#include <SSLSocket.h>

Inheritance diagram for SSLSocket:

Public Member Functions
	SSLSocket () __DCL_THROWS1(SSLException *)
	SSLSocket (const String &_addr, uint16_t _port) __DCL_THROWS2(IOException *
SSLException *virtual	~SSLSocket ()
virtual void	close () __DCL_THROWS1(IOException *)
virtual void	connect (const sockaddr _serv_addr, socklen_t _addrlen) __DCL_THROWS1(IOException )
virtual size_t	send (const void _buf, size_t _n, int _flags=0) __DCL_THROWS1(IOException )
virtual size_t	recv (void _buf, size_t _n, int _flags=0) __DCL_THROWS1(IOException )
bool	isPeerCertificateVerified () const
String	getPeerCertificateCommonName () const
Public Member Functions inherited from File
virtual String	toString () const
virtual	~File ()
	File (const String &_path, int _oflags=READONLY, int _mode=0666) __DCL_THROWS1(IOException *)
void	open (const String &_path, int _oflags=READONLY, int _mode=0666) __DCL_THROWS1(IOException *)
	File (HandleType _handle, int _ohints, bool _closeOnClose) __DCL_THROWS1(IOException *)
void	open (HandleType _handle, int _ohints, bool _closeOnClose) __DCL_THROWS1(IOException *)
virtual void	sync () __DCL_THROWS1(IOException *)
off_t	seek (off_t _offset, int _whence) __DCL_THROWS1(IOException *)
off_t	size () const __DCL_THROWS1(IOException *)
DateTime	mtime () const __DCL_THROWS1(IOException *)
bool	time (time_t _atime, time_t _mtime, time_t *_ctime) const
HandleType	handle () const
const String &	path () const
Public Member Functions inherited from Object
virtual void	destroy ()
String	className () const
bool	isInstanceOf (const std::type_info &typeinfo) const
virtual const std::type_info &	typeInfo () const

Protected Member Functions
void	construct () __DCL_THROWS1(SSLException *)
Protected Member Functions inherited from Socket
virtual bool	onEvent (short _revents, PollThread _pPollThread) __DCL_THROWS1(IOException )
Protected Member Functions inherited from File
	File ()
	File (HandleType _handle, const String &_path)
Protected Member Functions inherited from Object
virtual	~Object ()
	Object ()

Additional Inherited Members
Public Types inherited from File
enum	Whence { BEGIN , CURRENT , END }
Static Public Member Functions inherited from File
static File *	openTempFile (const String &_dirname, const String &_prefix, unsigned int _mode=0666) __DCL_THROWS1(IOException *)
Protected Attributes inherited from File
String	__path
HandleType	__handle
bool	__closeOnClose

Detailed Description

SSL/TLS 소켓에 대한 파일 인터페이스와 Non-Blocking 입출력을 제공한다.

See also: PollThread; SocketPollThread; openssl

Definition at line 49 of file SSLSocket.h.

Constructor & Destructor Documentation

◆ SSLSocket() [1/2]

SSLSocket::SSLSocket ( )

Definition at line 265 of file SSLSocket.cpp.

{
    construct();
}

◆ SSLSocket() [2/2]

SSLSocket::SSLSocket	(	const String &	_addr,
		uint16_t	_port )

◆ ~SSLSocket()

SSLSocket::~SSLSocket ( )

virtual

Definition at line 278 of file SSLSocket.cpp.

{
#if __DCL_USE_OPENSSL
    if (__ssl)
#elif __DCL_USE_SCHANNEL
    if (SecIsValidHandle(&__ctxt))
#endif
    {
        try {
            close();
        }
        catch (Exception* cause) {
            __DCL_TRACE1(__T("Error! SSLSocket::~SSLSocket %ls\n"), cause->toString().data());
            cause->destroy();
        }
    }
 
#if __DCL_USE_OPENSSL
    if (__ctx) {
        SSL_CTX_free(__ctx);
    #if __DCL_DEBUG
        __ctx = NULL;
    #endif
    }
 
#elif __DCL_USE_SCHANNEL
    if (SecIsValidHandle(&__cred)) {
        SECURITY_STATUS ss = FreeCredentialsHandle(&__cred);
    #if __DCL_DEBUG
        if (ss != SEC_E_OK)
            __DCL_TRACE1(__T("Warning!! [%ls]\n"), __GetStatusMessage(ss).data());
        SecInvalidateHandle(&__cred);
    #endif
    }
 
#endif
}

Member Function Documentation

◆ close()

void SSLSocket::close ( )

virtual

파일을 닫는다.

Reimplemented from Socket.

Definition at line 316 of file SSLSocket.cpp.

{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ssl != NULL);
    SSL_free(__ssl);
    __ssl = NULL;
 
#elif __DCL_USE_SCHANNEL
    __DCL_ASSERT_HANDLE(SecIsValidHandle(&__ctxt));
    SECURITY_STATUS ss = DeleteSecurityContext(&__ctxt);
    #if __DCL_DEBUG
    if (ss != SEC_E_OK)
        __DCL_TRACE1(__T("Warning!! [%ls]\n"), __GetStatusMessage(ss).data());
    #endif
    SecInvalidateHandle(&__ctxt);
 
#endif
    
    Socket::close();
}

◆ connect()

void SSLSocket::connect	(	const sockaddr *	_serv_addr,
		socklen_t	_addrlen )

virtual

Reimplemented from Socket.

Definition at line 350 of file SSLSocket.cpp.

{
    Socket::connect(_serv_addr, _addrlen);
 
    __DCL_TRACE0(__T("SSLSocket::connect()\n"));
 
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl == NULL);
    __ssl = SSL_new(__ctx);
    BIO* bio = BIO_new_socket(__handle, BIO_NOCLOSE);
 
    SSL_set_bio(__ssl, bio, bio);
 
    if (SSL_connect(__ssl) < 0)
        throw new IOException(toString(), new SSLException());
 
#elif __DCL_USE_SCHANNEL
    DWORD fContextReq = ISC_REQ_SEQUENCE_DETECT   |
            ISC_REQ_REPLAY_DETECT     |
            ISC_REQ_CONFIDENTIALITY   |
            ISC_RET_EXTENDED_ERROR    |
            ISC_REQ_ALLOCATE_MEMORY   |
            ISC_REQ_STREAM;
 
    SecBufferDesc   outBufferDesc;
    SecBuffer       outBuffers[1];
 
    outBuffers[0].BufferType = SECBUFFER_TOKEN;
    outBuffers[0].cbBuffer = 0;
    outBuffers[0].pvBuffer = NULL;
    outBufferDesc.ulVersion = SECBUFFER_VERSION;
    outBufferDesc.cBuffers = 1;
    outBufferDesc.pBuffers = outBuffers;
 
    CtxtHandle  ctxt;
    ULONG       ctxtAttr;
    TimeStamp   tsExpiry;
 
    SECURITY_STATUS ss = InitializeSecurityContextW(
        &__cred,                // __in         PCredHandle phCredential,
        NULL,                   // __in_out PCtxtHandle phContext,
        NULL,                   // __in         SEC_CHAR* pszTargetName,
        fContextReq,            // __in         ULONG fContextReq,
        0,                      // ULONG Reserved1,
        0,                      // __in         ULONG TargetDataRep,
        NULL,                   // __in_out PSecBufferDesc pInput,
        0,                      // ULONG Reserved2,
        &ctxt,                  // __in_out PCtxtHandle phNewContext,
        &outBufferDesc,         // __out        PSecBufferDesc pOutput,
        &ctxtAttr,              // __out        PULONG pfContextAttr,
        &tsExpiry               // __out        PTimeStamp ptsExpiry
        );
 
    if (FAILED(ss))
        throw new IOException(toString(), new SSLException(ss));
 
    __DCL_TRACE1(__T("%ls\n"), __GetStatusMessage(ss).data());
 
    if (outBuffers[0].cbBuffer != 0 && outBuffers[0].pvBuffer != NULL) {
        __DCL_TRACE3(__T("%d, %d, [%ls]\n"),
            outBuffers[0].BufferType,
            outBuffers[0].cbBuffer,
            String::tryString((const char*) outBuffers[0].pvBuffer,
                outBuffers[0].cbBuffer, 8).data()
            );
        int n = ::send((UINT_PTR) __handle,
            (const char*) outBuffers[0].pvBuffer, outBuffers[0].cbBuffer, 0);
        if (n == SOCKET_ERROR || n == 0) {
            FreeContextBuffer(outBuffers[0].pvBuffer);
            DeleteSecurityContext(&ctxt);
            throw new IOException(toString(), WSAGetLastError());
        }
 
        __DCL_TRACE1(__T("[%d] bytes of Handshake data sent\n"), n);
        FreeContextBuffer(outBuffers[0].pvBuffer);
        outBuffers[0].pvBuffer = NULL;
    }
 
    // Handshake
 
    SecBufferDesc   inBufferDesc;
    SecBuffer       inBuffers[2];
 
    DWORD WSAError = 0;
#define READ_BUFFER_SIZE    0x10000
    char* readBuffer = (char*) malloc(READ_BUFFER_SIZE);
    bool fDoRead = true;
    unsigned int nRead = 0;
 
    while (ss == SEC_I_CONTINUE_NEEDED ||
            ss == SEC_E_INCOMPLETE_MESSAGE ||
            ss == SEC_I_INCOMPLETE_CREDENTIALS) {
        if (0 == nRead || ss == SEC_E_INCOMPLETE_MESSAGE) {
            if (fDoRead) {
                int n = ::recv(
                    (UINT_PTR) __handle,
                    readBuffer + nRead,
                    READ_BUFFER_SIZE - nRead,
                    0
                    );
                if (n == SOCKET_ERROR) {
                    WSAError = WSAGetLastError();
                    ss = SEC_E_INTERNAL_ERROR;
                    break;
                }
                else if (n == 0) {
                    WSAError = WSAECONNRESET;
                    ss = SEC_E_INTERNAL_ERROR;
                    break;
                }
                __DCL_TRACE2(__T("Handshake read [%d] [%ls]\n"), n,
                    String::tryString((const char*) readBuffer + nRead, n, 8).data());
 
                nRead += n;
            }
            else
                fDoRead = true;
        }
 
        inBuffers[0].BufferType = SECBUFFER_TOKEN;
        inBuffers[0].cbBuffer = nRead;
        inBuffers[0].pvBuffer = readBuffer;
 
        inBuffers[1].BufferType = SECBUFFER_EMPTY;
        inBuffers[1].cbBuffer = 0;
        inBuffers[1].pvBuffer = NULL;
 
        inBufferDesc.ulVersion = SECBUFFER_VERSION;
        inBufferDesc.cBuffers = 2;
        inBufferDesc.pBuffers = inBuffers;
 
        outBuffers[0].BufferType = SECBUFFER_TOKEN;
        outBuffers[0].cbBuffer = 0;
        outBuffers[0].pvBuffer = NULL;
 
        outBufferDesc.ulVersion = SECBUFFER_VERSION;
        outBufferDesc.cBuffers = 1;
        outBufferDesc.pBuffers = outBuffers;
 
        ss = InitializeSecurityContextW(
                &__cred,
                &ctxt,
                NULL,
                fContextReq,
                0,
                SECURITY_NATIVE_DREP,
                &inBufferDesc,
                0,
                NULL,
                &outBufferDesc,
                &ctxtAttr,
                &tsExpiry
                );
 
        if (ss == SEC_E_OK ||
                ss == SEC_I_CONTINUE_NEEDED ||
                FAILED(ss) && (ctxtAttr & ISC_RET_EXTENDED_ERROR)) {
            if (outBuffers[0].cbBuffer != 0 && outBuffers[0].pvBuffer != NULL) {
                int n = ::send(
                    (UINT_PTR) __handle,
                    (const char*) outBuffers[0].pvBuffer,
                    outBuffers[0].cbBuffer,
                    0
                    );
                if (n == SOCKET_ERROR || n == 0) {
                    WSAError = WSAGetLastError();
                    FreeContextBuffer(outBuffers[0].pvBuffer);
                    DeleteSecurityContext(&ctxt);
                    ss = SEC_E_INTERNAL_ERROR;
                    break;
                }
 
                __DCL_TRACE1(__T("[%d] bytes of Handshake data sent\n"), n);
                FreeContextBuffer(outBuffers[0].pvBuffer);
                outBuffers[0].pvBuffer = NULL;
            }
        }
 
        if (ss == SEC_E_INCOMPLETE_MESSAGE) {
            __DCL_TRACE0(__T("====================== SEC_E_INCOMPLETE_MESSAGE =====================\n"));
            continue;
        }
 
        __DCL_TRACE1(__T("Before OK[%u]\n"), ss);
        if (ss == SEC_E_OK) {
            __DCL_TRACE0(__T("Handshake was successful\n"));
 
            if (inBuffers[1].BufferType == SECBUFFER_EXTRA) {
                __DCL_TRACE1(__T("Extad data [%d] bytes\n"), inBuffers[1].cbBuffer);
            }
 
            break;
        }
 
        __DCL_TRACE2(__T("[%u][%ls]\n"), ss, __GetStatusMessage(ss).data());
 
        if(ss == SEC_I_INCOMPLETE_CREDENTIALS) {
            __DCL_TRACE0(__T("SEC_I_INCOMPLETE_CREDENTIALS\n"));
 
            // Get New client Credentials
 
            break;
 
            fDoRead = false;
            ss = SEC_I_CONTINUE_NEEDED;
            continue;
        }
    
        if (inBuffers[1].BufferType == SECBUFFER_EXTRA) {
            __DCL_TRACE1(__T("Extad data [%d] bytes\n"), inBuffers[1].cbBuffer);
            memcpy(readBuffer,
                readBuffer + (nRead - inBuffers[1].cbBuffer),
                inBuffers[1].cbBuffer
                );
            nRead = inBuffers[1].cbBuffer;
        }
        else
            nRead = 0;
    }
 
    free(readBuffer);
 
    if (FAILED(ss)) {
        DeleteSecurityContext(&ctxt);
    }
    else
        __ctxt = ctxt;
 
#endif
}

◆ construct()

void SSLSocket::construct ( )

protected

Definition at line 219 of file SSLSocket.cpp.

{
#if __DCL_USE_OPENSSL
    Thread::once(__opensslOnceControl, __opensslLibraryInit);
    __ctx = NULL;
    __ssl = NULL;
    SSL_CTX* ctx = SSL_CTX_new(SSLv23_method());
    if (ctx == NULL)
        throw new SSLException();
    __ctx = ctx;
 
#elif __DCL_USE_SCHANNEL
    SecInvalidateHandle(&__cred);
    SecInvalidateHandle(&__ctxt);
 
    CredHandle      cred;
    SCHANNEL_CRED   credData;
    TimeStamp       tsExpiry;
 
    ZeroMemory(&credData, sizeof(credData));
    credData.dwVersion = SCHANNEL_CRED_VERSION;
    // Specify the TLS V1.0 (client-side) security protocol.
    // credData.grbitEnabledProtocols = SP_PROT_TLS1_CLIENT; 
 
    credData.dwFlags |= SCH_CRED_NO_DEFAULT_CREDS;
    credData.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION;
 
    SECURITY_STATUS ss = AcquireCredentialsHandleW(
        NULL,                   // __in     SEC_CHAR* pszPrincipal, default principal
        UNISP_NAME_W,           // __in     SEC_CHAR* pszPackage, for Schannel
        SECPKG_CRED_OUTBOUND,   // __in     ULONG fCredentialUse,
        NULL,                   // __in     PLUID pvLogonID, use the current LOGON id
        &credData,              // __in     PVOID pAuthData, protocol-specific data
        NULL,                   // __in     SEC_GET_KEY_FN pGetKeyFn, default
        NULL,                   // __in     PVOID pvGetKeyArgument, default
        &cred,                  // __out    PCredHandle phCredential,
        &tsExpiry               // __out    PTimeStamp ptsExpiry
        );
    if (ss != SEC_E_OK)
        throw new SSLException(ss);
 
    __cred = cred;
#endif
}

◆ getPeerCertificateCommonName()

String SSLSocket::getPeerCertificateCommonName ( ) const

Definition at line 661 of file SSLSocket.cpp.

{
    String s;
 
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
 
    char peer_CN[512];
    
    X509* peer = SSL_get_peer_certificate(__ssl);
    if (peer) {
        int r = X509_NAME_get_text_by_NID(
            X509_get_subject_name(peer),
            NID_commonName,
            peer_CN,
            sizeof(peer_CN)
            );
 
        if (r > 0) {
            LocaleDecoder decoder;
            s = decoder.decode(peer_CN);
        }
    }
 
#endif
    return s;
}

◆ isPeerCertificateVerified()

bool SSLSocket::isPeerCertificateVerified ( ) const

Definition at line 650 of file SSLSocket.cpp.

{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
 
    return SSL_get_verify_result(__ssl) !=X509_V_OK;
#endif
    return false;
}

◆ recv()

size_t SSLSocket::recv	(	void *	_buf,
		size_t	_n,
		int	_flags = 0 )

virtual

Returns: Non-Blocking 상태에서 0을 반환할 수 있다. 이 경우 다시 시도해야 한다.

Reimplemented from Socket.

Definition at line 613 of file SSLSocket.cpp.

{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
 
    __DCL_TRACE2(__T("SSLSocket::recv(%p, %zd)\n"), _buf, _n);
 
    __DCL_TRACE2(__T("before avail[%zd], pending[%d]\n"),
        Socket::available(), SSL_pending(__ssl));
    int n = (int) _n;
    int r = SSL_read(__ssl, _buf, n);
    __DCL_TRACE1(__T("SSLSocket::SSL_read(%d)\n"), r);
    __DCL_TRACE2(__T("after avail[%zd], pending[%d]\n"),
        Socket::available(), SSL_pending(__ssl));
    if (r > 0)
        return (size_t) r;
    
    switch (SSL_get_error(__ssl, r)) {
        case SSL_ERROR_ZERO_RETURN:
            __DCL_TRACE0(__T("SSL error zero return\n"));
            // ssl close notify, and send close notify
            SSL_shutdown(__ssl);
            break;
        case SSL_ERROR_SYSCALL:
            __DCL_TRACE0(__T("SSL Error: Premature close\n"));
            break;
        default:
            throw new IOException(toString(), new SSLException());
    }
#endif
    // DWORD dw = SCHANNEL_SHUTDOWN;
 
    return 0;
}

◆ send()

size_t SSLSocket::send	(	const void *	_buf,
		size_t	_n,
		int	_flags = 0 )

virtual

Returns: Non-Blocking 상태에서 0을 반환할 수 있다. 이 경우 다시 시도해야 한다.

Reimplemented from Socket.

Definition at line 583 of file SSLSocket.cpp.

{
#if __DCL_USE_OPENSSL
    __DCL_ASSERT_HANDLE(__ctx != NULL);
    __DCL_ASSERT_HANDLE(__ssl != NULL);
 
    __DCL_TRACE2(__T("SSLSocket::send(%p, %zd)\n"), _buf, _n);
 
    int n = (int) _n;
    int r = SSL_write(__ssl, _buf, (int) _n);
 
    __DCL_TRACE1(__T("SSLSocket::SSL_write(%d)\n"),r);
 
    if (r > 0)
        return (size_t) r;
 
    switch(SSL_get_error(__ssl, r)) {      
        case SSL_ERROR_NONE:
            if(n != r)
                __DCL_TRACE0(__T("Incomplete write!\n"));
            break;
        default:
            throw new IOException(toString(), new SSLException());
    }
#endif
 
    return 0;
}

The documentation for this class was generated from the following files:

Public Member Functions

Protected Member Functions

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

◆ SSLSocket() [1/2]

◆ SSLSocket() [2/2]

◆ ~SSLSocket()

Member Function Documentation

◆ close()

◆ connect()

◆ construct()

◆ getPeerCertificateCommonName()

◆ isPeerCertificateVerified()

◆ recv()

◆ send()