set(_session, GNUTLS_CRD_CERTIFICATE,
	    systemTrustCreds) != GNUTLS_E_SUCCESS)

		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];

	_host = [host copy];



	if (gnutls_server_name_set(_session, GNUTLS_NAME_DNS,
	    _host.UTF8String, _host.UTF8StringLength) != GNUTLS_E_SUCCESS)
































		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];

	if (_verifiesCertificates)
		gnutls_session_set_verify_cert(_session, _host.UTF8String, 0);

	status = gnutls_handshake(_session);

	if (status == GNUTLS_E_INTERRUPTED || status == GNUTLS_E_AGAIN) {
		if (gnutls_record_get_direction(_session) == 1)
			[_underlyingStream asyncWriteData: [OFData data]
					      runLoopMode: runLoopMode];
		else








|
>
|







|


|
|





<
<





|
|
>






>

>
|
|
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>





<
<
<








200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226


227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282



283
284
285
286
287
288
289


- (bool)lowlevelHasDataInReadBuffer
{
	return (_underlyingStream.hasDataInReadBuffer ||
	    gnutls_record_check_pending(_session) > 0);
}

- (void)of_asyncPerformHandshakeWithHost: (OFString *)host
				  server: (bool)server
			     runLoopMode: (OFRunLoopMode)runLoopMode
{
	static const OFTLSStreamErrorCode initFailedErrorCode =
	    OFTLSStreamErrorCodeInitializationFailed;
	void *pool = objc_autoreleasePoolPush();
	id exception = nil;
	int status;

	if (_handshakeDone)
		@throw [OFAlreadyOpenException exceptionWithObject: self];

	if (gnutls_init(&_session, (server ? GNUTLS_SERVER : GNUTLS_CLIENT) |
	    GNUTLS_NONBLOCK | GNUTLS_SAFE_PADDING_CHECK) != GNUTLS_E_SUCCESS)
		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];



	gnutls_transport_set_ptr(_session, self);
	gnutls_transport_set_pull_function(_session, readFunc);
	gnutls_transport_set_push_function(_session, writeFunc);

	if (gnutls_set_default_priority(_session) != GNUTLS_E_SUCCESS ||
	    gnutls_certificate_allocate_credentials(&_credentials) !=
	    GNUTLS_E_SUCCESS ||
	    gnutls_certificate_set_x509_system_trust(_credentials) < 0)
		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];

	_host = [host copy];
	_server = server;

	if (!server) {
		if (gnutls_server_name_set(_session, GNUTLS_NAME_DNS,
		    _host.UTF8String, _host.UTF8StringLength) !=
		    GNUTLS_E_SUCCESS)
			@throw [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: host
				      errorCode: initFailedErrorCode];

		if (_verifiesCertificates)
			gnutls_session_set_verify_cert(_session, _host.UTF8String, 0);
	}

	if (_certificateChain != nil) {
		OFMutableData *certs = [OFMutableData
		    dataWithItemSize: sizeof(gnutls_x509_crt_t)
			    capacity: _certificateChain.count];

		for (OFGnuTLSX509Certificate *cert in _certificateChain) {
			gnutls_x509_crt_t gnuTLSCert =
			    cert.of_gnuTLSCertificate;
			[certs addItem: &gnuTLSCert];
		}

		if (gnutls_certificate_set_x509_key(_credentials,
		    (gnutls_x509_crt_t *)certs.items, (unsigned int)certs.count,
		    [_privateKey of_gnuTLSPrivateKey]) < 0)
			@throw [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: host
				      errorCode: initFailedErrorCode];
	}

	if (gnutls_credentials_set(_session, GNUTLS_CRD_CERTIFICATE,
	    _credentials) != GNUTLS_E_SUCCESS)
		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];




	status = gnutls_handshake(_session);

	if (status == GNUTLS_E_INTERRUPTED || status == GNUTLS_E_AGAIN) {
		if (gnutls_record_get_direction(_session) == 1)
			[_underlyingStream asyncWriteData: [OFData data]
					      runLoopMode: runLoopMode];
		else
︙︙
283
284
285
286
287
288
289

290





291
292
293
294
295

296
297















298
299
300
301
302
303
304

		/* FIXME: Map to better errors */
		exception = [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: errorCode];
	}


	if ([_delegate respondsToSelector:





	    @selector(stream:didPerformClientHandshakeWithHost:exception:)])
		[_delegate		       stream: self
		    didPerformClientHandshakeWithHost: host
					    exception: exception];


	objc_autoreleasePoolPop(pool);
}
















-      (bool)stream: (OFStream *)stream
  didReadIntoBuffer: (void *)buffer
	     length: (size_t)length
	  exception: (id)exception
{
	if (exception == nil) {








>
|
>
>
>
>
>
|
|
|
|
|
>


>
>
>
>
>
>
>
>
>
>
>
>
>
>
>








308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351

		/* FIXME: Map to better errors */
		exception = [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: errorCode];
	}

	if (server) {
		if ([_delegate respondsToSelector: @selector(
		    streamDidPerformServerHandshake:exception:)])
			[_delegate streamDidPerformServerHandshake: self
							 exception: exception];
	} else {
		if ([_delegate respondsToSelector: @selector(stream:
		    didPerformClientHandshakeWithHost:exception:)])
			[_delegate		       stream: self
			    didPerformClientHandshakeWithHost: host
						    exception: exception];
	}

	objc_autoreleasePoolPop(pool);
}

- (void)asyncPerformClientHandshakeWithHost: (OFString *)host
				runLoopMode: (OFRunLoopMode)runLoopMode
{
	[self of_asyncPerformHandshakeWithHost: host
					server: false
				   runLoopMode: runLoopMode];
}

- (void)asyncPerformServerHandshakeWithRunLoopMode: (OFRunLoopMode)runLoopMode
{
	[self of_asyncPerformHandshakeWithHost: nil
					server: true
				   runLoopMode: runLoopMode];
}

-      (bool)stream: (OFStream *)stream
  didReadIntoBuffer: (void *)buffer
	     length: (size_t)length
	  exception: (id)exception
{
	if (exception == nil) {
︙︙
321
322
323
324
325
326
327

328





329
330
331
332

333
334
335
336
337
338
339

		else
			exception = [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: _host
				      errorCode: OFTLSStreamErrorCodeUnknown];
	}


	if ([_delegate respondsToSelector:





	    @selector(stream:didPerformClientHandshakeWithHost:exception:)])
		[_delegate		       stream: self
		    didPerformClientHandshakeWithHost: _host
					    exception: exception];


	[_delegate release];

	return false;
}

- (OFData *)stream: (OFStream *)stream








>
|
>
>
>
>
>
|
|
|
|
>








368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393

		else
			exception = [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: _host
				      errorCode: OFTLSStreamErrorCodeUnknown];
	}

	if (_server) {
		if ([_delegate respondsToSelector: @selector(
		    streamDidPerformServerHandshake:exception:)])
			[_delegate streamDidPerformServerHandshake: self
							 exception: exception];
	} else {
		if ([_delegate respondsToSelector: @selector(stream:
		    didPerformClientHandshakeWithHost:exception:)])
			[_delegate		       stream: self
			    didPerformClientHandshakeWithHost: _host
						    exception: exception];
	}

	[_delegate release];

	return false;
}

- (OFData *)stream: (OFStream *)stream
︙︙
364
365
366
367
368
369
370

371





372
373
374
375

376
377
378
379
380
381

		else
			exception = [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: _host
				      errorCode: OFTLSStreamErrorCodeUnknown];
	}


	if ([_delegate respondsToSelector:





	    @selector(stream:didPerformClientHandshakeWithHost:exception:)])
		[_delegate		       stream: self
		    didPerformClientHandshakeWithHost: _host
					    exception: exception];


	[_delegate release];

	return nil;
}
@end








>
|
>
>
>
>
>
|
|
|
|
>







418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442

		else
			exception = [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: _host
				      errorCode: OFTLSStreamErrorCodeUnknown];
	}

	if (_server) {
		if ([_delegate respondsToSelector: @selector(
		    streamDidPerformServerHandshake:exception:)])
			[_delegate streamDidPerformServerHandshake: self
							 exception: exception];
	} else {
		if ([_delegate respondsToSelector: @selector(stream:
		    didPerformClientHandshakeWithHost:exception:)])
			[_delegate		       stream: self
			    didPerformClientHandshakeWithHost: _host
						    exception: exception];
	}

	[_delegate release];

	return nil;
}
@end

Added src/tls/OFGnuTLSX509Certificate.h version [2e16455f00]. 













































































>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFX509Certificate.h"

#include <gnutls/x509.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFGnuTLSX509Certificate: OFX509Certificate
{
	gnutls_x509_crt_t _certificate;
}

@property (readonly, nonatomic) gnutls_x509_crt_t of_gnuTLSCertificate;

- (instancetype)of_initWithGnuTLSCertificate: (gnutls_x509_crt_t)certificate;
@end

OF_ASSUME_NONNULL_END

Added src/tls/OFGnuTLSX509Certificate.m version [f1631a4c53]. 















































































































































































































>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#include "config.h"

#import "OFGnuTLSX509Certificate.h"
#import "OFArray.h"
#import "OFData.h"

#import "OFInvalidFormatException.h"
#import "OFOutOfRangeException.h"

@implementation OFGnuTLSX509Certificate
@synthesize of_gnuTLSCertificate = _certificate;

+ (void)load
{
	if (OFX509CertificateImplementation == Nil)
		OFX509CertificateImplementation = self;
}

+ (OFArray OF_GENERIC(OFX509Certificate *) *)
    certificateChainFromIRI: (OFIRI *)IRI
{
	OFMutableArray *chain = [OFMutableArray array];
	void *pool = objc_autoreleasePoolPush();
	OFData *data = [OFData dataWithContentsOfIRI: IRI];
	gnutls_datum_t datum;
	gnutls_x509_crt_t *certs;
	unsigned int i, size;

	if (data.count * data.itemSize > UINT_MAX)
		@throw [OFOutOfRangeException exception];

	datum.data = (unsigned char *)data.items;
	datum.size = (unsigned int)(data.count * data.itemSize);

	if (gnutls_x509_crt_list_import2(&certs, &size, &datum,
	    GNUTLS_X509_FMT_PEM, 0) != GNUTLS_E_SUCCESS)
		@throw [OFInvalidFormatException exception];

	for (i = 0; i < size; i++) {
		OFGnuTLSX509Certificate *certificate;

		@try {
			certificate = [[self alloc]
			    of_initWithGnuTLSCertificate: certs[i]];
		} @catch (id e) {
			gnutls_x509_crt_deinit(certs[i]);
			gnutls_free(certs);
			@throw e;
		}

		@try {
			[chain addObject: certificate];
		} @catch (id e) {
			gnutls_free(certs);
			@throw e;
		} @finally {
			[certificate release];
		}
	}

	gnutls_free(certs);

	objc_autoreleasePoolPop(pool);

	return chain;
}

- (instancetype)of_initWithGnuTLSCertificate: (gnutls_x509_crt_t)certificate
{
	self = [super init];

	_certificate = certificate;

	return self;
}

- (void)dealloc
{
	gnutls_x509_crt_deinit(_certificate);

	[super dealloc];
}
@end

Added src/tls/OFGnuTLSX509CertificatePrivateKey.h version [65299b2524]. 













































































>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFX509CertificatePrivateKey.h"

#include <gnutls/x509.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFGnuTLSX509CertificatePrivateKey: OFX509CertificatePrivateKey
{
	gnutls_x509_privkey_t _privateKey;
}

@property (readonly, nonatomic) gnutls_x509_privkey_t of_gnuTLSPrivateKey;

- (instancetype)of_initWithGnuTLSPrivateKey: (gnutls_x509_privkey_t)privateKey;
@end

OF_ASSUME_NONNULL_END

Added src/tls/OFGnuTLSX509CertificatePrivateKey.m version [06ae647eee]. 





















































































































































































>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#include "config.h"

#import "OFGnuTLSX509CertificatePrivateKey.h"
#import "OFData.h"

#import "OFInitializationFailedException.h"
#import "OFInvalidFormatException.h"
#import "OFOutOfRangeException.h"

@implementation OFGnuTLSX509CertificatePrivateKey
@synthesize of_gnuTLSPrivateKey = _privateKey;

+ (void)load
{
	if (OFX509CertificatePrivateKeyImplementation == Nil)
		OFX509CertificatePrivateKeyImplementation = self;
}

+ (instancetype)privateKeyFromIRI: (OFIRI *)IRI
{
	void *pool = objc_autoreleasePoolPush();
	OFData *data = [OFData dataWithContentsOfIRI: IRI];
	gnutls_datum_t datum;
	gnutls_x509_privkey_t key;
	OFGnuTLSX509CertificatePrivateKey *privateKey;

	if (data.count * data.itemSize > UINT_MAX)
		@throw [OFOutOfRangeException exception];

	datum.data = (unsigned char *)data.items;
	datum.size = (unsigned int)(data.count * data.itemSize);

	if (gnutls_x509_privkey_init(&key) != GNUTLS_E_SUCCESS)
		@throw [OFInitializationFailedException
		    exceptionWithClass: self];

	if (gnutls_x509_privkey_import(key, &datum,
	    GNUTLS_X509_FMT_PEM) != GNUTLS_E_SUCCESS) {
		gnutls_x509_privkey_deinit(key);
		@throw [OFInvalidFormatException exception];
	}

	@try {
		privateKey = [[self alloc] of_initWithGnuTLSPrivateKey: key];
	} @catch (id e) {
		gnutls_x509_privkey_deinit(key);
		@throw e;
	}

	objc_autoreleasePoolPop(pool);

	return [privateKey autorelease];
}

- (instancetype)of_initWithGnuTLSPrivateKey: (gnutls_x509_privkey_t)privateKey
{
	self = [super init];

	_privateKey = privateKey;

	return self;
}

- (void)dealloc
{
	gnutls_x509_privkey_deinit(_privateKey);

	[super dealloc];
}
@end

Modified src/tls/OFMbedTLSTLSStream.h from [0cedeb4d4c] to [5e39028c75].

︙︙
19
20
21
22
23
24
25

26
27
28
29
30
31
32


#import "OFTLSStream.h"

#include <mbedtls/ssl.h>

OF_ASSUME_NONNULL_BEGIN


@interface OFMbedTLSTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _initialized, _handshakeDone;
	mbedtls_ssl_config _config;
	mbedtls_ssl_context _SSL;
	mbedtls_x509_crt _CAChain;
	OFString *_host;








>








19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


#import "OFTLSStream.h"

#include <mbedtls/ssl.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFMbedTLSTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _initialized, _handshakeDone;
	mbedtls_ssl_config _config;
	mbedtls_ssl_context _SSL;
	mbedtls_x509_crt _CAChain;
	OFString *_host;
︙︙

Modified src/tls/OFOpenSSLTLSStream.h from [4327ec3147] to [117120b8e9].

︙︙
22
23
24
25
26
27
28

29
30
31
32
33
34
35

#include <openssl/bio.h>
#include <openssl/ssl.h>

OF_ASSUME_NONNULL_BEGIN

#define OFOpenSSLTLSStreamBufferSize 512


@interface OFOpenSSLTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _handshakeDone;
	SSL *_SSL;
	BIO *_readBIO, *_writeBIO;
	OFString *_host;
	char _buffer[OFOpenSSLTLSStreamBufferSize];








>








22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

#include <openssl/bio.h>
#include <openssl/ssl.h>

OF_ASSUME_NONNULL_BEGIN

#define OFOpenSSLTLSStreamBufferSize 512

OF_SUBCLASSING_RESTRICTED
@interface OFOpenSSLTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _handshakeDone;
	SSL *_SSL;
	BIO *_readBIO, *_writeBIO;
	OFString *_host;
	char _buffer[OFOpenSSLTLSStreamBufferSize];
︙︙

Modified src/tls/OFSecureTransportTLSStream.h from [7f7ce4f626] to [ae9bd77e22].

︙︙
19
20
21
22
23
24
25

26
27
28
29
30
31
32


#import "OFTLSStream.h"

#include <Security/SecureTransport.h>

OF_ASSUME_NONNULL_BEGIN


@interface OFSecureTransportTLSStream: OFTLSStream <OFStreamDelegate>
{
	SSLContextRef _context;
	OFString *_host;
}
@end









>








19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


#import "OFTLSStream.h"

#include <Security/SecureTransport.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFSecureTransportTLSStream: OFTLSStream <OFStreamDelegate>
{
	SSLContextRef _context;
	OFString *_host;
}
@end
︙︙