1 ! Copyright (C) 2008 Slava Pestov.
2 ! See http://factorcode.org/license.txt for BSD license.
3 USING: accessors kernel symbols namespaces continuations
4 destructors io.sockets sequences summary calendar delegate
5 system vocabs.loader combinators present ;
8 SYMBOL: secure-socket-timeout
10 1 minutes secure-socket-timeout set-global
12 SYMBOL: secure-socket-backend
14 SINGLETONS: SSLv2 SSLv23 SSLv3 TLSv1 ;
25 : <secure-config> ( -- config )
28 1024 >>ephemeral-key-bits
29 "resource:basis/openssl/cacert.pem" >>ca-file
32 TUPLE: secure-context config handle disposed ;
34 HOOK: <secure-context> secure-socket-backend ( config -- context )
36 : with-secure-context ( config quot -- )
38 [ <secure-context> ] [ [ secure-context set ] prepose ] bi*
42 TUPLE: secure addrspec ;
46 M: secure present addrspec>> present " (secure)" append ;
48 CONSULT: inet secure addrspec>> ;
50 M: secure resolve-host ( secure -- seq )
51 addrspec>> resolve-host [ <secure> ] map ;
53 HOOK: check-certificate secure-socket-backend ( host handle -- )
57 PREDICATE: secure-inet < secure addrspec>> inet? ;
59 M: secure-inet (client)
61 [ resolve-host (client) [ |dispose ] dip ] keep
62 addrspec>> host>> pick handle>> check-certificate
67 ERROR: premature-close ;
69 M: premature-close summary
70 drop "Connection closed prematurely - potential truncation attack" ;
72 ERROR: certificate-verify-error result ;
74 M: certificate-verify-error summary
75 drop "Certificate verification failed" ;
77 ERROR: common-name-verify-error expected got ;
79 M: common-name-verify-error summary
80 drop "Common name verification failed" ;
83 { [ os unix? ] [ "io.unix.sockets.secure" require ] }
84 { [ os windows? ] [ "openssl" require ] }