socket.hpp

Go to the documentation of this file.

 
#ifndef JOIN_CORE_SOCKET_HPP
#define JOIN_CORE_SOCKET_HPP
 
// libjoin.
#include <join/protocol.hpp>
#include <join/endpoint.hpp>
#include <join/openssl.hpp>
#include <join/utils.hpp>
#include <join/error.hpp>
 
// Libraries.
#include <openssl/err.h>
 
// C++.
#include <type_traits>
#include <iostream>
 
// C.
#include <netinet/tcp.h>
#include <linux/icmp.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <fnmatch.h>
#include <cassert>
#include <fcntl.h>
#include <poll.h>
 
namespace join
{
    template <class Protocol>
    class BasicSocket
    {
    public:
        using Ptr = std::unique_ptr<BasicSocket<Protocol>>;
        using Endpoint = typename Protocol::Endpoint;
 
        enum Mode
        {
            Blocking,    
            NonBlocking, 
        };
 
        enum Option
        {
            NoDelay,         
            KeepAlive,       
            KeepIdle,        
            KeepIntvl,       
            KeepCount,       
            SndBuffer,       
            RcvBuffer,       
            TimeStamp,       
            ReuseAddr,       
            ReusePort,       
            Broadcast,       
            Ttl,             
            MulticastLoop,   
            MulticastTtl,    
            PathMtuDiscover, 
            RcvError,        
            AuxData,         
        };
 
        enum State
        {
            Connecting,    
            Connected,     
            Disconnecting, 
            Disconnected,  
            Closed,        
        };
 
        BasicSocket ()
        : BasicSocket (Mode::NonBlocking)
        {
        }
 
        BasicSocket (Mode mode)
        : _mode (mode)
        {
        }
 
        BasicSocket (const BasicSocket& other) = delete;
 
        BasicSocket& operator= (const BasicSocket& other) = delete;
 
        BasicSocket (BasicSocket&& other)
        : _state (other._state)
        , _mode (other._mode)
        , _handle (other._handle)
        , _protocol (other._protocol)
        {
            other._state = State::Closed;
            other._mode = Mode::NonBlocking;
            other._handle = -1;
            other._protocol = Protocol ();
        }
 
        BasicSocket& operator= (BasicSocket&& other)
        {
            this->close ();
 
            this->_state = other._state;
            this->_mode = other._mode;
            this->_handle = other._handle;
            this->_protocol = other._protocol;
 
            other._state = State::Closed;
            other._mode = Mode::NonBlocking;
            other._handle = -1;
            other._protocol = Protocol ();
 
            return *this;
        }
 
        virtual ~BasicSocket ()
        {
            if (this->_handle != -1)
            {
                ::close (this->_handle);
            }
        }
 
        virtual int open (const Protocol& protocol = Protocol ()) noexcept
        {
            if (this->_state != State::Closed)
            {
                lastError = make_error_code (Errc::InUse);
                return -1;
            }
 
            if (this->_mode == Mode::NonBlocking)
                this->_handle = ::socket (protocol.family (), protocol.type () | SOCK_NONBLOCK, protocol.protocol ());
            else
                this->_handle = ::socket (protocol.family (), protocol.type (), protocol.protocol ());
 
            if (this->_handle == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                this->close ();
                return -1;
            }
 
            this->_state = State::Disconnected;
            this->_protocol = protocol;
 
            return 0;
        }
 
        virtual void close () noexcept
        {
            if (this->_state != State::Closed)
            {
                ::close (this->_handle);
                this->_state = State::Closed;
                this->_handle = -1;
            }
        }
 
        virtual int bind (const Endpoint& endpoint) noexcept
        {
            if ((this->_state == State::Closed) && (this->open (endpoint.protocol ()) == -1))
            {
                return -1;
            }
 
            if (endpoint.protocol ().family () == AF_PACKET)
            {
                if (reinterpret_cast<const struct sockaddr_ll*> (endpoint.addr ())->sll_ifindex == 0)
                {
                    lastError = std::make_error_code (std::errc::no_such_device);
                    return -1;
                }
            }
            else if ((endpoint.protocol ().family () == AF_INET6) || (endpoint.protocol ().family () == AF_INET))
            {
                this->setOption (Option::ReuseAddr, 1);
            }
            else if (endpoint.protocol ().family () == AF_UNIX)
            {
                ::unlink (endpoint.device ().c_str ());
            }
 
            if (::bind (this->_handle, endpoint.addr (), endpoint.length ()) == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return 0;
        }
 
        virtual int canRead () const noexcept
        {
            int available = 0;
 
            // check if data can be read in the socket internal buffer.
            if (::ioctl (this->_handle, FIONREAD, &available) == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return available;
        }
 
        virtual bool waitReadyRead (int timeout = 0) const noexcept
        {
            return (this->wait (true, false, timeout) == 0);
        }
 
        virtual int read (char* data, unsigned long maxSize) noexcept
        {
            struct iovec iov;
            iov.iov_base = data;
            iov.iov_len = maxSize;
 
            struct msghdr message;
            message.msg_name = nullptr;
            message.msg_namelen = 0;
            message.msg_iov = &iov;
            message.msg_iovlen = 1;
            message.msg_control = nullptr;
            message.msg_controllen = 0;
 
            int size = ::recvmsg (this->_handle, &message, 0);
            if (size < 1)
            {
                if (size == -1)
                {
                    lastError = std::error_code (errno, std::generic_category ());
                }
                else
                {
                    lastError = make_error_code (Errc::ConnectionClosed);
                }
                return -1;
            }
 
            return size;
        }
 
        virtual bool waitReadyWrite (int timeout = 0) const noexcept
        {
            return (this->wait (false, true, timeout) == 0);
        }
 
        virtual int write (const char* data, unsigned long maxSize) noexcept
        {
            struct iovec iov;
            iov.iov_base = const_cast<char*> (data);
            iov.iov_len = maxSize;
 
            struct msghdr message;
            message.msg_name = nullptr;
            message.msg_namelen = 0;
            message.msg_iov = &iov;
            message.msg_iovlen = 1;
            message.msg_control = nullptr;
            message.msg_controllen = 0;
 
            int result = ::sendmsg (this->_handle, &message, 0);
            if (result == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return result;
        }
 
        void setMode (Mode mode) noexcept
        {
            this->_mode = mode;
 
            if (this->_state != State::Closed)
            {
                int flags = ::fcntl (this->_handle, F_GETFL, 0);
 
                if (this->_mode == Mode::NonBlocking)
                {
                    flags = flags | O_NONBLOCK;
                }
                else
                {
                    flags = flags & ~O_NONBLOCK;
                }
 
                ::fcntl (this->_handle, F_SETFL, flags);
            }
        }
 
        virtual int setOption (Option option, int value) noexcept
        {
            int optlevel, optname;
 
            switch (option)
            {
                case Option::KeepAlive:
                    optlevel = SOL_SOCKET;
                    optname = SO_KEEPALIVE;
                    break;
 
                case Option::SndBuffer:
                    optlevel = SOL_SOCKET;
                    optname = SO_SNDBUF;
                    break;
 
                case Option::RcvBuffer:
                    optlevel = SOL_SOCKET;
                    optname = SO_RCVBUF;
                    break;
 
                case Option::TimeStamp:
                    optlevel = SOL_SOCKET;
                    optname = SO_TIMESTAMP;
                    break;
 
                case Option::ReuseAddr:
                    optlevel = SOL_SOCKET;
                    optname = SO_REUSEADDR;
                    break;
 
                case Option::ReusePort:
                    optlevel = SOL_SOCKET;
                    optname = SO_REUSEPORT;
                    break;
 
                case Option::Broadcast:
                    optlevel = SOL_SOCKET;
                    optname = SO_BROADCAST;
                    break;
 
                case Option::AuxData:
                    optlevel = SOL_PACKET;
                    optname = PACKET_AUXDATA;
                    break;
 
                default:
                    lastError = make_error_code (Errc::InvalidParam);
                    return -1;
            }
 
            int result = ::setsockopt (this->_handle, optlevel, optname, &value, sizeof (value));
            if (result == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return 0;
        }
 
        Endpoint localEndpoint () const noexcept
        {
            struct sockaddr_storage sa;
            socklen_t sa_len = sizeof (struct sockaddr_storage);
 
            if (::getsockname (this->_handle, reinterpret_cast<struct sockaddr*> (&sa), &sa_len) == -1)
            {
                return {};
            }
 
            return Endpoint (reinterpret_cast<struct sockaddr*> (&sa), sa_len);
        }
 
        bool opened () const noexcept
        {
            return (this->_state != State::Closed);
        }
 
        virtual bool encrypted () const noexcept
        {
            return false;
        }
 
        int family () const noexcept
        {
            return this->_protocol.family ();
        }
 
        int type () const noexcept
        {
            return this->_protocol.type ();
        }
 
        int protocol () const noexcept
        {
            return this->_protocol.protocol ();
        }
 
        int handle () const noexcept
        {
            return this->_handle;
        }
 
        static uint16_t checksum (const uint16_t* data, size_t len, uint16_t current = 0)
        {
            uint32_t sum = current;
 
            while (len > 1)
            {
                sum += *data++;
                len -= 2;
            }
 
            if (len == 1)
            {
#if __BYTE_ORDER == __LITTLE_ENDIAN
                sum += *reinterpret_cast<const uint8_t*> (data);
#else
                sum += *reinterpret_cast<const uint8_t*> (data) << 8;
#endif
            }
 
            sum = (sum >> 16) + (sum & 0xffff);
            sum += (sum >> 16);
 
            return static_cast<uint16_t> (~sum);
        }
 
    protected:
        int wait (bool wantRead, bool wantWrite, int timeout) const noexcept
        {
            struct pollfd handle = {.fd = this->_handle, .events = 0, .revents = 0};
 
            if (wantRead)
            {
                handle.events |= POLLIN;
            }
 
            if (wantWrite)
            {
                handle.events |= POLLOUT;
            }
 
            int nset = (handle.fd > -1) ? ::poll (&handle, 1, timeout == 0 ? -1 : timeout) : -1;
            if (nset != 1)
            {
                if (nset == -1)
                {
                    if (handle.fd == -1)
                    {
                        errno = EBADF;
                    }
                    lastError = std::error_code (errno, std::generic_category ());
                }
                else
                {
                    lastError = make_error_code (Errc::TimedOut);
                }
 
                return -1;
            }
 
            return 0;
        }
 
        State _state = State::Closed;
 
        Mode _mode = Mode::NonBlocking;
 
        int _handle = -1;
 
        Protocol _protocol;
    };
 
    template <class Protocol>
    constexpr bool operator< (const BasicSocket<Protocol>& a, const BasicSocket<Protocol>& b) noexcept
    {
        return a.handle () < b.handle ();
    }
 
    template <class Protocol>
    class BasicDatagramSocket : public BasicSocket<Protocol>
    {
    public:
        using Ptr = std::unique_ptr<BasicDatagramSocket<Protocol>>;
        using Mode = typename BasicSocket<Protocol>::Mode;
        using Option = typename BasicSocket<Protocol>::Option;
        using State = typename BasicSocket<Protocol>::State;
        using Endpoint = typename Protocol::Endpoint;
 
        BasicDatagramSocket (int ttl = 60)
        : BasicDatagramSocket (Mode::NonBlocking, ttl)
        {
        }
 
        BasicDatagramSocket (Mode mode, int ttl = 60)
        : BasicSocket<Protocol> (mode)
        , _ttl (ttl)
        {
        }
 
        BasicDatagramSocket (const BasicDatagramSocket& other) = delete;
 
        BasicDatagramSocket& operator= (const BasicDatagramSocket& other) = delete;
 
        BasicDatagramSocket (BasicDatagramSocket&& other)
        : BasicSocket<Protocol> (std::move (other))
        , _remote (std::move (other._remote))
        , _ttl (other._ttl)
        {
            other._ttl = 60;
        }
 
        BasicDatagramSocket& operator= (BasicDatagramSocket&& other)
        {
            BasicSocket<Protocol>::operator= (std::move (other));
 
            _remote = std::move (other._remote);
            _ttl = other._ttl;
 
            other._ttl = 60;
 
            return *this;
        }
 
        virtual ~BasicDatagramSocket () = default;
 
        virtual int open (const Protocol& protocol = Protocol ()) noexcept override
        {
            int result = BasicSocket<Protocol>::open (protocol);
            if (result == -1)
            {
                return -1;
            }
 
            int off = 0;
 
            if ((protocol.protocol () == IPPROTO_UDP) || (protocol.protocol () == IPPROTO_TCP))
            {
                if ((protocol.family () == AF_INET6) &&
                    (::setsockopt (this->_handle, IPPROTO_IPV6, IPV6_V6ONLY, &off, sizeof (off)) == -1))
                {
                    lastError = std::error_code (errno, std::generic_category ());
                    this->close ();
                    return -1;
                }
            }
 
            if ((protocol.protocol () == IPPROTO_ICMPV6) || (protocol.protocol () == IPPROTO_ICMP))
            {
                if ((protocol.family () == AF_INET) &&
                    (::setsockopt (this->_handle, IPPROTO_IP, IP_HDRINCL, &off, sizeof (off)) == -1))
                {
                    lastError = std::error_code (errno, std::generic_category ());
                    this->close ();
                    return -1;
                }
 
                this->setOption (Option::MulticastTtl, this->_ttl);
                this->setOption (Option::Ttl, this->_ttl);
            }
 
            return 0;
        }
 
        virtual int bindToDevice (const std::string& device) noexcept
        {
            if (this->_state == State::Closed)
            {
                lastError = make_error_code (Errc::ConnectionClosed);
                return -1;
            }
 
            if (this->_state == State::Connected)
            {
                lastError = make_error_code (Errc::InUse);
                return -1;
            }
 
            if ((this->_protocol.family () == AF_INET6) || (this->_protocol.family () == AF_INET))
            {
                this->setOption (Option::ReuseAddr, 1);
            }
 
            int result = setsockopt (this->_handle, SOL_SOCKET, SO_BINDTODEVICE, device.c_str (), device.size ());
            if (result == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return 0;
        }
 
        virtual int connect (const Endpoint& endpoint)
        {
            if ((this->_state != State::Closed) && (this->_state != State::Disconnected))
            {
                lastError = make_error_code (Errc::InUse);
                return -1;
            }
 
            if ((this->_state == State::Closed) && (this->open (endpoint.protocol ()) == -1))
            {
                return -1;
            }
 
            int result = ::connect (this->_handle, endpoint.addr (), endpoint.length ());
 
            this->_state = State::Connecting;
            this->_remote = endpoint;
 
            if (result == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                if (lastError != std::errc::operation_in_progress)
                {
                    this->close ();
                }
                return -1;
            }
 
            this->_state = State::Connected;
 
            return 0;
        }
 
        virtual int disconnect ()
        {
            if (this->_state == State::Connected)
            {
                struct sockaddr_storage nullAddr;
                ::memset (&nullAddr, 0, sizeof (nullAddr));
 
                nullAddr.ss_family = AF_UNSPEC;
 
                int result = ::connect (this->_handle, reinterpret_cast<struct sockaddr*> (&nullAddr),
                                        sizeof (struct sockaddr_storage));
                if (result == -1)
                {
                    if (errno != EAFNOSUPPORT)
                    {
                        lastError = std::error_code (errno, std::generic_category ());
                        return -1;
                    }
                }
 
                this->_state = State::Disconnected;
                this->_remote = {};
            }
 
            return 0;
        }
 
        virtual void close () noexcept override
        {
            BasicSocket<Protocol>::close ();
            this->_remote = {};
        }
 
        virtual int read (char* data, unsigned long maxSize) noexcept override
        {
            return BasicSocket<Protocol>::read (data, maxSize);
        }
 
        virtual int readFrom (char* data, unsigned long maxSize, Endpoint* endpoint = nullptr) noexcept
        {
            struct sockaddr_storage sa;
            socklen_t sa_len = sizeof (struct sockaddr_storage);
 
            int size = ::recvfrom (this->_handle, data, maxSize, 0, reinterpret_cast<struct sockaddr*> (&sa), &sa_len);
            if (size < 1)
            {
                if (size == -1)
                {
                    lastError = std::error_code (errno, std::generic_category ());
                }
                else
                {
                    lastError = make_error_code (Errc::ConnectionClosed);
                    this->_state = State::Disconnected;
                }
 
                return -1;
            }
 
            if (endpoint != nullptr)
            {
                *endpoint = Endpoint (reinterpret_cast<struct sockaddr*> (&sa), sa_len);
            }
 
            return size;
        }
 
        virtual int write (const char* data, unsigned long maxSize) noexcept override
        {
            return BasicSocket<Protocol>::write (data, maxSize);
        }
 
        virtual int writeTo (const char* data, unsigned long maxSize, const Endpoint& endpoint) noexcept
        {
            if ((this->_state == State::Closed) && (this->open (endpoint.protocol ()) == -1))
            {
                return -1;
            }
 
            int result = ::sendto (this->_handle, data, maxSize, 0, endpoint.addr (), endpoint.length ());
            if (result < 0)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return result;
        }
 
        virtual int setOption (Option option, int value) noexcept override
        {
            if (this->_state == State::Closed)
            {
                lastError = make_error_code (Errc::OperationFailed);
                return -1;
            }
 
            int optlevel, optname;
 
            switch (option)
            {
                case Option::Ttl:
                    if (this->family () == AF_INET6)
                    {
                        optlevel = IPPROTO_IPV6;
                        optname = IPV6_UNICAST_HOPS;
                    }
                    else
                    {
                        optlevel = IPPROTO_IP;
                        optname = IP_TTL;
                    }
                    break;
 
                case Option::MulticastLoop:
                    if (this->family () == AF_INET6)
                    {
                        optlevel = IPPROTO_IPV6;
                        optname = IPV6_MULTICAST_LOOP;
                    }
                    else
                    {
                        optlevel = IPPROTO_IP;
                        optname = IP_MULTICAST_LOOP;
                    }
                    break;
 
                case Option::MulticastTtl:
                    if (this->family () == AF_INET6)
                    {
                        optlevel = IPPROTO_IPV6;
                        optname = IPV6_MULTICAST_HOPS;
                    }
                    else
                    {
                        optlevel = IPPROTO_IP;
                        optname = IP_MULTICAST_TTL;
                    }
                    break;
 
                case Option::PathMtuDiscover:
                    if (this->family () == AF_INET6)
                    {
                        optlevel = IPPROTO_IPV6;
                        optname = IPV6_MTU_DISCOVER;
                    }
                    else
                    {
                        optlevel = IPPROTO_IP;
                        optname = IP_MTU_DISCOVER;
                    }
                    break;
 
                case Option::RcvError:
                    if (this->family () == AF_INET6)
                    {
                        optlevel = IPPROTO_IPV6;
                        optname = IPV6_RECVERR;
                    }
                    else
                    {
                        optlevel = IPPROTO_IP;
                        optname = IP_RECVERR;
                    }
                    break;
 
                default:
                    return BasicSocket<Protocol>::setOption (option, value);
            }
 
            int result = ::setsockopt (this->_handle, optlevel, optname, &value, sizeof (value));
            if (result == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return 0;
        }
 
        const Endpoint& remoteEndpoint () const noexcept
        {
            return this->_remote;
        }
 
        virtual bool connected () noexcept
        {
            return (this->_state == State::Connected);
        }
 
        int mtu () const
        {
            if (this->_state == State::Closed)
            {
                lastError = make_error_code (Errc::OperationFailed);
                return -1;
            }
 
            int result = -1, value = -1;
            socklen_t valueLen = sizeof (value);
 
            if (this->_protocol.family () == AF_INET6)
            {
                result = ::getsockopt (this->_handle, IPPROTO_IPV6, IPV6_MTU, &value, &valueLen);
            }
            else if (this->_protocol.family () == AF_INET)
            {
                result = ::getsockopt (this->_handle, IPPROTO_IP, IP_MTU, &value, &valueLen);
            }
            else
            {
                lastError = make_error_code (Errc::OperationFailed);
                return -1;
            }
 
            if (result == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return value;
        }
 
        int ttl () const noexcept
        {
            return this->_ttl;
        }
 
    protected:
        Endpoint _remote;
 
        int _ttl = 60;
    };
 
    template <class Protocol>
    constexpr bool operator< (const BasicDatagramSocket<Protocol>& a, const BasicDatagramSocket<Protocol>& b) noexcept
    {
        return a.handle () < b.handle ();
    }
 
    template <class Protocol>
    class BasicStreamSocket : public BasicDatagramSocket<Protocol>
    {
    public:
        using Ptr = std::unique_ptr<BasicStreamSocket<Protocol>>;
        using Mode = typename BasicDatagramSocket<Protocol>::Mode;
        using Option = typename BasicDatagramSocket<Protocol>::Option;
        using State = typename BasicDatagramSocket<Protocol>::State;
        using Endpoint = typename Protocol::Endpoint;
 
        BasicStreamSocket ()
        : BasicStreamSocket (Mode::NonBlocking)
        {
        }
 
        BasicStreamSocket (Mode mode)
        : BasicDatagramSocket<Protocol> (mode)
        {
        }
 
        BasicStreamSocket (const BasicStreamSocket& other) = delete;
 
        BasicStreamSocket& operator= (const BasicStreamSocket& other) = delete;
 
        BasicStreamSocket (BasicStreamSocket&& other)
        : BasicDatagramSocket<Protocol> (std::move (other))
        {
        }
 
        BasicStreamSocket& operator= (BasicStreamSocket&& other)
        {
            BasicDatagramSocket<Protocol>::operator= (std::move (other));
 
            return *this;
        }
 
        virtual ~BasicStreamSocket () = default;
 
        virtual bool waitConnected (int timeout = 0)
        {
            if (this->_state != State::Connected)
            {
                if (this->_state != State::Connecting)
                {
                    lastError = make_error_code (Errc::OperationFailed);
                    return false;
                }
 
                if (!this->waitReadyWrite (timeout))
                {
                    return false;
                }
 
                return connected ();
            }
 
            return true;
        }
 
        virtual int disconnect () override
        {
            if (this->_state == State::Connected)
            {
                ::shutdown (this->_handle, SHUT_WR);
                this->_state = State::Disconnecting;
            }
 
            if (this->_state == State::Disconnecting)
            {
                char buffer[4096];
                // closing before reading can make the client
                // not see all of our output.
                // we have to do a "lingering close"
                for (;;)
                {
                    int result = this->read (buffer, sizeof (buffer));
                    if (result <= 0)
                    {
                        if ((result == -1) && (lastError == Errc::TemporaryError))
                        {
                            return -1;
                        }
 
                        break;
                    }
                }
 
                ::shutdown (this->_handle, SHUT_RD);
                this->_state = State::Disconnected;
            }
 
            this->close ();
 
            return 0;
        }
 
        virtual bool waitDisconnected (int timeout = 0)
        {
            if ((this->_state != State::Disconnected) && (this->_state != State::Closed))
            {
                if (this->_state != State::Disconnecting)
                {
                    lastError = make_error_code (Errc::OperationFailed);
                    return false;
                }
 
                auto start = std::chrono::steady_clock::now ();
                int elapsed = 0;
 
                while ((lastError == Errc::TemporaryError) && (elapsed <= timeout))
                {
                    if (!this->waitReadyRead (timeout - elapsed))
                    {
                        return false;
                    }
 
                    if (this->disconnect () == 0)
                    {
                        return true;
                    }
 
                    if (timeout)
                    {
                        elapsed = std::chrono::duration_cast<std::chrono::milliseconds> (
                                      std::chrono::steady_clock::now () - start)
                                      .count ();
                    }
                }
 
                return false;
            }
 
            return true;
        }
 
        int readExactly (char* data, unsigned long size, int timeout = 0)
        {
            unsigned long numRead = 0;
 
            while (numRead < size)
            {
                int result = this->read (data + numRead, size - numRead);
                if (result == -1)
                {
                    if (lastError == Errc::TemporaryError)
                    {
                        if (this->waitReadyRead (timeout))
                            continue;
                    }
 
                    return -1;
                }
 
                numRead += result;
            }
 
            return 0;
        }
 
        int readExactly (std::string& data, unsigned long size, int timeout = 0)
        {
            data.resize (size);
            return readExactly (&data[0], size, timeout);
        }
 
        int writeExactly (const char* data, unsigned long size, int timeout = 0)
        {
            unsigned long numWrite = 0;
 
            while (numWrite < size)
            {
                int result = this->write (data + numWrite, size - numWrite);
                if (result == -1)
                {
                    if (lastError == Errc::TemporaryError)
                    {
                        if (this->waitReadyWrite (timeout))
                            continue;
                    }
 
                    return -1;
                }
 
                numWrite += result;
            }
 
            return 0;
        }
 
        virtual int setOption (Option option, int value) noexcept override
        {
            if (this->_state == State::Closed)
            {
                lastError = make_error_code (Errc::OperationFailed);
                return -1;
            }
 
            int optlevel, optname;
 
            switch (option)
            {
                case Option::NoDelay:
                    optlevel = IPPROTO_TCP;
                    optname = TCP_NODELAY;
                    break;
 
                case Option::KeepIdle:
                    optlevel = IPPROTO_TCP;
                    optname = TCP_KEEPIDLE;
                    break;
 
                case Option::KeepIntvl:
                    optlevel = IPPROTO_TCP;
                    optname = TCP_KEEPINTVL;
                    break;
 
                case Option::KeepCount:
                    optlevel = IPPROTO_TCP;
                    optname = TCP_KEEPCNT;
                    break;
 
                default:
                    return BasicDatagramSocket<Protocol>::setOption (option, value);
            }
 
            int result = ::setsockopt (this->_handle, optlevel, optname, &value, sizeof (value));
            if (result == -1)
            {
                lastError = std::error_code (errno, std::generic_category ());
                return -1;
            }
 
            return 0;
        }
 
        virtual bool connecting () const noexcept
        {
            return (this->_state == State::Connecting);
        }
 
        virtual bool connected () noexcept override
        {
            if (this->_state == State::Connected)
            {
                return true;
            }
            else if (this->_state != State::Connecting)
            {
                return false;
            }
 
            int optval;
            socklen_t optlen = sizeof (optval);
 
            int result = ::getsockopt (this->_handle, SOL_SOCKET, SO_ERROR, &optval, &optlen);
            if ((result == -1) || (optval != 0))
            {
                return false;
            }
 
            this->_state = State::Connected;
 
            return true;
        }
 
        friend class BasicStreamAcceptor<Protocol>;
    };
 
    template <class Protocol>
    constexpr bool operator< (const BasicStreamSocket<Protocol>& a, const BasicStreamSocket<Protocol>& b) noexcept
    {
        return a.handle () < b.handle ();
    }
 
    enum class TlsErrc
    {
        TlsCloseNotifyAlert = 1, 
        TlsProtocolError         
    };
 
    class TlsCategory : public std::error_category
    {
    public:
        virtual const char* name () const noexcept;
 
        virtual std::string message (int code) const;
    };
 
    const std::error_category& getTlsCategory ();
 
    std::error_code make_error_code (TlsErrc code);
 
    std::error_condition make_error_condition (TlsErrc code);
 
    template <class Protocol>
    class BasicTlsSocket : public BasicStreamSocket<Protocol>
    {
    public:
        using Ptr = std::unique_ptr<BasicTlsSocket<Protocol>>;
        using Mode = typename BasicStreamSocket<Protocol>::Mode;
        using Option = typename BasicStreamSocket<Protocol>::Option;
        using State = typename BasicStreamSocket<Protocol>::State;
        using Endpoint = typename Protocol::Endpoint;
 
        BasicTlsSocket ()
        : BasicTlsSocket (Mode::NonBlocking)
        {
        }
 
        BasicTlsSocket (Mode mode)
        : BasicStreamSocket<Protocol> (mode)
        , _tlsContext (SSL_CTX_new (TLS_client_method ()))
        {
            // enable the OpenSSL bug workaround options.
            SSL_CTX_set_options (this->_tlsContext.get (), SSL_OP_ALL);
 
            // disallow compression.
            SSL_CTX_set_options (this->_tlsContext.get (), SSL_OP_NO_COMPRESSION);
 
            // disallow usage of SSLv2, SSLv3, TLSv1 and TLSv1.1 which are considered insecure.
            SSL_CTX_set_options (this->_tlsContext.get (),
                                 SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1);
 
            // setup write mode.
            SSL_CTX_set_mode (this->_tlsContext.get (),
                              SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 
            // automatically renegotiates.
            SSL_CTX_set_mode (this->_tlsContext.get (), SSL_MODE_AUTO_RETRY);
 
            // set session cache mode to client by default.
            SSL_CTX_set_session_cache_mode (this->_tlsContext.get (), SSL_SESS_CACHE_CLIENT);
 
            // no verification by default.
            SSL_CTX_set_verify (this->_tlsContext.get (), SSL_VERIFY_NONE, nullptr);
 
            // set default TLSv1.2 and below cipher suites.
            SSL_CTX_set_cipher_list (this->_tlsContext.get (), join::defaultCipher.c_str ());
 
            // set default TLSv1.3 cipher suites.
            SSL_CTX_set_ciphersuites (this->_tlsContext.get (), join::defaultCipher_1_3.c_str ());
        }
 
        BasicTlsSocket (join::SslCtxPtr tlsContext)
        : BasicTlsSocket (Mode::NonBlocking, std::move (tlsContext))
        {
        }
 
        BasicTlsSocket (Mode mode, join::SslCtxPtr tlsContext)
        : BasicStreamSocket<Protocol> (mode)
        , _tlsContext (std::move (tlsContext))
        {
            if (this->_tlsContext == nullptr)
            {
                throw std::invalid_argument ("OpenSSL context is invalid");
            }
        }
 
        BasicTlsSocket (const BasicTlsSocket& other) = delete;
 
        BasicTlsSocket& operator= (const BasicTlsSocket& other) = delete;
 
        BasicTlsSocket (BasicTlsSocket&& other)
        : BasicStreamSocket<Protocol> (std::move (other))
        , _tlsContext (std::move (other._tlsContext))
        , _tlsHandle (std::move (other._tlsHandle))
        , _tlsState (other._tlsState)
        {
            if (this->_tlsHandle)
            {
                SSL_set_app_data (this->_tlsHandle.get (), this);
            }
 
            other._tlsState = TlsState::NonEncrypted;
        }
 
        BasicTlsSocket& operator= (BasicTlsSocket&& other)
        {
            BasicStreamSocket<Protocol>::operator= (std::move (other));
 
            this->_tlsContext = std::move (other._tlsContext);
            this->_tlsHandle = std::move (other._tlsHandle);
            this->_tlsState = other._tlsState;
 
            if (this->_tlsHandle)
            {
                SSL_set_app_data (this->_tlsHandle.get (), this);
            }
 
            other._tlsState = TlsState::NonEncrypted;
 
            return *this;
        }
 
        virtual ~BasicTlsSocket () = default;
 
        virtual int connectEncrypted (const Endpoint& endpoint)
        {
            if (this->connect (endpoint) == -1)
            {
                return -1;
            }
 
            if (this->startEncryption () == -1)
            {
                if (lastError != Errc::TemporaryError)
                {
                    this->close ();
                }
                return -1;
            }
 
            return 0;
        }
 
        int startEncryption ()
        {
            if (this->encrypted () == false)
            {
                this->_tlsHandle.reset (SSL_new (this->_tlsContext.get ()));
                if (this->_tlsHandle == nullptr)
                {
                    lastError = make_error_code (Errc::OutOfMemory);
                    return -1;
                }
 
                if (SSL_set_fd (this->_tlsHandle.get (), this->_handle) != 1)
                {
                    lastError = make_error_code (Errc::InvalidParam);
                    this->_tlsHandle.reset ();
                    return -1;
                }
 
                if (SSL_is_server (this->_tlsHandle.get ()) == 0)
                {
                    if (!this->_remote.hostname ().empty () &&
                        (SSL_set_tlsext_host_name (this->_tlsHandle.get (), this->_remote.hostname ().c_str ()) != 1))
                    {
                        lastError = make_error_code (Errc::InvalidParam);
                        this->_tlsHandle.reset ();
                        return -1;
                    }
 
                    SSL_set_connect_state (this->_tlsHandle.get ());
                }
                else
                {
                    SSL_set_accept_state (this->_tlsHandle.get ());
                }
 
                SSL_set_app_data (this->_tlsHandle.get (), this);
 
#ifdef DEBUG
                SSL_set_info_callback (this->_tlsHandle.get (), infoWrapper);
#endif
 
                return startHandshake ();
            }
 
            return 0;
        }
 
        virtual bool waitEncrypted (int timeout = 0)
        {
            if (this->encrypted () == false)
            {
                if (this->_state == State::Connecting)
                {
                    if (!this->waitConnected (timeout))
                    {
                        return false;
                    }
 
                    if (this->startEncryption () == 0)
                    {
                        return true;
                    }
                }
 
                while ((lastError == Errc::TemporaryError) &&
                       (SSL_want_read (this->_tlsHandle.get ()) || SSL_want_write (this->_tlsHandle.get ())))
                {
                    if (this->wait (SSL_want_read (this->_tlsHandle.get ()), SSL_want_write (this->_tlsHandle.get ()),
                                    timeout) == -1)
                    {
                        return false;
                    }
 
                    if (this->startHandshake () == 0)
                    {
                        return true;
                    }
                }
 
                return false;
            }
 
            return true;
        }
 
        virtual int disconnect () override
        {
            if (this->encrypted ())
            {
                // check if the close_notify alert was already sent.
                if ((SSL_get_shutdown (this->_tlsHandle.get ()) & SSL_SENT_SHUTDOWN) == false)
                {
                    // send the close_notify alert to the peer.
                    int result = SSL_shutdown (this->_tlsHandle.get ());
                    if (result < 0)
                    {
                        // shutdown was not successful.
                        switch (SSL_get_error (this->_tlsHandle.get (), result))
                        {
                            case SSL_ERROR_WANT_READ:
                            case SSL_ERROR_WANT_WRITE:
                                // SSL_shutdown want read or want write.
                                lastError = make_error_code (Errc::TemporaryError);
                                break;
                            case SSL_ERROR_SYSCALL:
                                // an error occurred at the socket level.
                                switch (errno)
                                {
                                    case 0:
                                    case ECONNRESET:
                                    case EPIPE:
                                        lastError = make_error_code (Errc::ConnectionClosed);
                                        this->_tlsState = TlsState::NonEncrypted;
                                        this->_state = State::Disconnected;
                                        break;
                                    default:
                                        lastError = std::error_code (errno, std::generic_category ());
                                        break;
                                }
                                break;
                            default:
                                // SSL protocol error.
#ifdef DEBUG
                                std::cout << ERR_reason_error_string (ERR_get_error ()) << std::endl;
#endif
                                lastError = make_error_code (TlsErrc::TlsProtocolError);
                                break;
                        }
 
                        return -1;
                    }
                    else if (result == 1)
                    {
                        // shutdown was successfully completed.
                        // close_notify alert was sent and the peer's close_notify alert was received.
                        this->_tlsState = TlsState::NonEncrypted;
                    }
                    else
                    {
                        // shutdown is not yet finished.
                        // the close_notify was sent but the peer did not send it back yet.
                        // SSL_read must be called to do a bidirectional shutdown.
                    }
                }
            }
 
            return BasicStreamSocket<Protocol>::disconnect ();
        }
 
        virtual void close () noexcept override
        {
            BasicStreamSocket<Protocol>::close ();
            this->_tlsState = TlsState::NonEncrypted;
            this->_tlsHandle.reset ();
        }
 
        virtual bool waitReadyRead (int timeout = 0) const noexcept override
        {
            if (this->encrypted () &&
                (SSL_want_read (this->_tlsHandle.get ()) || SSL_want_write (this->_tlsHandle.get ())))
            {
                return (this->wait (SSL_want_read (this->_tlsHandle.get ()), SSL_want_write (this->_tlsHandle.get ()),
                                    timeout) == 0);
            }
 
            return BasicStreamSocket<Protocol>::waitReadyRead (timeout);
        }
 
        virtual int canRead () const noexcept override
        {
            if (this->encrypted ())
            {
                return SSL_pending (this->_tlsHandle.get ());
            }
 
            return BasicStreamSocket<Protocol>::canRead ();
        }
 
        virtual int read (char* data, unsigned long maxSize) noexcept override
        {
            if (this->encrypted ())
            {
                // read data.
                int result = SSL_read (this->_tlsHandle.get (), data, int (maxSize));
                if (result < 1)
                {
                    switch (SSL_get_error (this->_tlsHandle.get (), result))
                    {
                        case SSL_ERROR_WANT_READ:
                        case SSL_ERROR_WANT_WRITE:
                        case SSL_ERROR_WANT_X509_LOOKUP:
                            // SSL_read want read, want write or want lookup.
                            lastError = make_error_code (Errc::TemporaryError);
                            break;
                        case SSL_ERROR_ZERO_RETURN:
                            // a close notify alert was received.
                            // we have to answer by sending a close notify alert too.
                            lastError = make_error_code (TlsErrc::TlsCloseNotifyAlert);
                            if (SSL_get_shutdown (this->_tlsHandle.get ()) & SSL_SENT_SHUTDOWN)
                            {
                                this->_tlsState = TlsState::NonEncrypted;
                            }
                            break;
                        case SSL_ERROR_SYSCALL:
                            // an error occurred at the socket level.
                            switch (errno)
                            {
                                case 0:
                                case ECONNRESET:
                                case EPIPE:
                                    lastError = make_error_code (Errc::ConnectionClosed);
                                    this->_tlsState = TlsState::NonEncrypted;
                                    this->_state = State::Disconnected;
                                    break;
                                default:
                                    lastError = std::error_code (errno, std::generic_category ());
                                    break;
                            }
                            break;
                        default:
                            // SSL protocol error.
#ifdef DEBUG
                            std::cout << ERR_reason_error_string (ERR_get_error ()) << std::endl;
#endif
                            lastError = make_error_code (TlsErrc::TlsProtocolError);
                            break;
                    }
 
                    return -1;
                }
 
                return result;
            }
 
            return BasicStreamSocket<Protocol>::read (data, maxSize);
        }
 
        virtual bool waitReadyWrite (int timeout = 0) const noexcept override
        {
            if (this->encrypted () &&
                (SSL_want_read (this->_tlsHandle.get ()) || SSL_want_write (this->_tlsHandle.get ())))
            {
                return (this->wait (SSL_want_read (this->_tlsHandle.get ()), SSL_want_write (this->_tlsHandle.get ()),
                                    timeout) == 0);
            }
 
            return BasicStreamSocket<Protocol>::waitReadyWrite (timeout);
        }
 
        virtual int write (const char* data, unsigned long maxSize) noexcept override
        {
            if (this->encrypted ())
            {
                // write data.
                int result = SSL_write (this->_tlsHandle.get (), data, int (maxSize));
                if (result < 1)
                {
                    switch (SSL_get_error (this->_tlsHandle.get (), result))
                    {
                        case SSL_ERROR_WANT_READ:
                        case SSL_ERROR_WANT_WRITE:
                        case SSL_ERROR_WANT_X509_LOOKUP:
                            // SSL_write want read, want write or want lookup.
                            lastError = make_error_code (Errc::TemporaryError);
                            break;
                        case SSL_ERROR_ZERO_RETURN:
                            // a close notify alert was received.
                            // we have to answer by sending a close notify alert too.
                            lastError = make_error_code (TlsErrc::TlsCloseNotifyAlert);
                            if (SSL_get_shutdown (this->_tlsHandle.get ()) & SSL_SENT_SHUTDOWN)
                            {
                                this->_tlsState = TlsState::NonEncrypted;
                            }
                            break;
                        case SSL_ERROR_SYSCALL:
                            // an error occurred at the socket level.
                            switch (errno)
                            {
                                case 0:
                                case ECONNRESET:
                                case EPIPE:
                                    lastError = make_error_code (Errc::ConnectionClosed);
                                    this->_tlsState = TlsState::NonEncrypted;
                                    this->_state = State::Disconnected;
                                    break;
                                default:
                                    lastError = std::error_code (errno, std::generic_category ());
                                    break;
                            }
                            break;
                        default:
                            // SSL protocol error.
#ifdef DEBUG
                            std::cout << ERR_reason_error_string (ERR_get_error ()) << std::endl;
#endif
                            lastError = make_error_code (TlsErrc::TlsProtocolError);
                            break;
                    }
 
                    return -1;
                }
 
                return result;
            }
 
            return BasicStreamSocket<Protocol>::write (data, maxSize);
        }
 
        virtual bool encrypted () const noexcept override
        {
            return (this->_tlsState == TlsState::Encrypted);
        }
 
        int setCertificate (const std::string& cert, const std::string& key = "")
        {
            if (((this->_tlsHandle)
                     ? SSL_use_certificate_file (this->_tlsHandle.get (), cert.c_str (), SSL_FILETYPE_PEM)
                     : SSL_CTX_use_certificate_file (this->_tlsContext.get (), cert.c_str (), SSL_FILETYPE_PEM)) == 0)
            {
                lastError = make_error_code (Errc::InvalidParam);
                return -1;
            }
 
            if (key.size ())
            {
                if (((this->_tlsHandle)
                         ? SSL_use_PrivateKey_file (this->_tlsHandle.get (), key.c_str (), SSL_FILETYPE_PEM)
                         : SSL_CTX_use_PrivateKey_file (this->_tlsContext.get (), key.c_str (), SSL_FILETYPE_PEM)) == 0)
                {
                    lastError = make_error_code (Errc::InvalidParam);
                    return -1;
                }
            }
 
            if (((this->_tlsHandle) ? SSL_check_private_key (this->_tlsHandle.get ())
                                    : SSL_CTX_check_private_key (this->_tlsContext.get ())) == 0)
            {
                lastError = make_error_code (Errc::InvalidParam);
                return -1;
            }
 
            return 0;
        }
 
        int setCaPath (const std::string& caPath)
        {
            struct stat st;
            if (stat (caPath.c_str (), &st) != 0 || !S_ISDIR (st.st_mode) ||
                SSL_CTX_load_verify_locations (this->_tlsContext.get (), nullptr, caPath.c_str ()) == 0)
            {
                lastError = make_error_code (Errc::InvalidParam);
                return -1;
            }
 
            return 0;
        }
 
        int setCaFile (const std::string& caFile)
        {
            struct stat st;
            if (stat (caFile.c_str (), &st) != 0 || !S_ISREG (st.st_mode) ||
                SSL_CTX_load_verify_locations (this->_tlsContext.get (), caFile.c_str (), nullptr) == 0)
            {
                lastError = make_error_code (Errc::InvalidParam);
                return -1;
            }
 
            return 0;
        }
 
        void setVerify (bool verify, int depth = -1) noexcept
        {
            if (verify == true)
            {
                SSL_CTX_set_verify (this->_tlsContext.get (), SSL_VERIFY_PEER, verifyWrapper);
                SSL_CTX_set_verify_depth (this->_tlsContext.get (), depth);
            }
            else
            {
                SSL_CTX_set_verify (this->_tlsContext.get (), SSL_VERIFY_NONE, nullptr);
            }
        }
 
        int setCipher (const std::string& cipher)
        {
            if (((this->_tlsHandle) ? SSL_set_cipher_list (this->_tlsHandle.get (), cipher.c_str ())
                                    : SSL_CTX_set_cipher_list (this->_tlsContext.get (), cipher.c_str ())) == 0)
            {
                lastError = make_error_code (Errc::InvalidParam);
                return -1;
            }
 
            return 0;
        }
 
        int setCipher_1_3 (const std::string& cipher)
        {
            if (((this->_tlsHandle) ? SSL_set_ciphersuites (this->_tlsHandle.get (), cipher.c_str ())
                                    : SSL_CTX_set_ciphersuites (this->_tlsContext.get (), cipher.c_str ())) == 0)
            {
                lastError = make_error_code (Errc::InvalidParam);
                return -1;
            }
 
            return 0;
        }
 
        int setAlpnProtocols (const std::vector<std::string>& protocols)
        {
            std::vector<uint8_t> wire;
            wire.reserve (256);
 
            for (auto const& proto : protocols)
            {
                wire.push_back (static_cast<uint8_t> (proto.size ()));
                wire.insert (wire.end (), proto.begin (), proto.end ());
            }
 
            if (SSL_CTX_set_alpn_protos (this->_tlsContext.get (), wire.data (),
                                         static_cast<unsigned int> (wire.size ())) != 0)
            {
                lastError = make_error_code (Errc::InvalidParam);
                return -1;
            }
 
            return 0;
        }
 
    protected:
        enum TlsState
        {
            Encrypted,    
            NonEncrypted, 
        };
 
        int startHandshake ()
        {
            // start the SSL handshake.
            int result = SSL_do_handshake (this->_tlsHandle.get ());
            if (result < 1)
            {
                switch (SSL_get_error (this->_tlsHandle.get (), result))
                {
                    case SSL_ERROR_WANT_READ:
                    case SSL_ERROR_WANT_WRITE:
                    case SSL_ERROR_WANT_X509_LOOKUP:
                        // SSL_do_handshake want read or want write.
                        lastError = make_error_code (Errc::TemporaryError);
                        break;
                    case SSL_ERROR_ZERO_RETURN:
                        // a close notify alert was received.
                        // we have to answer by sending a close notify alert too.
                        lastError = make_error_code (TlsErrc::TlsCloseNotifyAlert);
                        break;
                    case SSL_ERROR_SYSCALL:
                        // an error occurred at the socket level.
                        switch (errno)
                        {
                            case 0:
                            case ECONNRESET:
                            case EPIPE:
                                lastError = make_error_code (Errc::ConnectionClosed);
                                this->_state = State::Disconnected;
                                break;
                            default:
                                lastError = std::error_code (errno, std::generic_category ());
                                break;
                        }
                        break;
                    default:
                        // SSL protocol error.
#ifdef DEBUG
                        std::cout << ERR_reason_error_string (ERR_get_error ()) << std::endl;
#endif
                        lastError = make_error_code (TlsErrc::TlsProtocolError);
                        break;
                }
 
                return -1;
            }
 
            this->_tlsState = TlsState::Encrypted;
 
            return 0;
        }
 
        static void infoWrapper (const SSL* ssl, int where, int ret)
        {
            assert (ssl);
            static_cast<BasicTlsSocket<Protocol>*> (SSL_get_app_data (ssl))->infoCallback (where, ret);
        }
 
        void infoCallback (int where, int ret) const
        {
            if (where & SSL_CB_ALERT)
            {
                std::cout << "SSL/TLS Alert ";
                (where & SSL_CB_READ) ? std::cout << "[read] " : std::cout << "[write] ";
                std::cout << SSL_alert_type_string_long (ret) << ":";
                std::cout << SSL_alert_desc_string_long (ret);
                std::cout << std::endl;
            }
            else if (where & SSL_CB_LOOP)
            {
                std::cout << "SSL/TLS State ";
                (SSL_in_connect_init (this->_tlsHandle.get ()))  ? std::cout << "[connect] "
                : (SSL_in_accept_init (this->_tlsHandle.get ())) ? std::cout << "[accept] "
                                                                 : std::cout << "[undefined] ";
                std::cout << SSL_state_string_long (this->_tlsHandle.get ());
                std::cout << std::endl;
            }
            else if (where & SSL_CB_HANDSHAKE_START)
            {
                std::cout << "SSL/TLS Handshake [Start] " << SSL_state_string_long (this->_tlsHandle.get ())
                          << std::endl;
            }
            else if (where & SSL_CB_HANDSHAKE_DONE)
            {
                std::cout << "SSL/TLS Handshake [Done] " << SSL_state_string_long (this->_tlsHandle.get ())
                          << std::endl;
                std::cout << SSL_CTX_sess_number (this->_tlsContext.get ()) << " items in the session cache"
                          << std::endl;
                std::cout << SSL_CTX_sess_connect (this->_tlsContext.get ()) << " client connects" << std::endl;
                std::cout << SSL_CTX_sess_connect_good (this->_tlsContext.get ()) << " client connects that finished"
                          << std::endl;
                std::cout << SSL_CTX_sess_connect_renegotiate (this->_tlsContext.get ())
                          << " client renegotiations requested" << std::endl;
                std::cout << SSL_CTX_sess_accept (this->_tlsContext.get ()) << " server connects" << std::endl;
                std::cout << SSL_CTX_sess_accept_good (this->_tlsContext.get ()) << " server connects that finished"
                          << std::endl;
                std::cout << SSL_CTX_sess_accept_renegotiate (this->_tlsContext.get ())
                          << " server renegotiations requested" << std::endl;
                std::cout << SSL_CTX_sess_hits (this->_tlsContext.get ()) << " session cache hits" << std::endl;
                std::cout << SSL_CTX_sess_cb_hits (this->_tlsContext.get ()) << " external session cache hits"
                          << std::endl;
                std::cout << SSL_CTX_sess_misses (this->_tlsContext.get ()) << " session cache misses" << std::endl;
                std::cout << SSL_CTX_sess_timeouts (this->_tlsContext.get ()) << " session cache timeouts" << std::endl;
                std::cout << "negotiated " << SSL_get_cipher (this->_tlsHandle.get ()) << " cipher suite" << std::endl;
            }
        }
 
        static int verifyWrapper (int preverified, X509_STORE_CTX* context)
        {
            SSL* ssl = static_cast<SSL*> (X509_STORE_CTX_get_ex_data (context, SSL_get_ex_data_X509_STORE_CTX_idx ()));
 
            assert (ssl);
            return static_cast<BasicTlsSocket<Protocol>*> (SSL_get_app_data (ssl))
                ->verifyCallback (preverified, context);
        }
 
        int verifyCallback (int preverified, X509_STORE_CTX* context) const
        {
            int maxDepth = SSL_get_verify_depth (this->_tlsHandle.get ());
            int dpth = X509_STORE_CTX_get_error_depth (context);
 
#ifdef DEBUG
            std::cout << "verification started at depth=" << dpth << std::endl;
#endif
 
            // catch a too long certificate chain.
            if ((maxDepth >= 0) && (dpth > maxDepth))
            {
                preverified = 0;
                X509_STORE_CTX_set_error (context, X509_V_ERR_CERT_CHAIN_TOO_LONG);
            }
 
            if (!preverified)
            {
#ifdef DEBUG
                std::cout << "verification failed at depth=" << dpth << " - "
                          << X509_verify_cert_error_string (X509_STORE_CTX_get_error (context)) << std::endl;
#endif
                return 0;
            }
 
            // check the certificate host name.
            if (!verifyCert (context))
            {
#ifdef DEBUG
                std::cout << "rejected by CERT at depth=" << dpth << std::endl;
#endif
                return 0;
            }
 
            // check the revocation list.
            /*if (!verifyCrl (context))
            {
            #ifdef DEBUG
                std::cout << "rejected by CRL at depth=" << dpth << std::endl;
            #endif
                return 0;
            }*/
 
            // check ocsp.
            /*if (!verifyOcsp (context))
            {
            #ifdef DEBUG
                std::cout << "rejected by OCSP at depth=" << dpth << std::endl;
            #endif
                return 0;
            }*/
 
#ifdef DEBUG
            std::cout << "certificate accepted at depth=" << dpth << std::endl;
#endif
 
            return 1;
        }
 
        int verifyCert (X509_STORE_CTX* context) const
        {
            int depth = X509_STORE_CTX_get_error_depth (context);
            X509* cert = X509_STORE_CTX_get_current_cert (context);
 
            char buf[256];
            X509_NAME_oneline (X509_get_subject_name (cert), buf, sizeof (buf));
#ifdef DEBUG
            std::cout << "subject=" << buf << std::endl;
#endif
 
            // check the certificate host name
            if (depth == 0)
            {
                // confirm a match between the hostname and the hostnames listed in the certificate.
                if (!checkHostName (cert))
                {
#ifdef DEBUG
                    std::cout << "no match for hostname in the certificate" << std::endl;
#endif
                    return 0;
                }
            }
 
            return 1;
        }
 
        bool checkHostName (X509* certificate) const
        {
            bool match = false;
 
            // get alternative names.
            join::StackOfGeneralNamePtr altnames (reinterpret_cast<STACK_OF (GENERAL_NAME)*> (
                X509_get_ext_d2i (certificate, NID_subject_alt_name, 0, 0)));
            if (altnames)
            {
                for (int i = 0; (i < sk_GENERAL_NAME_num (altnames.get ())) && !match; ++i)
                {
                    // get a handle to alternative name.
                    GENERAL_NAME* current_name = sk_GENERAL_NAME_value (altnames.get (), i);
 
                    if (current_name->type == GEN_DNS)
                    {
                        // get data and length.
                        const char* host = reinterpret_cast<const char*> (ASN1_STRING_get0_data (current_name->d.ia5));
                        size_t len = size_t (ASN1_STRING_length (current_name->d.ia5));
                        std::string pattern (host, host + len), serverName (this->_remote.hostname ());
 
                        // strip off trailing dots.
                        if (pattern.back () == '.')
                        {
                            pattern.pop_back ();
                        }
 
                        if (serverName.back () == '.')
                        {
                            serverName.pop_back ();
                        }
 
                        // compare to pattern.
                        if (fnmatch (pattern.c_str (), serverName.c_str (), 0) == 0)
                        {
                            // an alternative name matched the server hostname.
                            match = true;
                        }
                    }
                }
            }
 
            return match;
        }
 
        /*int verifyCrl ([[maybe_unused]]X509_STORE_CTX *context) const
        {
            return 1;
        }*/
 
        /*int verifyOcsp ([[maybe_unused]]X509_STORE_CTX *context) const
        {
            return 1;
        }*/
 
        join::SslCtxPtr _tlsContext;
 
        join::SslPtr _tlsHandle;
 
        TlsState _tlsState = TlsState::NonEncrypted;
 
        friend class BasicTlsAcceptor<Protocol>;
    };
 
    template <class Protocol>
    constexpr bool operator< (const BasicTlsSocket<Protocol>& a, const BasicTlsSocket<Protocol>& b) noexcept
    {
        return a.handle () < b.handle ();
    }
}
 
namespace std
{
    template <>
    struct is_error_condition_enum<join::TlsErrc> : public true_type
    {
    };
}
 
#endif