CMSDK 2.0.1
Cross-platform C++ base library and SDK for the Psyclone AIOS platform
Loading...
Searching...
No Matches
cmlabs::SSLConnection Class Reference

SSL/TLS-encrypted TCP connection (OpenSSL) with configurable peer verification. More...

#include <NetworkConnections.h>

Inheritance diagram for cmlabs::SSLConnection:
[legend]
Collaboration diagram for cmlabs::SSLConnection:
[legend]

Public Member Functions

 SSLConnection ()
 ~SSLConnection ()
bool init ()
 Initialise the OpenSSL context for a client-side connection.
bool init (const char *certFile, const char *keyFile)
 Initialise the OpenSSL context for a server-side connection with a certificate.
void setAllowSelfSigned (bool allow)
bool getAllowSelfSigned () const
void setVerifyHostName (const char *host)
const char * getVerifyHostName () const
void setCALocation (const char *caFile, const char *caPath)
bool connect (SOCKET s, uint64 localAddr, NetworkDataReceiver *receiver=NULL)
 Adopt an already-accepted socket and perform the server-side TLS handshake.
bool connect (uint64 addr, uint32 timeoutMS, NetworkDataReceiver *receiver=NULL)
 Connect and handshake to a packed uint64 endpoint (client side).
bool connect (const char *addr, uint16 port, uint64 &location, uint32 timeoutMS, NetworkDataReceiver *receiver=NULL)
 Connect and handshake to a host by name/IP and port (client side).
bool connect (const uint32 *addresses, uint16 addressCount, uint16 port, uint64 &location, uint32 timeoutMS, NetworkDataReceiver *receiver=NULL)
 Try several candidate IPv4 addresses until one connects and handshakes.
bool delayedConnect (uint64 addr, uint32 timeoutMS, NetworkDataReceiver *receiver)
 Begin a non-blocking connect (TLS handshake completes in didConnect()).
bool delayedConnect (const char *addr, uint16 port, uint64 &location, uint32 timeoutMS, NetworkDataReceiver *receiver)
 Begin a non-blocking connect to a host name/IP (see TCPConnection::delayedConnect()).
bool send (const char *data, uint32 size, uint64 receiver=0)
 Send bytes over the encrypted stream.
bool reconnect (uint32 timeoutMS)
 Reconnect and re-handshake to the previous endpoint.
bool isConnected (int timeout=0)
 Test whether the connection is currently alive.
bool didConnect (int timeout=0)
 Check/complete an in-progress (delayed) connect on the existing socket.
bool disconnect (uint16 error=0)
 Shut down the TLS session and close the socket.
int32 peekStream ()
 Peek how many decrypted bytes are pending inside the SSL layer.
int32 readIntoBuffer ()
 Read decrypted bytes from the SSL layer into the internal buffer.
bool receive (char *data, uint32 size, uint32 timeout, bool peek=false)
 Receive exactly size bytes into data, waiting up to timeout ms.
bool receiveAvailable (char *data, uint32 &size, uint32 maxSize, uint32 timeout, bool peek=false)
 Receive whatever bytes are available (up to maxSize).
Public Member Functions inherited from cmlabs::NetworkConnection
 NetworkConnection ()
 ~NetworkConnection ()
virtual bool didConnect (SOCKET s, int timeout)
 Variant of didConnect() testing an explicit socket handle.
virtual bool isRemote ()
virtual uint64 getRemoteAddress ()
bool setConnectTimeout (uint32 timeoutMS)
 Set the timeout used by subsequent connect()/reconnect() attempts.
virtual bool discard (uint32 size)
 Drop size bytes from the front of the receive buffer (after a peek).
virtual uint32 clearBuffer ()
 Discard all currently buffered input.
virtual bool waitForDataToRead (uint32 timeout)
 Block until data is readable (buffered or on the socket).
virtual bool waitForDataToBeWritten (uint32 timeout)
 Block until the socket is writable.
virtual uint32 getOutputSpeed ()
virtual uint32 getInputSpeed ()
virtual uint8 getConnectionType ()
bool setGreetingData (const char *data, uint32 size)
 Set greeting bytes sent automatically right after a connection is established (used e.g.
Public Member Functions inherited from cmlabs::Runnable
 Runnable ()
 Initialise flags: not running, allowed to continue.
virtual ~Runnable ()
 Destructor requests a stop (with the default timeout) before destruction proceeds.
virtual bool stop (uint32 timeout=200)
 Ask the worker loop to finish and wait for it to do so.

Static Public Member Functions

static void SetDefaultAllowSelfSigned (bool allow)
static bool GetDefaultAllowSelfSigned ()
static void SetDefaultCALocation (const char *caFile, const char *caPath)

Public Attributes

std::string certinfo
 Human-readable summary of the peer certificate (subject/issuer), filled after handshake.
Public Attributes inherited from cmlabs::NetworkConnection
char * greetingData
 Owned copy of the greeting bytes (NULL if unset).
uint32 greetingSize
 Size of ::greetingData in bytes.

Protected Member Functions

bool findRemoteAddress (uint64 &addr)
Protected Member Functions inherited from cmlabs::NetworkConnection
void disconnectInternal (uint16 error)
virtual bool resizeBuffer (uint32 len)
virtual bool run ()

Protected Attributes

bool allowSelfSigned
std::string verifyHostName
std::string caFile
std::string caPath
Protected Attributes inherited from cmlabs::NetworkConnection
uint8 type
uint64 remoteAddress
uint64 localAddress
uint64 lastActivity
uint32 threadID
SOCKET socket
bool remote
uint32 bufferLen
uint32 bufferContentLen
uint32 bufferContentPos
NetworkDataReceiverreceiver
utils::Mutex mutex
utils::Mutex sendMutex
char * buffer
uint32 connectTimeoutMS
uint32 inputSpeed
uint32 outputSpeed
uint64 inputBytes
uint64 outputBytes
Protected Attributes inherited from cmlabs::Runnable
uint32 threadID
 ThreadManager slot ID of the worker thread (0 until known).
bool shouldContinue
 Loop-continuation flag; cleared by stop().
bool isRunning
 Set by the worker while its loop is active.

Static Protected Attributes

static bool DefaultAllowSelfSigned = false
static std::string DefaultCAFile
static std::string DefaultCAPath

Friends

THREAD_RET THREAD_FUNCTION_CALL SSLConnectionRun (THREAD_ARG arg)

Detailed Description

SSL/TLS-encrypted TCP connection (OpenSSL) with configurable peer verification.

Mirrors the TCPConnection API but wraps the socket in an OpenSSL session. The existing inline comments below document the verification policy precisely; in summary: peer certificates are verified against the OS/CA trust store by default, hostname verification (SNI + SSL_set1_host) is applied when the hostname is known, self-signed peers can be allowed per connection or process-wide, and a custom CA file/path can replace the OS trust store. Full SSL support requires building with _USE_SSL_; without it the class exists but cannot establish encrypted sessions.

Warning
setAllowSelfSigned(true) disables peer verification entirely for that connection — use only for testing or closed networks.

Definition at line 766 of file NetworkConnections.h.

Constructor & Destructor Documentation

◆ SSLConnection()

◆ ~SSLConnection()

cmlabs::SSLConnection::~SSLConnection ( )

Definition at line 1754 of file NetworkConnections.cpp.

References cmlabs::NetworkConnection::mutex.

Member Function Documentation

◆ connect() [1/4]

bool cmlabs::SSLConnection::connect ( const char * addr,
uint16 port,
uint64 & location,
uint32 timeoutMS,
NetworkDataReceiver * receiver = NULL )

Connect and handshake to a host by name/IP and port (client side).

When addr is a DNS name (not an IP literal) it is recorded for hostname verification and sent as SNI.

Parameters
addrHost name or IPv4 string.
portRemote port.
locationOut: resolved endpoint packed as uint64.
timeoutMSConnect+handshake timeout in ms.
receiverOptional push-mode data receiver.
Returns
true on success.

Definition at line 2377 of file NetworkConnections.cpp.

References connect(), GETIPADDRESSPORT, cmlabs::utils::LookupIPAddress(), cmlabs::NetworkConnection::receiver, and verifyHostName.

◆ connect() [2/4]

bool cmlabs::SSLConnection::connect ( const uint32 * addresses,
uint16 addressCount,
uint16 port,
uint64 & location,
uint32 timeoutMS,
NetworkDataReceiver * receiver = NULL )

Try several candidate IPv4 addresses until one connects and handshakes.

Parameters
addressesIPv4 candidates.
addressCountCount.
portRemote port.
locationOut: winning endpoint.
timeoutMSTotal budget in ms.
receiverOptional push-mode data receiver.
Returns
true on success.

Definition at line 2392 of file NetworkConnections.cpp.

References connect(), GETIPADDRESSPORT, and cmlabs::NetworkConnection::receiver.

◆ connect() [3/4]

◆ connect() [4/4]

◆ delayedConnect() [1/2]

bool cmlabs::SSLConnection::delayedConnect ( const char * addr,
uint16 port,
uint64 & location,
uint32 timeoutMS,
NetworkDataReceiver * receiver )

Begin a non-blocking connect to a host name/IP (see TCPConnection::delayedConnect()).

Parameters
addrHost name or IPv4 string.
portRemote port.
locationOut: resolved endpoint.
timeoutMSCompletion timeout.
receiverOptional push-mode data receiver.
Returns
true if initiated.

Definition at line 2430 of file NetworkConnections.cpp.

References delayedConnect(), GETIPADDRESSPORT, cmlabs::utils::LookupIPAddress(), cmlabs::NetworkConnection::receiver, and verifyHostName.

◆ delayedConnect() [2/2]

bool cmlabs::SSLConnection::delayedConnect ( uint64 addr,
uint32 timeoutMS,
NetworkDataReceiver * receiver )

◆ didConnect()

bool cmlabs::SSLConnection::didConnect ( int timeout = 0)
virtual

Check/complete an in-progress (delayed) connect on the existing socket.

Parameters
timeoutMilliseconds to wait for the connect to complete (0 = poll).
Returns
true once the socket is writable, i.e. connected.

Reimplemented from cmlabs::NetworkConnection.

Definition at line 1948 of file NetworkConnections.cpp.

References cmlabs::NetworkConnection::didConnect().

Referenced by connect().

◆ disconnect()

bool cmlabs::SSLConnection::disconnect ( uint16 error = 0)
virtual

Shut down the TLS session and close the socket.

Parameters
errorOptional NETWORKERROR_* reason.
Returns
true when closed.

Reimplemented from cmlabs::NetworkConnection.

Definition at line 2115 of file NetworkConnections.cpp.

References cmlabs::NetworkConnection::disconnectInternal(), and cmlabs::NetworkConnection::mutex.

Referenced by isConnected(), receive(), receiveAvailable(), reconnect(), and send().

◆ findRemoteAddress()

bool cmlabs::SSLConnection::findRemoteAddress ( uint64 & addr)
protected

◆ getAllowSelfSigned()

bool cmlabs::SSLConnection::getAllowSelfSigned ( ) const
inline

Definition at line 787 of file NetworkConnections.h.

References allowSelfSigned.

◆ GetDefaultAllowSelfSigned()

bool cmlabs::SSLConnection::GetDefaultAllowSelfSigned ( )
static

Definition at line 1776 of file NetworkConnections.cpp.

References DefaultAllowSelfSigned.

◆ getVerifyHostName()

const char * cmlabs::SSLConnection::getVerifyHostName ( ) const
inline

Definition at line 798 of file NetworkConnections.h.

References verifyHostName.

◆ init() [1/2]

bool cmlabs::SSLConnection::init ( )

Initialise the OpenSSL context for a client-side connection.

Returns
true on success. Call before connect() (done implicitly by connect()).

Definition at line 1921 of file NetworkConnections.cpp.

References cmlabs::NetworkConnection::mutex.

Referenced by cmlabs::TCPListener::acceptConnection(), cmlabs::NetworkChannel::addTCPConnection(), cmlabs::NetworkChannel::addTCPConnection(), connect(), and cmlabs::NetworkChannel::createTCPConnection().

◆ init() [2/2]

bool cmlabs::SSLConnection::init ( const char * certFile,
const char * keyFile )

Initialise the OpenSSL context for a server-side connection with a certificate.

Parameters
certFilePath to PEM certificate.
keyFilePath to PEM private key.
Returns
true if the certificate/key pair loaded successfully.

Definition at line 1875 of file NetworkConnections.cpp.

References LOG_NETWORK, LogPrint, and cmlabs::NetworkConnection::mutex.

◆ isConnected()

bool cmlabs::SSLConnection::isConnected ( int timeout = 0)
virtual

Test whether the connection is currently alive.

Parameters
timeoutMilliseconds to allow for probing the socket (0 = immediate).
Returns
true if connected.

Reimplemented from cmlabs::NetworkConnection.

Definition at line 1952 of file NetworkConnections.cpp.

References disconnect(), cmlabs::utils::GetLastOSErrorNumber(), INVALID_SOCKET, cmlabs::NetworkConnection::mutex, cmlabs::NetworkConnection::socket, SOCKETTRYAGAIN, SOCKETWOULDBLOCK, cmlabs::NetworkConnection::type, and UDPCON.

◆ peekStream()

int32 cmlabs::SSLConnection::peekStream ( )

Peek how many decrypted bytes are pending inside the SSL layer.

Returns
Number of bytes available, or negative on error.

Definition at line 2561 of file NetworkConnections.cpp.

References cmlabs::NetworkConnection::mutex.

◆ readIntoBuffer()

int32 cmlabs::SSLConnection::readIntoBuffer ( )
virtual

◆ receive()

bool cmlabs::SSLConnection::receive ( char * data,
uint32 size,
uint32 timeout,
bool peek = false )
virtual

Receive exactly size bytes into data, waiting up to timeout ms.

Parameters
dataDestination buffer of at least size bytes.
sizeExact number of bytes required.
timeoutMaximum wait in milliseconds.
peekWhen true the bytes remain in the internal buffer (subsequent reads see them again).
Returns
true if size bytes were delivered before the timeout.

Reimplemented from cmlabs::NetworkConnection.

Definition at line 2711 of file NetworkConnections.cpp.

References cmlabs::NetworkConnection::buffer, cmlabs::NetworkConnection::bufferContentLen, cmlabs::NetworkConnection::bufferContentPos, cmlabs::NetworkConnection::bufferLen, disconnect(), cmlabs::GetTimeAge(), cmlabs::GetTimeAgeMS(), cmlabs::GetTimeNow(), cmlabs::NetworkConnection::inputBytes, cmlabs::NetworkConnection::inputSpeed, LOG_NETWORK, LogPrint, cmlabs::NetworkConnection::mutex, NETWORKERROR_RECEIVE, cmlabs::NetworkConnection::resizeBuffer(), cmlabs::NetworkConnection::socket, and cmlabs::utils::WaitForSocketReadability().

◆ receiveAvailable()

bool cmlabs::SSLConnection::receiveAvailable ( char * data,
uint32 & size,
uint32 maxSize,
uint32 timeout,
bool peek = false )
virtual

Receive whatever bytes are available (up to maxSize).

Parameters
dataDestination buffer.
sizeOut: number of bytes actually delivered.
maxSizeCapacity of data.
timeoutMaximum wait in milliseconds for at least one byte.
peekWhen true the bytes remain buffered.
Returns
true if any bytes were delivered.

Reimplemented from cmlabs::NetworkConnection.

Definition at line 2629 of file NetworkConnections.cpp.

References cmlabs::NetworkConnection::buffer, cmlabs::NetworkConnection::bufferContentLen, cmlabs::NetworkConnection::bufferContentPos, cmlabs::NetworkConnection::bufferLen, disconnect(), cmlabs::GetTimeNow(), cmlabs::NetworkConnection::inputBytes, LOG_NETWORK, LogPrint, cmlabs::NetworkConnection::mutex, NETWORKERROR_RECEIVE, cmlabs::NetworkConnection::resizeBuffer(), cmlabs::NetworkConnection::socket, and cmlabs::utils::WaitForSocketReadability().

◆ reconnect()

bool cmlabs::SSLConnection::reconnect ( uint32 timeoutMS)
virtual

Reconnect and re-handshake to the previous endpoint.

Parameters
timeoutMSTimeout in ms.
Returns
true on success.

Implements cmlabs::NetworkConnection.

Definition at line 2516 of file NetworkConnections.cpp.

References connect(), disconnect(), cmlabs::NetworkConnection::receiver, and cmlabs::NetworkConnection::remoteAddress.

◆ send()

bool cmlabs::SSLConnection::send ( const char * data,
uint32 size,
uint64 receiver = 0 )
virtual

◆ setAllowSelfSigned()

void cmlabs::SSLConnection::setAllowSelfSigned ( bool allow)

Definition at line 1803 of file NetworkConnections.cpp.

References allowSelfSigned.

Referenced by cmlabs::NetworkChannel::applySSLClientPolicy().

◆ setCALocation()

void cmlabs::SSLConnection::setCALocation ( const char * caFile,
const char * caPath )

Definition at line 1790 of file NetworkConnections.cpp.

References caFile, and caPath.

Referenced by cmlabs::NetworkChannel::applySSLClientPolicy().

◆ SetDefaultAllowSelfSigned()

void cmlabs::SSLConnection::SetDefaultAllowSelfSigned ( bool allow)
static

Definition at line 1772 of file NetworkConnections.cpp.

References DefaultAllowSelfSigned.

◆ SetDefaultCALocation()

void cmlabs::SSLConnection::SetDefaultCALocation ( const char * caFile,
const char * caPath )
static

Definition at line 1785 of file NetworkConnections.cpp.

References caFile, caPath, DefaultCAFile, and DefaultCAPath.

◆ setVerifyHostName()

void cmlabs::SSLConnection::setVerifyHostName ( const char * host)

Definition at line 1799 of file NetworkConnections.cpp.

References verifyHostName.

◆ SSLConnectionRun

Member Data Documentation

◆ allowSelfSigned

bool cmlabs::SSLConnection::allowSelfSigned
protected

◆ caFile

std::string cmlabs::SSLConnection::caFile
protected

Definition at line 874 of file NetworkConnections.h.

Referenced by setCALocation(), SetDefaultCALocation(), and SSLConnection().

◆ caPath

std::string cmlabs::SSLConnection::caPath
protected

Definition at line 875 of file NetworkConnections.h.

Referenced by setCALocation(), SetDefaultCALocation(), and SSLConnection().

◆ certinfo

std::string cmlabs::SSLConnection::certinfo

Human-readable summary of the peer certificate (subject/issuer), filled after handshake.

Definition at line 867 of file NetworkConnections.h.

Referenced by connect().

◆ DefaultAllowSelfSigned

bool cmlabs::SSLConnection::DefaultAllowSelfSigned = false
staticprotected

◆ DefaultCAFile

std::string cmlabs::SSLConnection::DefaultCAFile
staticprotected

Definition at line 876 of file NetworkConnections.h.

Referenced by SetDefaultCALocation(), and SSLConnection().

◆ DefaultCAPath

std::string cmlabs::SSLConnection::DefaultCAPath
staticprotected

Definition at line 877 of file NetworkConnections.h.

Referenced by SetDefaultCALocation(), and SSLConnection().

◆ verifyHostName

std::string cmlabs::SSLConnection::verifyHostName
protected

The documentation for this class was generated from the following files: