Add SSLConnectionFailedException
This way, when an SSLSocket is passed where an OFTCPSocket is expected, the description will still contain the error and no special code for SSLSocket is necessary.
This commit is contained in:
parent
7c85e21d8f
commit
272a6f4c7f
6 changed files with 241 additions and 14 deletions
|
|
@ -5,7 +5,8 @@ STATIC_LIB = ${OBJOPENSSL_STATIC_LIB}
|
|||
LIB_MAJOR = 0
|
||||
LIB_MINOR = 0
|
||||
|
||||
SRCS = SSLInvalidCertificateException.m \
|
||||
SRCS = SSLConnectionFailedException.m \
|
||||
SSLInvalidCertificateException.m \
|
||||
SSLSocket.m \
|
||||
X509Certificate.m
|
||||
|
||||
|
|
|
|||
54
src/SSLConnectionFailedException.h
Normal file
54
src/SSLConnectionFailedException.h
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
/*
|
||||
* Copyright (c) 2016, Jonathan Schleifer <js@heap.zone>
|
||||
*
|
||||
* https://heap.zone/git/?p=objopenssl.git
|
||||
*
|
||||
* Permission to use, copy, modify, and/or distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice is present in all copies.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
||||
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
||||
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#import <ObjFW/OFConnectionFailedException.h>
|
||||
|
||||
@class SSLSocket;
|
||||
|
||||
@interface SSLConnectionFailedException: OFConnectionFailedException
|
||||
{
|
||||
unsigned long _SSLError;
|
||||
long _verifyResult;
|
||||
}
|
||||
|
||||
@property (readonly) unsigned long SSLError;
|
||||
@property (readonly) long verifyResult;
|
||||
|
||||
+ (instancetype)exceptionWithHost: (OFString*)host
|
||||
port: (uint16_t)port
|
||||
socket: (SSLSocket*)socket
|
||||
SSLError: (unsigned long)SSLError;
|
||||
+ (instancetype)exceptionWithHost: (OFString*)host
|
||||
port: (uint16_t)port
|
||||
socket: (SSLSocket*)socket
|
||||
SSLError: (unsigned long)SSLError
|
||||
verifyResult: (long)verifyResult;
|
||||
- initWithHost: (OFString*)host
|
||||
port: (uint16_t)port
|
||||
socket: (SSLSocket*)socket
|
||||
SSLError: (unsigned long)SSLError;
|
||||
- initWithHost: (OFString*)host
|
||||
port: (uint16_t)port
|
||||
socket: (SSLSocket*)socket
|
||||
SSLError: (unsigned long)SSLError
|
||||
verifyResult: (long)verifyResult;
|
||||
@end
|
||||
124
src/SSLConnectionFailedException.m
Normal file
124
src/SSLConnectionFailedException.m
Normal file
|
|
@ -0,0 +1,124 @@
|
|||
/*
|
||||
* Copyright (c) 2016, Jonathan Schleifer <js@heap.zone>
|
||||
*
|
||||
* https://heap.zone/git/?p=objopenssl.git
|
||||
*
|
||||
* Permission to use, copy, modify, and/or distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice is present in all copies.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
||||
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||||
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||||
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
||||
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
||||
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <inttypes.h>
|
||||
|
||||
#import <ObjFW/OFString.h>
|
||||
|
||||
#import "SSLConnectionFailedException.h"
|
||||
|
||||
#if defined(__clang__)
|
||||
# pragma clang diagnostic push
|
||||
# pragma clang diagnostic ignored "-Wdocumentation"
|
||||
#endif
|
||||
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/x509v3.h>
|
||||
|
||||
#if defined(__clang__)
|
||||
# pragma clang diagnostic pop
|
||||
#endif
|
||||
|
||||
@implementation SSLConnectionFailedException
|
||||
@synthesize SSLError = _SSLError, verifyResult = _verifyResult;
|
||||
|
||||
+ (instancetype)exceptionWithHost: (OFString*)host
|
||||
port: (uint16_t)port
|
||||
socket: (SSLSocket*)socket
|
||||
SSLError: (unsigned long)SSLError
|
||||
{
|
||||
return [[[self alloc] initWithHost: host
|
||||
port: port
|
||||
socket: socket
|
||||
SSLError: SSLError] autorelease];
|
||||
}
|
||||
|
||||
|
||||
+ (instancetype)exceptionWithHost: (OFString*)host
|
||||
port: (uint16_t)port
|
||||
socket: (SSLSocket*)socket
|
||||
SSLError: (unsigned long)SSLError
|
||||
verifyResult: (long)verifyResult
|
||||
{
|
||||
return [[[self alloc] initWithHost: host
|
||||
port: port
|
||||
socket: socket
|
||||
SSLError: SSLError
|
||||
verifyResult: verifyResult] autorelease];
|
||||
}
|
||||
|
||||
- initWithHost: (OFString*)host
|
||||
port: (uint16_t)port
|
||||
socket: (SSLSocket*)socket
|
||||
SSLError: (unsigned long)SSLError
|
||||
{
|
||||
self = [super initWithHost: host
|
||||
port: port
|
||||
socket: socket];
|
||||
|
||||
_SSLError = SSLError;
|
||||
|
||||
return self;
|
||||
}
|
||||
|
||||
- initWithHost: (OFString*)host
|
||||
port: (uint16_t)port
|
||||
socket: (SSLSocket*)socket
|
||||
SSLError: (unsigned long)SSLError
|
||||
verifyResult: (long)verifyResult
|
||||
{
|
||||
self = [super initWithHost: host
|
||||
port: port
|
||||
socket: socket];
|
||||
|
||||
_SSLError = SSLError;
|
||||
_verifyResult = verifyResult;
|
||||
|
||||
return self;
|
||||
}
|
||||
|
||||
- (OFString*)description
|
||||
{
|
||||
if (_SSLError != SSL_ERROR_NONE) {
|
||||
char error[512];
|
||||
|
||||
ERR_error_string_n(_SSLError, error, 512);
|
||||
|
||||
if (_verifyResult != X509_V_OK)
|
||||
return [OFString stringWithFormat:
|
||||
@"A connection to %@ on port %" @PRIu16 @" could "
|
||||
@"not be established in socket of type %@: "
|
||||
@"Verification failed: %s [%s]",
|
||||
_host, _port, [_socket class],
|
||||
X509_verify_cert_error_string(_verifyResult),
|
||||
error];
|
||||
else
|
||||
return [OFString stringWithFormat:
|
||||
@"A connection to %@ on port %" @PRIu16 @" could "
|
||||
@"not be established in socket of type %@: %s",
|
||||
_host, _port, [_socket class], error];
|
||||
}
|
||||
|
||||
return [super description];
|
||||
}
|
||||
@end
|
||||
|
|
@ -34,6 +34,7 @@
|
|||
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/x509v3.h>
|
||||
|
||||
#if defined(__clang__)
|
||||
|
|
@ -46,7 +47,6 @@
|
|||
#import <ObjFW/OFSystemInfo.h>
|
||||
|
||||
#import <ObjFW/OFAcceptFailedException.h>
|
||||
#import <ObjFW/OFConnectionFailedException.h>
|
||||
#import <ObjFW/OFInitializationFailedException.h>
|
||||
#import <ObjFW/OFInvalidArgumentException.h>
|
||||
#import <ObjFW/OFNotOpenException.h>
|
||||
|
|
@ -58,9 +58,11 @@
|
|||
#import <ObjFW/threading.h>
|
||||
|
||||
#import "SSLSocket.h"
|
||||
#import "SSLInvalidCertificateException.h"
|
||||
#import "X509Certificate.h"
|
||||
|
||||
#import "SSLConnectionFailedException.h"
|
||||
#import "SSLInvalidCertificateException.h"
|
||||
|
||||
#ifndef INVALID_SOCKET
|
||||
# define INVALID_SOCKET -1
|
||||
#endif
|
||||
|
|
@ -175,12 +177,16 @@ locking_callback(int mode, int n, const char *file, int line)
|
|||
{
|
||||
of_string_encoding_t encoding;
|
||||
|
||||
if ((_SSL = SSL_new(ctx)) == NULL || !SSL_set_fd(_SSL, _socket)) {
|
||||
if ((_SSL = SSL_new(ctx)) == NULL || SSL_set_fd(_SSL, _socket) != 1) {
|
||||
unsigned long error = ERR_get_error();
|
||||
|
||||
[super close];
|
||||
@throw [OFConnectionFailedException
|
||||
|
||||
@throw [SSLConnectionFailedException
|
||||
exceptionWithHost: host
|
||||
port: port
|
||||
socket: self];
|
||||
socket: self
|
||||
SSLError: error];
|
||||
}
|
||||
|
||||
if (_certificateVerificationEnabled) {
|
||||
|
|
@ -190,11 +196,17 @@ locking_callback(int mode, int n, const char *file, int line)
|
|||
X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
|
||||
|
||||
if (X509_VERIFY_PARAM_set1_host(param,
|
||||
[host UTF8String], [host UTF8StringLength]) == 0)
|
||||
@throw [OFConnectionFailedException
|
||||
[host UTF8String], [host UTF8StringLength]) != 1) {
|
||||
unsigned long error = ERR_get_error();
|
||||
|
||||
[self close];
|
||||
|
||||
@throw [SSLConnectionFailedException
|
||||
exceptionWithHost: host
|
||||
port: port
|
||||
socket: self];
|
||||
socket: self
|
||||
SSLError: error];
|
||||
}
|
||||
|
||||
SSL_set_verify(_SSL, SSL_VERIFY_PEER, NULL);
|
||||
}
|
||||
|
|
@ -208,12 +220,37 @@ locking_callback(int mode, int n, const char *file, int line)
|
|||
SSL_FILETYPE_PEM)) || (_certificateFile != nil &&
|
||||
!SSL_use_certificate_file(_SSL, [_certificateFile
|
||||
cStringWithEncoding: encoding],
|
||||
SSL_FILETYPE_PEM)) || SSL_connect(_SSL) != 1) {
|
||||
SSL_FILETYPE_PEM))) {
|
||||
unsigned long error = ERR_get_error();
|
||||
|
||||
[super close];
|
||||
@throw [OFConnectionFailedException
|
||||
|
||||
@throw [SSLConnectionFailedException
|
||||
exceptionWithHost: host
|
||||
port: port
|
||||
socket: self];
|
||||
socket: self
|
||||
SSLError: error];
|
||||
}
|
||||
|
||||
if (SSL_connect(_SSL) != 1) {
|
||||
unsigned long error = ERR_get_error();
|
||||
long res;
|
||||
|
||||
[super close];
|
||||
|
||||
if ((res = SSL_get_verify_result(_SSL)) != X509_V_OK)
|
||||
@throw [SSLConnectionFailedException
|
||||
exceptionWithHost: host
|
||||
port: port
|
||||
socket: self
|
||||
SSLError: error
|
||||
verifyResult: res];
|
||||
else
|
||||
@throw [SSLConnectionFailedException
|
||||
exceptionWithHost: host
|
||||
port: port
|
||||
socket: self
|
||||
SSLError: error];
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
Reference in a new issue