苹果安全运输代码错误

Question

I have the following code of Apple Security API initialisation:

    OSStatus status = noErr;
    sslContext = SSLCreateContext(kCFAllocatorDefault, kSSLClientSide, kSSLStreamType);
    if (sslContext == nullptr)
    {
        throw std::runtime_error("cannot create ssl context");
    }

    status = SSLSetIOFuncs(sslContext, socketRead, socketWrite);
    if (status != noErr)
    {
        throw std::runtime_error("cannot set ssl io functions");
    }

    status = SSLSetConnection(sslContext, reinterpret_cast<void*>(&handle));
    if (status != noErr)
    {
        throw std::runtime_error("cannot set ssl connections");
    }

    status = SSLSetPeerDomainName(sslContext, address.c_str(), address.length());
    if (status != noErr)
    {
        throw std::runtime_error("cannot set ssl peer domain name");
    }

    status = SSLSetSessionOption(sslContext, kSSLSessionOptionBreakOnServerAuth, true);
    if (status != noErr)
    {
        throw std::runtime_error("cannot set ssl options");
    }

    status = SSLHandshake(sslContext);
    if (status != noErr)
    {
        throw std::runtime_error("cannot perform ssl handshake");
    }

On this line:

status = SSLHandshake(sslContext);

my SSLWriteFunc callback is called. It tries to send 174 bytes (I didn't mean to send it) via SSLWrite but it fails anyway. But in documentation about SSLHandshake it is written "On successful return, the session is ready for normal secure communication using the functions SSLRead( : : : :) and SSLWrite( : : : :).". So in my case there was no return from this method and then my SSLWriteFunc suddenly tried to send data via SSLWrite. I just don't understand what I'm doing wrong. Please guys help me.

Answer 1

SSLRead() and SSLWrite() should be called from your application code, not from inside the SSLReadFunc and SSLWriteFunc callbacks.

In the SSLReadFunc and SSLWriteFunc callbacks, SecureTransport is asking you to receive/send data from your socket (which you set using SSLSetConnection ). So in SSLWriteFunc , you are being given encrypted data to send out over your socket. Your implementation of SSLWriteFunc should look something like:

OSStatus mySSLWriteFunc(SSLConnectionRef connection, const void *data, size_t *dataLength)
{
    int *handle;
    SSLGetConnection(connection, &handle);
    size_t result = write(*handle, data, *dataLength);
    if (result == -1)
    {
        if ((errno == EAGAIN) || (errno == EWOULDBLOCK))
            return errSSLWouldBlock;
        else
            // fill this in
    }
    else
    {
        *dataLength = result;
    }
    return noErr;
}

You'll want to add additional error handling to that (in case the socket closes, etc) but that should be the basic structure.