1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
|
#include <vector>
#include <openssl/err.h>
#include <openssl/pkcs12.h>
#include "Swiften/TLS/OpenSSL/OpenSSLContext.h"
#include "Swiften/TLS/PKCS12Certificate.h"
#pragma GCC diagnostic ignored "-Wold-style-cast"
namespace Swift {
static const int SSL_READ_BUFFERSIZE = 8192;
void freeX509Stack(STACK_OF(X509)* stack) {
sk_X509_free(stack);
}
OpenSSLContext::OpenSSLContext() : state_(Start), context_(0), handle_(0), readBIO_(0), writeBIO_(0) {
ensureLibraryInitialized();
context_ = SSL_CTX_new(TLSv1_client_method());
}
OpenSSLContext::~OpenSSLContext() {
SSL_free(handle_);
SSL_CTX_free(context_);
}
void OpenSSLContext::ensureLibraryInitialized() {
static bool isLibraryInitialized = false;
if (!isLibraryInitialized) {
SSL_load_error_strings();
SSL_library_init();
OpenSSL_add_all_algorithms();
isLibraryInitialized = true;
}
}
void OpenSSLContext::connect() {
handle_ = SSL_new(context_);
// Ownership of BIOs is ransferred
readBIO_ = BIO_new(BIO_s_mem());
writeBIO_ = BIO_new(BIO_s_mem());
SSL_set_bio(handle_, readBIO_, writeBIO_);
state_ = Connecting;
doConnect();
}
void OpenSSLContext::doConnect() {
int connectResult = SSL_connect(handle_);
int error = SSL_get_error(handle_, connectResult);
switch (error) {
case SSL_ERROR_NONE:
state_ = Connected;
onConnected();
//X509* x = SSL_get_peer_certificate(handle_);
//std::cout << x->name << std::endl;
//const char* comp = SSL_get_current_compression(handle_);
//std::cout << "Compression: " << SSL_COMP_get_name(comp) << std::endl;
break;
case SSL_ERROR_WANT_READ:
sendPendingDataToNetwork();
break;
default:
state_ = Error;
onError();
}
}
void OpenSSLContext::sendPendingDataToNetwork() {
int size = BIO_pending(writeBIO_);
if (size > 0) {
ByteArray data;
data.resize(size);
BIO_read(writeBIO_, data.getData(), size);
onDataForNetwork(data);
}
}
void OpenSSLContext::handleDataFromNetwork(const ByteArray& data) {
BIO_write(readBIO_, data.getData(), data.getSize());
switch (state_) {
case Connecting:
doConnect();
break;
case Connected:
sendPendingDataToApplication();
break;
case Start: assert(false); break;
case Error: assert(false); break;
}
}
void OpenSSLContext::handleDataFromApplication(const ByteArray& data) {
if (SSL_write(handle_, data.getData(), data.getSize()) >= 0) {
sendPendingDataToNetwork();
}
else {
state_ = Error;
onError();
}
}
void OpenSSLContext::sendPendingDataToApplication() {
ByteArray data;
data.resize(SSL_READ_BUFFERSIZE);
int ret = SSL_read(handle_, data.getData(), data.getSize());
while (ret > 0) {
data.resize(ret);
onDataForApplication(data);
data.resize(SSL_READ_BUFFERSIZE);
ret = SSL_read(handle_, data.getData(), data.getSize());
}
if (ret < 0 && SSL_get_error(handle_, ret) != SSL_ERROR_WANT_READ) {
state_ = Error;
onError();
}
}
bool OpenSSLContext::setClientCertificate(const PKCS12Certificate& certificate) {
if (certificate.isNull()) {
return false;
}
// Create a PKCS12 structure
BIO* bio = BIO_new(BIO_s_mem());
BIO_write(bio, certificate.getData().getData(), certificate.getData().getSize());
boost::shared_ptr<PKCS12> pkcs12(d2i_PKCS12_bio(bio, NULL), PKCS12_free);
BIO_free(bio);
if (!pkcs12) {
return false;
}
// Parse PKCS12
X509 *certPtr = 0;
EVP_PKEY* privateKeyPtr = 0;
STACK_OF(X509)* caCertsPtr = 0;
int result = PKCS12_parse(pkcs12.get(), certificate.getPassword().getUTF8Data(), &privateKeyPtr, &certPtr, &caCertsPtr);
if (result != 1) {
return false;
}
boost::shared_ptr<X509> cert(certPtr, X509_free);
boost::shared_ptr<EVP_PKEY> privateKey(privateKeyPtr, EVP_PKEY_free);
boost::shared_ptr<STACK_OF(X509)> caCerts(caCertsPtr, freeX509Stack);
// Use the key & certificates
if (SSL_CTX_use_certificate(context_, cert.get()) != 1) {
return false;
}
if (SSL_CTX_use_PrivateKey(context_, privateKey.get()) != 1) {
return false;
}
for (int i = 0; i < sk_X509_num(caCerts.get()); ++i) {
SSL_CTX_add_extra_chain_cert(context_, sk_X509_value(caCerts.get(), i));
}
return true;
}
}
|
Swift