1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
/*
* Ricochet - A minimalist CLI web browser for fast, distraction-free navigation.
* Copyright (C) 2026 Richard Qin
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
#include "ricochet/net/ssl_socket.hh"
#include <iostream>
#include <openssl/err.h>
#include <openssl/ssl.h>
#include <stdexcept>
namespace ricochet::net {
// --- RAII Deleters ---
void SslCtxDeleter::operator()( SSL_CTX* ptr ) const
{
if ( ptr != nullptr ) {
SSL_CTX_free( ptr );
}
}
void SslDeleter::operator()( SSL* ptr ) const
{
if ( ptr != nullptr ) {
SSL_free( ptr );
}
}
// SSLSocket Implementation
SSLSocket::SSLSocket()
{
const SSL_METHOD* method = TLS_client_method();
ctx_.reset( SSL_CTX_new( method ) );
if ( !ctx_ ) {
throw std::runtime_error( "Failed to create SSL_CTX" );
}
if ( SSL_CTX_set_default_verify_paths( ctx_.get() ) != 1 ) {
throw std::runtime_error( "Failed to load default CA certificates" );
}
}
void SSLSocket::connect( const Address& address, const std::string& hostname )
{
// TCP Connect
underlying_socket_.connect( address );
ssl_.reset( SSL_new( ctx_.get() ) );
if ( !ssl_ ) {
throw std::runtime_error( "Failed to create SSL object" );
}
// Setup SNI (Server Name Indication)
if ( SSL_set_tlsext_host_name( ssl_.get(), hostname.c_str() ) != 1 ) {
// Some old servers do not support SNI, here we can ignore the error or throw an exception, depending on the
// requirements
std::cerr << "Warning: Failed to set SNI" << '\n';
}
SSL_set_fd( ssl_.get(), underlying_socket_.fd_num() );
if ( SSL_connect( ssl_.get() ) != 1 ) {
throw std::runtime_error( "TLS Handshake failed!" );
}
}
std::size_t SSLSocket::write( std::string_view data )
{
if ( !ssl_ ) {
return 0;
}
const int bytes_written = SSL_write( ssl_.get(), data.data(), static_cast<int>( data.size() ) );
if ( bytes_written <= 0 ) {
throw std::runtime_error( "SSL write failed" );
}
return static_cast<std::size_t>( bytes_written );
}
void SSLSocket::read( std::string& buffer )
{
if ( !ssl_ ) {
return;
}
std::array<char, 4096> buf {};
// Read decrypted data from the encrypted channel
const int bytes_read = SSL_read( ssl_.get(), buf.data(), static_cast<int>( buf.size() ) );
if ( bytes_read > 0 ) {
buffer.append( buf.data(), static_cast<std::size_t>( bytes_read ) );
} else {
// Read 0 or negative, representing the server closed the connection (EOF)
eof_ = true;
}
}
bool SSLSocket::eof() const
{
return eof_;
}
} // namespace ricochet::net
|
