ObjFW  Check-in [2cb48ceaf1]

Overview
Comment:OFGnuTLSTLSStream: Add server support
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | tls-server
Files: files | file ages | folders
SHA3-256: 2cb48ceaf1d0c54a929080b17bcf0f994335809830ae6d0cbd8ae81dc9f2644b
User & Date: js on 2024-11-18 00:38:04
Other Links: branch diff | manifest | tags
Context
2024-11-18
00:47
Make GCC happy again Leaf check-in: f6cc2092af user: js tags: tls-server
00:38
OFGnuTLSTLSStream: Add server support check-in: 2cb48ceaf1 user: js tags: tls-server
2024-11-16
22:36
OFTLSStream: Add API for server mode check-in: 43864736e7 user: js tags: tls-server
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Modified src/Makefile from [486aeb0a5d] to [6a4c7a76fd].

︙
149
150
151
152
153
154
155

156
157
158
159
160
161
162

149
150
151
152
153
154
155
156
157
158
159
160
161
162
163








+








	       OFSystemInfo+NetworkInterfaces.m	\
	       OFTCPSocket.m			\
	       OFTLSStream.m			\
	       OFTXTDNSResourceRecord.m		\
	       OFUDPSocket.m			\
	       OFURIDNSResourceRecord.m		\
	       OFX509Certificate.m		\
	       OFX509CertificatePrivateKey.m	\
	       ${USE_SRCS_APPLETALK}		\
	       ${USE_SRCS_IPX}			\
	       ${USE_SRCS_SCTP}			\
	       ${USE_SRCS_UNIX_SOCKETS}
SRCS_APPLETALK = OFDDPSocket.m
SRCS_IPX = OFIPXSocket.m	\
	   OFSPXSocket.m	\
︙

Modified src/OFTLSStream.h from [1a6c8de484] to [73461e1dca].

︙
15
16
17
18
19
20
21


22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

31
32
33
34
35
36
37








+
+







-








 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFStream.h"
#import "OFRunLoop.h"
#import "OFX509Certificate.h"
#import "OFX509CertificatePrivateKey.h"

OF_ASSUME_NONNULL_BEGIN

/** @file */

@class OFArray OF_GENERIC(ObjectType);
@class OFTLSStream;
@class OFX509Certificate;

/**
 * @brief An enum representing an error of an OFTLSStream.
 */
typedef enum {
	/** @brief An unknown error. */
	OFTLSStreamErrorCodeUnknown,
︙
98
99
100
101
102
103
104

105
106



107
108
109
110
111
112
113

99
100
101
102
103
104
105
106


107
108
109
110
111
112
113
114
115
116








+
-
-
+
+
+








 */
@interface OFTLSStream: OFStream <OFReadyForReadingObserving,
    OFReadyForWritingObserving>
{
	OFStream <OFReadyForReadingObserving, OFReadyForWritingObserving>
	    *_underlyingStream;
	bool _verifiesCertificates;
	OFArray OF_GENERIC(OF_KINDOF(OFX509Certificate *)) *_Nullable
	OFArray OF_GENERIC(OFX509Certificate *) *_Nullable _certificateChain;
	OF_RESERVE_IVARS(OFTLSStream, 3)
	    _certificateChain;
	OF_KINDOF(OFX509CertificatePrivateKey *) _Nullable _privateKey;
	OF_RESERVE_IVARS(OFTLSStream, 2)
}

/**
 * @brief The underlying stream.
 */
@property (readonly, nonatomic) OFStream <OFReadyForReadingObserving,
    OFReadyForWritingObserving> *underlyingStream;
︙
128
129
130
131
132
133
134






135
136
137
138
139
140
141

131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150








+
+
+
+
+
+









/**
 * @brief The certificate chain to use.
 */
@property OF_NULLABLE_PROPERTY (copy, nonatomic)
    OFArray OF_GENERIC(OFX509Certificate *) *certificateChain;

/**
 * @brief The private key to use.
 */
@property OF_NULLABLE_PROPERTY (retain, nonatomic)
    OFX509CertificatePrivateKey *privateKey;

- (instancetype)init OF_UNAVAILABLE;

/**
 * @brief Creates a new TLS stream with the specified stream as its underlying
 *	  stream.
 *
 * @param stream The stream to use as underlying stream. Must not be closed
︙
223
224
225
226
227
228
229
230
231


232
233
234
235
236
237
238

232
233
234
235
236
237
238


239
240
241
242
243
244
245
246
247








-
-
+
+








#ifdef __cplusplus
extern "C" {
#endif
/**
 * @brief The implementation for OFTLSStream to use.
 *
 * This can be set to a class that is always used for OFTLSStream. This is
 * useful to either force a specific implementation or use one that ObjFW does
 * not know about.
 * useful to either force a specific implementation or to use one that ObjFW
 * does not know about.
 */
extern Class OFTLSStreamImplementation;

/**
 * @brief Returns a string description for the TLS stream error code.
 *
 * @param errorCode The error code to return the description for
︙

Modified src/OFTLSStream.m from [3b181aebf6] to [0875600981].

︙
93
94
95
96
97
98
99

100
101
102
103
104
105
106

93
94
95
96
97
98
99
100
101
102
103
104
105
106
107








+








}
@end

@implementation OFTLSStream
@synthesize underlyingStream = _underlyingStream;
@dynamic delegate;
@synthesize verifiesCertificates = _verifiesCertificates;
@synthesize privateKey = _privateKey;

+ (instancetype)alloc
{
	if (self == [OFTLSStream class]) {
		if (OFTLSStreamImplementation != Nil)
			return [OFTLSStreamImplementation alloc];
︙

Modified src/OFX509Certificate.h from [bbdec4f618] to [6f5ea71b48].

︙
17
18
19
20
21
22
23



24
25
26
27
28
29
30
31
32













33















34
35

17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66








+
+
+









+
+
+
+
+
+
+
+
+
+
+
+
+

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+



 * <https://www.gnu.org/licenses/>.
 */

#import "OFObject.h"

OF_ASSUME_NONNULL_BEGIN

@class OFArray OF_GENERIC(ObjectType);
@class OFIRI;

/**
 * @class OFX509Certificate OFX509Certificate.h ObjFW/ObjFW.h
 *
 * @brief An X.509 certificate.
 */
@interface OFX509Certificate: OFObject
{
	OF_RESERVE_IVARS(OFX509Certificate, 4)
}

/**
 * @brief Returns a certificate chain from the specified IRI.
 *
 * @param IRI The IRI to retrieve the certificate chain from
 *
 * @throw OFOpenItemFailedException Opening the item failed
 * @throw OFUnsupportedProtocolException The specified IRI is not supported
 * @throw OFReadFailedException Reading the item failed
 * @throw OFInvalidFormatException The format of the item is invalid
 */
+ (OFArray OF_GENERIC(OFX509Certificate *) *)
    certificateChainFromIRI: (OFIRI *)IRI;
@end

#ifdef __cplusplus
extern "C" {
#endif
/**
 * @brief The implementation for OFX509Certificate to use.
 *
 * This can be set to a class that is always used for OFX509Certificate. This
 * is useful to either force a specific implementation or to use one that ObjFW
 * does not know about.
 */
extern Class OFX509CertificateImplementation;
#ifdef __cplusplus
}
#endif

OF_ASSUME_NONNULL_END

Modified src/OFX509Certificate.m from [bef6dd357c] to [020fab5772].

︙
34
35
36
37
38
39
40










41

34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51








+
+
+
+
+
+
+
+
+
+



		@throw [OFNotImplementedException exceptionWithSelector: _cmd
								 object: self];
	}

	return [super alloc];
}

+ (OFArray OF_GENERIC(OFX509Certificate *) *)
    certificateChainFromIRI: (OFIRI *)IRI
{
	if (OFX509CertificateImplementation != Nil)
		return [OFX509CertificateImplementation
		    certificateChainFromIRI: IRI];

	OF_UNRECOGNIZED_SELECTOR
}
@end

Added src/OFX509CertificatePrivateKey.h version [c6b920cf5c]. 




































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFObject.h"

OF_ASSUME_NONNULL_BEGIN

@class OFIRI;

/**
 * @class OFX509CertificatePrivateKey \
 *	  OFX509CertificatePrivateKey.h ObjFW/ObjFW.h
 *
 * @brief The private key for an X.509 certificate.
 */
@interface OFX509CertificatePrivateKey: OFObject
{
	OF_RESERVE_IVARS(OFX509Certificate, 4)
}

/**
 * @brief Returns a private key from the specified IRI.
 *
 * @param IRI The IRI to retrieve the private key from
 *
 * @throw OFInitializationFailedException Initializing the private key failed
 * @throw OFOpenItemFailedException Opening the item failed
 * @throw OFUnsupportedProtocolException The specified IRI is not supported
 * @throw OFReadFailedException Reading the item failed
 * @throw OFInvalidFormatException The format of the item is invalid
 */
+ (instancetype)privateKeyFromIRI: (OFIRI *)IRI;
@end

#ifdef __cplusplus
extern "C" {
#endif
/**
 * @brief The implementation for OFX509CertificatePrivateKey to use.
 *
 * This can be set to a class that is always used for
 * OFX509CertificatePrivateKey. This is useful to either force a specific
 * implementation or to use one that ObjFW does not know about.
 */
extern Class OFX509CertificatePrivateKeyImplementation;
#ifdef __cplusplus
}
#endif

OF_ASSUME_NONNULL_END








Added src/OFX509CertificatePrivateKey.m version [89a24cbac0].























































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#include "config.h"

#import "OFX509CertificatePrivateKey.h"

#import "OFNotImplementedException.h"

Class OFX509CertificatePrivateKeyImplementation = Nil;

@implementation OFX509CertificatePrivateKey
+ (instancetype)alloc
{
	if (self == [OFX509CertificatePrivateKey class]) {
		if (OFX509CertificatePrivateKeyImplementation != Nil)
			return
			    [OFX509CertificatePrivateKeyImplementation alloc];

		@throw [OFNotImplementedException exceptionWithSelector: _cmd
								 object: self];
	}

	return [super alloc];
}

+ (instancetype)privateKeyFromIRI: (OFIRI *)IRI
{
	if (OFX509CertificatePrivateKeyImplementation != Nil)
		return [OFX509CertificatePrivateKeyImplementation
		    privateKeyFromIRI: IRI];

	OF_UNRECOGNIZED_SELECTOR
}
@end








Modified src/ObjFW.h
from [700d623d15]
to [e5760f4c54].




︙


82
83
84
85
86
87
88


89
90
91
92
93
94
95

82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97








+
+








#ifdef OF_HAVE_SOCKETS
# import "OFStreamSocket.h"
# import "OFDatagramSocket.h"
# import "OFSequencedPacketSocket.h"
# import "OFTCPSocket.h"
# import "OFUDPSocket.h"
# import "OFTLSStream.h"
# import "OFX509Certificate.h"
# import "OFX509CertificatePrivateKey.h"
# import "OFKernelEventObserver.h"
# import "OFDNSQuery.h"
# import "OFDNSResourceRecord.h"
# import "OFDNSResponse.h"
# import "OFDNSResolver.h"
# ifdef OF_HAVE_SCTP
#  import "OFSCTPSocket.h"




︙







Modified src/tls/Makefile
from [24a2c6b174]
to [6ba02952f9].




︙


11
12
13
14
15
16
17
18



19
20
21
22
23
24
25

11
12
13
14
15
16
17

18
19
20
21
22
23
24
25
26
27








-
+
+
+









INCLUDES := ObjFWTLS.h
SRCS = ${USE_SRCS_GNUTLS}		\
       ${USE_SRCS_MBEDTLS}		\
       ${USE_SRCS_OPENSSL}		\
       ${USE_SRCS_SECURETRANSPORT}

SRCS_GNUTLS = OFGnuTLSTLSStream.m
SRCS_GNUTLS = OFGnuTLSTLSStream.m			\
	      OFGnuTLSX509Certificate.m			\
	      OFGnuTLSX509CertificatePrivateKey.m
SRCS_MBEDTLS = OFMbedTLSTLSStream.m
SRCS_OPENSSL = OFOpenSSLTLSStream.m
SRCS_SECURETRANSPORT = OFSecureTransportTLSStream.m

includesubdir = ObjFWTLS

include ../../buildsys.mk




︙







Modified src/tls/OFGnuTLSTLSStream.h
from [ad70118309]
to [319a08ef71].




︙


19
20
21
22
23
24
25

26
27
28

29

30
31
32
33
34

19
20
21
22
23
24
25
26
27
28

29
30
31
32
33
34
35
36








+


-
+

+







#import "OFTLSStream.h"

#include <gnutls/gnutls.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFGnuTLSTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _initialized, _handshakeDone;
	bool _server, _handshakeDone;
	gnutls_session_t _session;
	gnutls_certificate_credentials_t _credentials;
	OFString *_host;
}
@end

OF_ASSUME_NONNULL_END








Modified src/tls/OFGnuTLSTLSStream.m
from [84d62d35d3]
to [2feefe95de].




︙


18
19
20
21
22
23
24

25


26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

38
39
40
41
42
43
44








+

+
+









-








 */

#include "config.h"

#include <errno.h>

#import "OFGnuTLSTLSStream.h"
#import "OFArray.h"
#import "OFData.h"
#import "OFGnuTLSX509Certificate.h"
#import "OFGnuTLSX509CertificatePrivateKey.h"

#import "OFAlreadyOpenException.h"
#import "OFInitializationFailedException.h"
#import "OFNotOpenException.h"
#import "OFReadFailedException.h"
#import "OFTLSHandshakeFailedException.h"
#import "OFWriteFailedException.h"

int _ObjFWTLS_reference;
static gnutls_certificate_credentials_t systemTrustCreds;

#ifndef GNUTLS_SAFE_PADDING_CHECK
/* Some older versions don't have it. */
# define GNUTLS_SAFE_PADDING_CHECK 0
#endif

static OFTLSStreamErrorCode




︙


97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133

134
135
136
137
138
139
140
141
142
143
144
145
146
147

148
149








150
151
152
153
154
155
156

99
100
101
102
103
104
105











106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122


123
124
125
126
127
128
129
130
131



132
133
134
135


136
137
138
139
140
141
142
143
144
145
146
147
148
149
150








-
-
-
-
-
-
-
-
-
-
-

















-
-
+








-
-
-



+
-
-
+
+
+
+
+
+
+
+









+ (void)load
{
	if (OFTLSStreamImplementation == Nil)
		OFTLSStreamImplementation = self;
}

+ (void)initialize
{
	if (self != [OFGnuTLSTLSStream class])
		return;

	if (gnutls_certificate_allocate_credentials(&systemTrustCreds) !=
	    GNUTLS_E_SUCCESS ||
	    gnutls_certificate_set_x509_system_trust(systemTrustCreds) < 0)
		@throw [OFInitializationFailedException exception];
}

- (instancetype)initWithStream: (OFStream <OFReadyForReadingObserving,
				     OFReadyForWritingObserving> *)stream
{
	self = [super initWithStream: stream];

	@try {
		_underlyingStream.delegate = self;
	} @catch (id e) {
		[self release];
		@throw e;
	}

	return self;
}

- (void)dealloc
{
	if (_initialized)
		[self close];
	[self close];

	[_host release];

	[super dealloc];
}

- (void)close
{
	if (!_initialized)
		@throw [OFNotOpenException exceptionWithObject: self];

	if (_handshakeDone)
		gnutls_bye(_session, GNUTLS_SHUT_WR);

	if (_session != NULL)
	gnutls_deinit(_session);
	_initialized = _handshakeDone = false;
		gnutls_deinit(_session);

	if (_credentials != NULL)
		gnutls_certificate_free_credentials(_credentials);

	_session = NULL;
	_credentials = NULL;
	_handshakeDone = false;

	[_host release];
	_host = nil;

	[super close];
}





︙


206
207
208
209
210
211
212
213
214



215
216
217
218
219
220
221
222

223
224
225
226


227
228
229
230
231
232
233
234
235
236
237
238
239
240



241
242
243
244
245
246

247

248
249


































250
251
252
253
254
255
256
257
258
259
260
261
262
263
264

200
201
202
203
204
205
206


207
208
209
210
211
212
213
214
215
216

217
218
219


220
221
222
223
224
225
226


227
228
229
230
231


232
233
234
235
236
237
238
239
240
241
242
243


244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282



283
284
285
286
287
288
289








-
-
+
+
+







-
+


-
-
+
+





-
-





-
-
+
+
+






+

+
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+





-
-
-









- (bool)lowlevelHasDataInReadBuffer
{
	return (_underlyingStream.hasDataInReadBuffer ||
	    gnutls_record_check_pending(_session) > 0);
}

- (void)asyncPerformClientHandshakeWithHost: (OFString *)host
				runLoopMode: (OFRunLoopMode)runLoopMode
- (void)of_asyncPerformHandshakeWithHost: (OFString *)host
				  server: (bool)server
			     runLoopMode: (OFRunLoopMode)runLoopMode
{
	static const OFTLSStreamErrorCode initFailedErrorCode =
	    OFTLSStreamErrorCodeInitializationFailed;
	void *pool = objc_autoreleasePoolPush();
	id exception = nil;
	int status;

	if (_initialized)
	if (_handshakeDone)
		@throw [OFAlreadyOpenException exceptionWithObject: self];

	if (gnutls_init(&_session, GNUTLS_CLIENT | GNUTLS_NONBLOCK |
	    GNUTLS_SAFE_PADDING_CHECK) != GNUTLS_E_SUCCESS)
	if (gnutls_init(&_session, (server ? GNUTLS_SERVER : GNUTLS_CLIENT) |
	    GNUTLS_NONBLOCK | GNUTLS_SAFE_PADDING_CHECK) != GNUTLS_E_SUCCESS)
		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];

	_initialized = true;

	gnutls_transport_set_ptr(_session, self);
	gnutls_transport_set_pull_function(_session, readFunc);
	gnutls_transport_set_push_function(_session, writeFunc);

	if (gnutls_set_default_priority(_session) != GNUTLS_E_SUCCESS ||
	    gnutls_credentials_set(_session, GNUTLS_CRD_CERTIFICATE,
	    systemTrustCreds) != GNUTLS_E_SUCCESS)
	    gnutls_certificate_allocate_credentials(&_credentials) !=
	    GNUTLS_E_SUCCESS ||
	    gnutls_certificate_set_x509_system_trust(_credentials) < 0)
		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];

	_host = [host copy];
	_server = server;

	if (!server) {
	if (gnutls_server_name_set(_session, GNUTLS_NAME_DNS,
	    _host.UTF8String, _host.UTF8StringLength) != GNUTLS_E_SUCCESS)
		if (gnutls_server_name_set(_session, GNUTLS_NAME_DNS,
		    _host.UTF8String, _host.UTF8StringLength) !=
		    GNUTLS_E_SUCCESS)
			@throw [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: host
				      errorCode: initFailedErrorCode];

		if (_verifiesCertificates)
			gnutls_session_set_verify_cert(_session, _host.UTF8String, 0);
	}

	if (_certificateChain != nil) {
		OFMutableData *certs = [OFMutableData
		    dataWithItemSize: sizeof(gnutls_x509_crt_t)
			    capacity: _certificateChain.count];

		for (OFGnuTLSX509Certificate *cert in _certificateChain) {
			gnutls_x509_crt_t gnuTLSCert =
			    cert.of_gnuTLSCertificate;
			[certs addItem: &gnuTLSCert];
		}

		if (gnutls_certificate_set_x509_key(_credentials,
		    (gnutls_x509_crt_t *)certs.items, (unsigned int)certs.count,
		    [_privateKey of_gnuTLSPrivateKey]) < 0)
			@throw [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: host
				      errorCode: initFailedErrorCode];
	}

	if (gnutls_credentials_set(_session, GNUTLS_CRD_CERTIFICATE,
	    _credentials) != GNUTLS_E_SUCCESS)
		@throw [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: initFailedErrorCode];

	if (_verifiesCertificates)
		gnutls_session_set_verify_cert(_session, _host.UTF8String, 0);

	status = gnutls_handshake(_session);

	if (status == GNUTLS_E_INTERRUPTED || status == GNUTLS_E_AGAIN) {
		if (gnutls_record_get_direction(_session) == 1)
			[_underlyingStream asyncWriteData: [OFData data]
					      runLoopMode: runLoopMode];
		else




︙


283
284
285
286
287
288
289

290
291
292
293
294
295












296
297















298
299
300
301
302
303
304

308
309
310
311
312
313
314
315






316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351








+
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+


+
+
+
+
+
+
+
+
+
+
+
+
+
+
+








		/* FIXME: Map to better errors */
		exception = [OFTLSHandshakeFailedException
		    exceptionWithStream: self
				   host: host
			      errorCode: errorCode];
	}

	if (server) {
	if ([_delegate respondsToSelector:
	    @selector(stream:didPerformClientHandshakeWithHost:exception:)])
		[_delegate		       stream: self
		    didPerformClientHandshakeWithHost: host
					    exception: exception];

		if ([_delegate respondsToSelector: @selector(
		    streamDidPerformServerHandshake:exception:)])
			[_delegate streamDidPerformServerHandshake: self
							 exception: exception];
	} else {
		if ([_delegate respondsToSelector: @selector(stream:
		    didPerformClientHandshakeWithHost:exception:)])
			[_delegate		       stream: self
			    didPerformClientHandshakeWithHost: host
						    exception: exception];
	}

	objc_autoreleasePoolPop(pool);
}

- (void)asyncPerformClientHandshakeWithHost: (OFString *)host
				runLoopMode: (OFRunLoopMode)runLoopMode
{
	[self of_asyncPerformHandshakeWithHost: host
					server: false
				   runLoopMode: runLoopMode];
}

- (void)asyncPerformServerHandshakeWithRunLoopMode: (OFRunLoopMode)runLoopMode
{
	[self of_asyncPerformHandshakeWithHost: nil
					server: true
				   runLoopMode: runLoopMode];
}

-      (bool)stream: (OFStream *)stream
  didReadIntoBuffer: (void *)buffer
	     length: (size_t)length
	  exception: (id)exception
{
	if (exception == nil) {




︙


321
322
323
324
325
326
327

328
329
330
331
332











333
334
335
336
337
338
339

368
369
370
371
372
373
374
375





376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393








+
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+








		else
			exception = [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: _host
				      errorCode: OFTLSStreamErrorCodeUnknown];
	}

	if (_server) {
	if ([_delegate respondsToSelector:
	    @selector(stream:didPerformClientHandshakeWithHost:exception:)])
		[_delegate		       stream: self
		    didPerformClientHandshakeWithHost: _host
					    exception: exception];
		if ([_delegate respondsToSelector: @selector(
		    streamDidPerformServerHandshake:exception:)])
			[_delegate streamDidPerformServerHandshake: self
							 exception: exception];
	} else {
		if ([_delegate respondsToSelector: @selector(stream:
		    didPerformClientHandshakeWithHost:exception:)])
			[_delegate		       stream: self
			    didPerformClientHandshakeWithHost: _host
						    exception: exception];
	}

	[_delegate release];

	return false;
}

- (OFData *)stream: (OFStream *)stream




︙


364
365
366
367
368
369
370

371
372
373
374
375











376
377
378
379
380
381

418
419
420
421
422
423
424
425





426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442








+
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+







		else
			exception = [OFTLSHandshakeFailedException
			    exceptionWithStream: self
					   host: _host
				      errorCode: OFTLSStreamErrorCodeUnknown];
	}

	if (_server) {
	if ([_delegate respondsToSelector:
	    @selector(stream:didPerformClientHandshakeWithHost:exception:)])
		[_delegate		       stream: self
		    didPerformClientHandshakeWithHost: _host
					    exception: exception];
		if ([_delegate respondsToSelector: @selector(
		    streamDidPerformServerHandshake:exception:)])
			[_delegate streamDidPerformServerHandshake: self
							 exception: exception];
	} else {
		if ([_delegate respondsToSelector: @selector(stream:
		    didPerformClientHandshakeWithHost:exception:)])
			[_delegate		       stream: self
			    didPerformClientHandshakeWithHost: _host
						    exception: exception];
	}

	[_delegate release];

	return nil;
}
@end








Added src/tls/OFGnuTLSX509Certificate.h version [2e16455f00].









































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFX509Certificate.h"

#include <gnutls/x509.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFGnuTLSX509Certificate: OFX509Certificate
{
	gnutls_x509_crt_t _certificate;
}

@property (readonly, nonatomic) gnutls_x509_crt_t of_gnuTLSCertificate;

- (instancetype)of_initWithGnuTLSCertificate: (gnutls_x509_crt_t)certificate;
@end

OF_ASSUME_NONNULL_END








Added src/tls/OFGnuTLSX509Certificate.m version [f1631a4c53].










































































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#include "config.h"

#import "OFGnuTLSX509Certificate.h"
#import "OFArray.h"
#import "OFData.h"

#import "OFInvalidFormatException.h"
#import "OFOutOfRangeException.h"

@implementation OFGnuTLSX509Certificate
@synthesize of_gnuTLSCertificate = _certificate;

+ (void)load
{
	if (OFX509CertificateImplementation == Nil)
		OFX509CertificateImplementation = self;
}

+ (OFArray OF_GENERIC(OFX509Certificate *) *)
    certificateChainFromIRI: (OFIRI *)IRI
{
	OFMutableArray *chain = [OFMutableArray array];
	void *pool = objc_autoreleasePoolPush();
	OFData *data = [OFData dataWithContentsOfIRI: IRI];
	gnutls_datum_t datum;
	gnutls_x509_crt_t *certs;
	unsigned int i, size;

	if (data.count * data.itemSize > UINT_MAX)
		@throw [OFOutOfRangeException exception];

	datum.data = (unsigned char *)data.items;
	datum.size = (unsigned int)(data.count * data.itemSize);

	if (gnutls_x509_crt_list_import2(&certs, &size, &datum,
	    GNUTLS_X509_FMT_PEM, 0) != GNUTLS_E_SUCCESS)
		@throw [OFInvalidFormatException exception];

	for (i = 0; i < size; i++) {
		OFGnuTLSX509Certificate *certificate;

		@try {
			certificate = [[self alloc]
			    of_initWithGnuTLSCertificate: certs[i]];
		} @catch (id e) {
			gnutls_x509_crt_deinit(certs[i]);
			gnutls_free(certs);
			@throw e;
		}

		@try {
			[chain addObject: certificate];
		} @catch (id e) {
			gnutls_free(certs);
			@throw e;
		} @finally {
			[certificate release];
		}
	}

	gnutls_free(certs);

	objc_autoreleasePoolPop(pool);

	return chain;
}

- (instancetype)of_initWithGnuTLSCertificate: (gnutls_x509_crt_t)certificate
{
	self = [super init];

	_certificate = certificate;

	return self;
}

- (void)dealloc
{
	gnutls_x509_crt_deinit(_certificate);

	[super dealloc];
}
@end








Added src/tls/OFGnuTLSX509CertificatePrivateKey.h version [65299b2524].









































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#import "OFX509CertificatePrivateKey.h"

#include <gnutls/x509.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFGnuTLSX509CertificatePrivateKey: OFX509CertificatePrivateKey
{
	gnutls_x509_privkey_t _privateKey;
}

@property (readonly, nonatomic) gnutls_x509_privkey_t of_gnuTLSPrivateKey;

- (instancetype)of_initWithGnuTLSPrivateKey: (gnutls_x509_privkey_t)privateKey;
@end

OF_ASSUME_NONNULL_END








Added src/tls/OFGnuTLSX509CertificatePrivateKey.m version [06ae647eee].





























































































1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

/*
 * Copyright (c) 2008-2024 Jonathan Schleifer <js@nil.im>
 *
 * All rights reserved.
 *
 * This program is free software: you can redistribute it and/or modify it
 * under the terms of the GNU Lesser General Public License version 3.0 only,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
 * version 3.0 for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * version 3.0 along with this program. If not, see
 * <https://www.gnu.org/licenses/>.
 */

#include "config.h"

#import "OFGnuTLSX509CertificatePrivateKey.h"
#import "OFData.h"

#import "OFInitializationFailedException.h"
#import "OFInvalidFormatException.h"
#import "OFOutOfRangeException.h"

@implementation OFGnuTLSX509CertificatePrivateKey
@synthesize of_gnuTLSPrivateKey = _privateKey;

+ (void)load
{
	if (OFX509CertificatePrivateKeyImplementation == Nil)
		OFX509CertificatePrivateKeyImplementation = self;
}

+ (instancetype)privateKeyFromIRI: (OFIRI *)IRI
{
	void *pool = objc_autoreleasePoolPush();
	OFData *data = [OFData dataWithContentsOfIRI: IRI];
	gnutls_datum_t datum;
	gnutls_x509_privkey_t key;
	OFGnuTLSX509CertificatePrivateKey *privateKey;

	if (data.count * data.itemSize > UINT_MAX)
		@throw [OFOutOfRangeException exception];

	datum.data = (unsigned char *)data.items;
	datum.size = (unsigned int)(data.count * data.itemSize);

	if (gnutls_x509_privkey_init(&key) != GNUTLS_E_SUCCESS)
		@throw [OFInitializationFailedException
		    exceptionWithClass: self];

	if (gnutls_x509_privkey_import(key, &datum,
	    GNUTLS_X509_FMT_PEM) != GNUTLS_E_SUCCESS) {
		gnutls_x509_privkey_deinit(key);
		@throw [OFInvalidFormatException exception];
	}

	@try {
		privateKey = [[self alloc] of_initWithGnuTLSPrivateKey: key];
	} @catch (id e) {
		gnutls_x509_privkey_deinit(key);
		@throw e;
	}

	objc_autoreleasePoolPop(pool);

	return [privateKey autorelease];
}

- (instancetype)of_initWithGnuTLSPrivateKey: (gnutls_x509_privkey_t)privateKey
{
	self = [super init];

	_privateKey = privateKey;

	return self;
}

- (void)dealloc
{
	gnutls_x509_privkey_deinit(_privateKey);

	[super dealloc];
}
@end








Modified src/tls/OFMbedTLSTLSStream.h
from [0cedeb4d4c]
to [5e39028c75].




︙


19
20
21
22
23
24
25

26
27
28
29
30
31
32

19
20
21
22
23
24
25
26
27
28
29
30
31
32
33








+









#import "OFTLSStream.h"

#include <mbedtls/ssl.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFMbedTLSTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _initialized, _handshakeDone;
	mbedtls_ssl_config _config;
	mbedtls_ssl_context _SSL;
	mbedtls_x509_crt _CAChain;
	OFString *_host;




︙







Modified src/tls/OFOpenSSLTLSStream.h
from [4327ec3147]
to [117120b8e9].




︙


22
23
24
25
26
27
28

29
30
31
32
33
34
35

22
23
24
25
26
27
28
29
30
31
32
33
34
35
36








+








#include <openssl/bio.h>
#include <openssl/ssl.h>

OF_ASSUME_NONNULL_BEGIN

#define OFOpenSSLTLSStreamBufferSize 512

OF_SUBCLASSING_RESTRICTED
@interface OFOpenSSLTLSStream: OFTLSStream <OFStreamDelegate>
{
	bool _handshakeDone;
	SSL *_SSL;
	BIO *_readBIO, *_writeBIO;
	OFString *_host;
	char _buffer[OFOpenSSLTLSStreamBufferSize];




︙







Modified src/tls/OFSecureTransportTLSStream.h
from [7f7ce4f626]
to [ae9bd77e22].




︙


19
20
21
22
23
24
25

26
27
28
29
30
31
32

19
20
21
22
23
24
25
26
27
28
29
30
31
32
33








+









#import "OFTLSStream.h"

#include <Security/SecureTransport.h>

OF_ASSUME_NONNULL_BEGIN

OF_SUBCLASSING_RESTRICTED
@interface OFSecureTransportTLSStream: OFTLSStream <OFStreamDelegate>
{
	SSLContextRef _context;
	OFString *_host;
}
@end





︙