2017-10-18 09:41:44 +08:00
|
|
|
/*
|
2019-08-14 10:44:14 +01:00
|
|
|
* libwebsockets - small server side websockets and web server implementation
|
2017-10-18 09:41:44 +08:00
|
|
|
*
|
2021-06-16 07:08:50 +01:00
|
|
|
* Copyright (C) 2010 - 2021 Andy Green <andy@warmcat.com>
|
2017-10-18 09:41:44 +08:00
|
|
|
*
|
2019-08-14 10:44:14 +01:00
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
|
|
|
* of this software and associated documentation files (the "Software"), to
|
|
|
|
|
* deal in the Software without restriction, including without limitation the
|
|
|
|
|
* rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
|
|
|
|
|
* sell copies of the Software, and to permit persons to whom the Software is
|
|
|
|
|
* furnished to do so, subject to the following conditions:
|
2017-10-18 09:41:44 +08:00
|
|
|
*
|
2019-08-14 10:44:14 +01:00
|
|
|
* The above copyright notice and this permission notice shall be included in
|
|
|
|
|
* all copies or substantial portions of the Software.
|
2017-10-18 09:41:44 +08:00
|
|
|
*
|
2019-08-14 10:44:14 +01:00
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
|
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
|
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
|
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
|
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
|
|
|
|
* IN THE SOFTWARE.
|
2017-10-18 09:41:44 +08:00
|
|
|
*/
|
|
|
|
|
|
2019-08-15 10:49:52 +01:00
|
|
|
#include "private-lib-core.h"
|
2021-04-01 17:34:38 +01:00
|
|
|
#include "private-lib-tls-mbedtls.h"
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2021-05-21 14:32:21 +01:00
|
|
|
#if defined(LWS_WITH_TLS_JIT_TRUST)
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* We get called for each peer certificate that was provided in turn.
|
|
|
|
|
*
|
|
|
|
|
* Our job is just to collect the AKID and SKIDs into ssl->kid_chain, and walk
|
|
|
|
|
* later at verification result time if it failed.
|
|
|
|
|
*
|
|
|
|
|
* None of these should be trusted, even if a misconfigured server sends us
|
|
|
|
|
* his root CA.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
lws_mbedtls_client_verify_callback(SSL *ssl, mbedtls_x509_crt *x509)
|
|
|
|
|
{
|
|
|
|
|
union lws_tls_cert_info_results ci;
|
|
|
|
|
|
|
|
|
|
/* we reached the max we can hold? */
|
|
|
|
|
|
|
|
|
|
if (ssl->kid_chain.count == LWS_ARRAY_SIZE(ssl->kid_chain.akid))
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
/* if not, stash the SKID and AKID into the next kid slot */
|
|
|
|
|
|
|
|
|
|
if (!lws_tls_mbedtls_cert_info(x509, LWS_TLS_CERT_INFO_SUBJECT_KEY_ID,
|
|
|
|
|
&ci, 0))
|
|
|
|
|
lws_tls_kid_copy(&ci,
|
|
|
|
|
&ssl->kid_chain.skid[ssl->kid_chain.count]);
|
|
|
|
|
|
|
|
|
|
if (!lws_tls_mbedtls_cert_info(x509, LWS_TLS_CERT_INFO_AUTHORITY_KEY_ID,
|
|
|
|
|
&ci, 0))
|
|
|
|
|
lws_tls_kid_copy(&ci,
|
|
|
|
|
&ssl->kid_chain.akid[ssl->kid_chain.count]);
|
|
|
|
|
|
|
|
|
|
ssl->kid_chain.count++;
|
|
|
|
|
|
|
|
|
|
// lwsl_notice("%s: %u\n", __func__, ssl->kid_chain.count);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
|
2017-10-18 09:41:44 +08:00
|
|
|
int
|
|
|
|
|
lws_ssl_client_bio_create(struct lws *wsi)
|
|
|
|
|
{
|
|
|
|
|
char hostname[128], *p;
|
fakewsi: replace with smaller substructure
Currently we always reserve a fakewsi per pt so events that don't have a related actual
wsi, like vhost-protocol-init or vhost cert init via protocol callback can make callbacks
that look reasonable to user protocol handler code expecting a valid wsi every time.
This patch splits out stuff that user callbacks often unconditionally expect to be in
a wsi, like context pointer, vhost pointer etc into a substructure, which is composed
into struct lws at the top of it. Internal references (struct lws is opaque, so there
are only internal references) are all updated to go via the substructre, the compiler
should make that a NOP.
Helpers are added when fakewsi is used and referenced.
If not PLAT_FREERTOS, we continue to provide a full fakewsi in the pt as before,
although the helpers improve consistency by zeroing down the substructure. There is
a huge amount of user code out there over the last 10 years that did not always have
the minimal examples to follow, some of it does some unexpected things.
If it is PLAT_FREERTOS, that is a newer thing in lws and users have the benefit of
being able to follow the minimal examples' approach. For PLAT_FREERTOS we don't
reserve the fakewsi in the pt any more, saving around 800 bytes. The helpers then
create a struct lws_a (the substructure) on the stack, zero it down (but it is only
like 4 pointers) and prepare it with whatever we know like the context.
Then we cast it to a struct lws * and use it in the user protocol handler call.
In this case, the remainder of the struct lws is undefined. However the amount of
old protocol handlers that might touch things outside of the substructure in
PLAT_FREERTOS is very limited compared to legacy lws user code and the saving is
significant on constrained devices.
User handlers should not be touching everything in a wsi every time anyway, there
are several cases where there is no valid wsi to do the call with. Dereference of
things outside the substructure should only happen when the callback reason shows
there is a valid wsi bound to the activity (as in all the minimal examples).
2020-07-19 08:33:46 +01:00
|
|
|
const char *alpn_comma = wsi->a.context->tls.alpn_default;
|
2018-04-12 15:56:38 +08:00
|
|
|
struct alpn_ctx protos;
|
2021-10-02 13:50:35 +01:00
|
|
|
int fl = SSL_VERIFY_PEER;
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2019-11-20 10:24:48 +00:00
|
|
|
if (wsi->stash)
|
|
|
|
|
lws_strncpy(hostname, wsi->stash->cis[CIS_HOST], sizeof(hostname));
|
|
|
|
|
else
|
|
|
|
|
if (lws_hdr_copy(wsi, hostname, sizeof(hostname),
|
|
|
|
|
_WSI_TOKEN_CLIENT_HOST) <= 0) {
|
|
|
|
|
lwsl_err("%s: Unable to get hostname\n", __func__);
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2019-11-20 10:24:48 +00:00
|
|
|
return -1;
|
|
|
|
|
}
|
2017-10-18 09:41:44 +08:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* remove any :port part on the hostname... necessary for network
|
|
|
|
|
* connection but typical certificates do not contain it
|
|
|
|
|
*/
|
|
|
|
|
p = hostname;
|
|
|
|
|
while (*p) {
|
|
|
|
|
if (*p == ':') {
|
|
|
|
|
*p = '\0';
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
p++;
|
|
|
|
|
}
|
|
|
|
|
|
fakewsi: replace with smaller substructure
Currently we always reserve a fakewsi per pt so events that don't have a related actual
wsi, like vhost-protocol-init or vhost cert init via protocol callback can make callbacks
that look reasonable to user protocol handler code expecting a valid wsi every time.
This patch splits out stuff that user callbacks often unconditionally expect to be in
a wsi, like context pointer, vhost pointer etc into a substructure, which is composed
into struct lws at the top of it. Internal references (struct lws is opaque, so there
are only internal references) are all updated to go via the substructre, the compiler
should make that a NOP.
Helpers are added when fakewsi is used and referenced.
If not PLAT_FREERTOS, we continue to provide a full fakewsi in the pt as before,
although the helpers improve consistency by zeroing down the substructure. There is
a huge amount of user code out there over the last 10 years that did not always have
the minimal examples to follow, some of it does some unexpected things.
If it is PLAT_FREERTOS, that is a newer thing in lws and users have the benefit of
being able to follow the minimal examples' approach. For PLAT_FREERTOS we don't
reserve the fakewsi in the pt any more, saving around 800 bytes. The helpers then
create a struct lws_a (the substructure) on the stack, zero it down (but it is only
like 4 pointers) and prepare it with whatever we know like the context.
Then we cast it to a struct lws * and use it in the user protocol handler call.
In this case, the remainder of the struct lws is undefined. However the amount of
old protocol handlers that might touch things outside of the substructure in
PLAT_FREERTOS is very limited compared to legacy lws user code and the saving is
significant on constrained devices.
User handlers should not be touching everything in a wsi every time anyway, there
are several cases where there is no valid wsi to do the call with. Dereference of
things outside the substructure should only happen when the callback reason shows
there is a valid wsi bound to the activity (as in all the minimal examples).
2020-07-19 08:33:46 +01:00
|
|
|
wsi->tls.ssl = SSL_new(wsi->a.vhost->tls.ssl_client_ctx);
|
2019-01-11 13:13:34 +08:00
|
|
|
if (!wsi->tls.ssl) {
|
|
|
|
|
lwsl_info("%s: SSL_new() failed\n", __func__);
|
2017-10-18 09:41:44 +08:00
|
|
|
return -1;
|
2019-01-11 13:13:34 +08:00
|
|
|
}
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2021-04-01 17:34:38 +01:00
|
|
|
#if defined(LWS_WITH_TLS_SESSIONS)
|
|
|
|
|
if (!(wsi->a.vhost->options & LWS_SERVER_OPTION_DISABLE_TLS_SESSION_CACHE))
|
|
|
|
|
lws_tls_reuse_session(wsi);
|
|
|
|
|
#endif
|
|
|
|
|
|
fakewsi: replace with smaller substructure
Currently we always reserve a fakewsi per pt so events that don't have a related actual
wsi, like vhost-protocol-init or vhost cert init via protocol callback can make callbacks
that look reasonable to user protocol handler code expecting a valid wsi every time.
This patch splits out stuff that user callbacks often unconditionally expect to be in
a wsi, like context pointer, vhost pointer etc into a substructure, which is composed
into struct lws at the top of it. Internal references (struct lws is opaque, so there
are only internal references) are all updated to go via the substructre, the compiler
should make that a NOP.
Helpers are added when fakewsi is used and referenced.
If not PLAT_FREERTOS, we continue to provide a full fakewsi in the pt as before,
although the helpers improve consistency by zeroing down the substructure. There is
a huge amount of user code out there over the last 10 years that did not always have
the minimal examples to follow, some of it does some unexpected things.
If it is PLAT_FREERTOS, that is a newer thing in lws and users have the benefit of
being able to follow the minimal examples' approach. For PLAT_FREERTOS we don't
reserve the fakewsi in the pt any more, saving around 800 bytes. The helpers then
create a struct lws_a (the substructure) on the stack, zero it down (but it is only
like 4 pointers) and prepare it with whatever we know like the context.
Then we cast it to a struct lws * and use it in the user protocol handler call.
In this case, the remainder of the struct lws is undefined. However the amount of
old protocol handlers that might touch things outside of the substructure in
PLAT_FREERTOS is very limited compared to legacy lws user code and the saving is
significant on constrained devices.
User handlers should not be touching everything in a wsi every time anyway, there
are several cases where there is no valid wsi to do the call with. Dereference of
things outside the substructure should only happen when the callback reason shows
there is a valid wsi bound to the activity (as in all the minimal examples).
2020-07-19 08:33:46 +01:00
|
|
|
if (wsi->a.vhost->tls.ssl_info_event_mask)
|
2018-05-01 12:41:42 +08:00
|
|
|
SSL_set_info_callback(wsi->tls.ssl, lws_ssl_info_callback);
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2018-05-01 12:41:42 +08:00
|
|
|
if (!(wsi->tls.use_ssl & LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK)) {
|
2018-10-10 13:54:43 +08:00
|
|
|
X509_VERIFY_PARAM *param = SSL_get0_param(wsi->tls.ssl);
|
2017-10-18 09:41:44 +08:00
|
|
|
/* Enable automatic hostname checks */
|
|
|
|
|
// X509_VERIFY_PARAM_set_hostflags(param,
|
|
|
|
|
// X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
|
2021-10-02 13:50:35 +01:00
|
|
|
lwsl_info("%s: setting hostname %s\n", __func__, hostname);
|
|
|
|
|
if (X509_VERIFY_PARAM_set1_host(param, hostname, 0) != 1)
|
|
|
|
|
return -1;
|
2017-10-18 09:41:44 +08:00
|
|
|
}
|
|
|
|
|
|
fakewsi: replace with smaller substructure
Currently we always reserve a fakewsi per pt so events that don't have a related actual
wsi, like vhost-protocol-init or vhost cert init via protocol callback can make callbacks
that look reasonable to user protocol handler code expecting a valid wsi every time.
This patch splits out stuff that user callbacks often unconditionally expect to be in
a wsi, like context pointer, vhost pointer etc into a substructure, which is composed
into struct lws at the top of it. Internal references (struct lws is opaque, so there
are only internal references) are all updated to go via the substructre, the compiler
should make that a NOP.
Helpers are added when fakewsi is used and referenced.
If not PLAT_FREERTOS, we continue to provide a full fakewsi in the pt as before,
although the helpers improve consistency by zeroing down the substructure. There is
a huge amount of user code out there over the last 10 years that did not always have
the minimal examples to follow, some of it does some unexpected things.
If it is PLAT_FREERTOS, that is a newer thing in lws and users have the benefit of
being able to follow the minimal examples' approach. For PLAT_FREERTOS we don't
reserve the fakewsi in the pt any more, saving around 800 bytes. The helpers then
create a struct lws_a (the substructure) on the stack, zero it down (but it is only
like 4 pointers) and prepare it with whatever we know like the context.
Then we cast it to a struct lws * and use it in the user protocol handler call.
In this case, the remainder of the struct lws is undefined. However the amount of
old protocol handlers that might touch things outside of the substructure in
PLAT_FREERTOS is very limited compared to legacy lws user code and the saving is
significant on constrained devices.
User handlers should not be touching everything in a wsi every time anyway, there
are several cases where there is no valid wsi to do the call with. Dereference of
things outside the substructure should only happen when the callback reason shows
there is a valid wsi bound to the activity (as in all the minimal examples).
2020-07-19 08:33:46 +01:00
|
|
|
if (wsi->a.vhost->tls.alpn)
|
|
|
|
|
alpn_comma = wsi->a.vhost->tls.alpn;
|
2018-04-12 15:56:38 +08:00
|
|
|
|
2020-01-02 08:32:23 +00:00
|
|
|
if (wsi->stash) {
|
2021-06-16 07:08:50 +01:00
|
|
|
lws_strncpy(hostname, wsi->stash->cis[CIS_HOST],
|
|
|
|
|
sizeof(hostname));
|
|
|
|
|
if (wsi->stash->cis[CIS_ALPN])
|
|
|
|
|
alpn_comma = wsi->stash->cis[CIS_ALPN];
|
2020-01-02 08:32:23 +00:00
|
|
|
} else {
|
|
|
|
|
if (lws_hdr_copy(wsi, hostname, sizeof(hostname),
|
|
|
|
|
_WSI_TOKEN_CLIENT_ALPN) > 0)
|
|
|
|
|
alpn_comma = hostname;
|
|
|
|
|
}
|
2018-04-12 15:56:38 +08:00
|
|
|
|
2020-12-12 06:21:40 +00:00
|
|
|
protos.len = (uint8_t)lws_alpn_comma_to_openssl(alpn_comma, protos.data,
|
2018-04-12 15:56:38 +08:00
|
|
|
sizeof(protos.data) - 1);
|
|
|
|
|
|
2022-02-01 07:59:41 +00:00
|
|
|
lwsl_info("%s: %s: client conn sending ALPN list '%s' (protos.len %d)\n",
|
|
|
|
|
__func__, lws_wsi_tag(wsi), alpn_comma, protos.len);
|
|
|
|
|
|
2018-04-12 15:56:38 +08:00
|
|
|
/* with mbedtls, protos is not pointed to after exit from this call */
|
2018-05-01 12:41:42 +08:00
|
|
|
SSL_set_alpn_select_cb(wsi->tls.ssl, &protos);
|
2018-04-12 15:56:38 +08:00
|
|
|
|
2021-10-02 13:50:35 +01:00
|
|
|
if (wsi->flags & LCCSCF_ALLOW_SELFSIGNED) {
|
|
|
|
|
lwsl_notice("%s: allowing selfsigned\n", __func__);
|
|
|
|
|
fl = SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (wsi->flags & LCCSCF_ALLOW_INSECURE)
|
|
|
|
|
fl = SSL_VERIFY_NONE;
|
|
|
|
|
|
2017-10-18 09:41:44 +08:00
|
|
|
/*
|
|
|
|
|
* use server name indication (SNI), if supported,
|
|
|
|
|
* when establishing connection
|
|
|
|
|
*/
|
2021-05-21 14:32:21 +01:00
|
|
|
#if defined(LWS_WITH_TLS_JIT_TRUST)
|
|
|
|
|
SSL_set_verify(wsi->tls.ssl, SSL_VERIFY_PEER,
|
|
|
|
|
lws_mbedtls_client_verify_callback);
|
2021-11-08 09:22:46 +00:00
|
|
|
(void)fl;
|
2021-10-02 13:50:35 +01:00
|
|
|
#else
|
|
|
|
|
SSL_set_verify(wsi->tls.ssl, fl, NULL);
|
2021-05-21 14:32:21 +01:00
|
|
|
#endif
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2021-01-29 16:28:21 +00:00
|
|
|
SSL_set_fd(wsi->tls.ssl, (int)wsi->desc.sockfd);
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2019-12-08 03:04:03 +00:00
|
|
|
if (wsi->sys_tls_client_cert) {
|
fakewsi: replace with smaller substructure
Currently we always reserve a fakewsi per pt so events that don't have a related actual
wsi, like vhost-protocol-init or vhost cert init via protocol callback can make callbacks
that look reasonable to user protocol handler code expecting a valid wsi every time.
This patch splits out stuff that user callbacks often unconditionally expect to be in
a wsi, like context pointer, vhost pointer etc into a substructure, which is composed
into struct lws at the top of it. Internal references (struct lws is opaque, so there
are only internal references) are all updated to go via the substructre, the compiler
should make that a NOP.
Helpers are added when fakewsi is used and referenced.
If not PLAT_FREERTOS, we continue to provide a full fakewsi in the pt as before,
although the helpers improve consistency by zeroing down the substructure. There is
a huge amount of user code out there over the last 10 years that did not always have
the minimal examples to follow, some of it does some unexpected things.
If it is PLAT_FREERTOS, that is a newer thing in lws and users have the benefit of
being able to follow the minimal examples' approach. For PLAT_FREERTOS we don't
reserve the fakewsi in the pt any more, saving around 800 bytes. The helpers then
create a struct lws_a (the substructure) on the stack, zero it down (but it is only
like 4 pointers) and prepare it with whatever we know like the context.
Then we cast it to a struct lws * and use it in the user protocol handler call.
In this case, the remainder of the struct lws is undefined. However the amount of
old protocol handlers that might touch things outside of the substructure in
PLAT_FREERTOS is very limited compared to legacy lws user code and the saving is
significant on constrained devices.
User handlers should not be touching everything in a wsi every time anyway, there
are several cases where there is no valid wsi to do the call with. Dereference of
things outside the substructure should only happen when the callback reason shows
there is a valid wsi bound to the activity (as in all the minimal examples).
2020-07-19 08:33:46 +01:00
|
|
|
lws_system_blob_t *b = lws_system_get_blob(wsi->a.context,
|
2019-12-08 03:04:03 +00:00
|
|
|
LWS_SYSBLOB_TYPE_CLIENT_CERT_DER,
|
|
|
|
|
wsi->sys_tls_client_cert - 1);
|
2020-09-15 07:16:56 +01:00
|
|
|
const uint8_t *pem_data = NULL;
|
|
|
|
|
uint8_t *data = NULL;
|
|
|
|
|
lws_filepos_t flen;
|
2019-12-08 03:04:03 +00:00
|
|
|
size_t size;
|
2020-09-15 07:16:56 +01:00
|
|
|
int err = 0;
|
2019-12-08 03:04:03 +00:00
|
|
|
|
|
|
|
|
if (!b)
|
|
|
|
|
goto no_client_cert;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Set up the per-connection client cert
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
size = lws_system_blob_get_size(b);
|
|
|
|
|
if (!size)
|
|
|
|
|
goto no_client_cert;
|
|
|
|
|
|
2020-09-15 07:16:56 +01:00
|
|
|
if (lws_system_blob_get_single_ptr(b, &pem_data))
|
2019-12-08 03:04:03 +00:00
|
|
|
goto no_client_cert;
|
|
|
|
|
|
2020-09-15 07:16:56 +01:00
|
|
|
if (lws_tls_alloc_pem_to_der_file(wsi->a.context, NULL,
|
|
|
|
|
(const char *)pem_data, size,
|
|
|
|
|
&data, &flen))
|
|
|
|
|
goto no_client_cert;
|
|
|
|
|
size = (size_t) flen;
|
|
|
|
|
|
2020-12-12 06:21:40 +00:00
|
|
|
err = SSL_use_certificate_ASN1(wsi->tls.ssl, data, (int)size);
|
2020-09-15 07:16:56 +01:00
|
|
|
lws_free_set_NULL(data);
|
|
|
|
|
if (err != 1)
|
2019-12-08 03:04:03 +00:00
|
|
|
goto no_client_cert;
|
|
|
|
|
|
fakewsi: replace with smaller substructure
Currently we always reserve a fakewsi per pt so events that don't have a related actual
wsi, like vhost-protocol-init or vhost cert init via protocol callback can make callbacks
that look reasonable to user protocol handler code expecting a valid wsi every time.
This patch splits out stuff that user callbacks often unconditionally expect to be in
a wsi, like context pointer, vhost pointer etc into a substructure, which is composed
into struct lws at the top of it. Internal references (struct lws is opaque, so there
are only internal references) are all updated to go via the substructre, the compiler
should make that a NOP.
Helpers are added when fakewsi is used and referenced.
If not PLAT_FREERTOS, we continue to provide a full fakewsi in the pt as before,
although the helpers improve consistency by zeroing down the substructure. There is
a huge amount of user code out there over the last 10 years that did not always have
the minimal examples to follow, some of it does some unexpected things.
If it is PLAT_FREERTOS, that is a newer thing in lws and users have the benefit of
being able to follow the minimal examples' approach. For PLAT_FREERTOS we don't
reserve the fakewsi in the pt any more, saving around 800 bytes. The helpers then
create a struct lws_a (the substructure) on the stack, zero it down (but it is only
like 4 pointers) and prepare it with whatever we know like the context.
Then we cast it to a struct lws * and use it in the user protocol handler call.
In this case, the remainder of the struct lws is undefined. However the amount of
old protocol handlers that might touch things outside of the substructure in
PLAT_FREERTOS is very limited compared to legacy lws user code and the saving is
significant on constrained devices.
User handlers should not be touching everything in a wsi every time anyway, there
are several cases where there is no valid wsi to do the call with. Dereference of
things outside the substructure should only happen when the callback reason shows
there is a valid wsi bound to the activity (as in all the minimal examples).
2020-07-19 08:33:46 +01:00
|
|
|
b = lws_system_get_blob(wsi->a.context,
|
2019-12-08 03:04:03 +00:00
|
|
|
LWS_SYSBLOB_TYPE_CLIENT_KEY_DER,
|
|
|
|
|
wsi->sys_tls_client_cert - 1);
|
|
|
|
|
if (!b)
|
|
|
|
|
goto no_client_cert;
|
|
|
|
|
size = lws_system_blob_get_size(b);
|
|
|
|
|
if (!size)
|
|
|
|
|
goto no_client_cert;
|
|
|
|
|
|
2020-09-15 07:16:56 +01:00
|
|
|
if (lws_system_blob_get_single_ptr(b, &pem_data))
|
|
|
|
|
goto no_client_cert;
|
|
|
|
|
|
|
|
|
|
if (lws_tls_alloc_pem_to_der_file(wsi->a.context, NULL,
|
|
|
|
|
(const char *)pem_data, size,
|
|
|
|
|
&data, &flen))
|
2019-12-08 03:04:03 +00:00
|
|
|
goto no_client_cert;
|
2020-09-15 07:16:56 +01:00
|
|
|
size = (size_t) flen;
|
2019-12-08 03:04:03 +00:00
|
|
|
|
2020-12-12 06:21:40 +00:00
|
|
|
err = SSL_use_PrivateKey_ASN1(0, wsi->tls.ssl, data, (int)size);
|
2020-09-15 07:16:56 +01:00
|
|
|
lws_free_set_NULL(data);
|
|
|
|
|
if (err != 1)
|
2019-12-08 03:04:03 +00:00
|
|
|
goto no_client_cert;
|
|
|
|
|
|
|
|
|
|
/* no wrapper api for check key */
|
|
|
|
|
|
|
|
|
|
lwsl_notice("%s: set system client cert %u\n", __func__,
|
|
|
|
|
wsi->sys_tls_client_cert - 1);
|
|
|
|
|
}
|
|
|
|
|
|
2017-10-18 09:41:44 +08:00
|
|
|
return 0;
|
2019-12-08 03:04:03 +00:00
|
|
|
|
|
|
|
|
no_client_cert:
|
|
|
|
|
lwsl_err("%s: unable to set up system client cert %d\n", __func__,
|
|
|
|
|
wsi->sys_tls_client_cert - 1);
|
|
|
|
|
|
|
|
|
|
return 1;
|
2017-10-18 09:41:44 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int ERR_get_error(void)
|
|
|
|
|
{
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
enum lws_ssl_capable_status
|
2020-12-12 06:21:40 +00:00
|
|
|
lws_tls_client_connect(struct lws *wsi, char *errbuf, size_t elen)
|
2017-10-18 09:41:44 +08:00
|
|
|
{
|
2021-02-28 17:17:55 +00:00
|
|
|
int m, n = SSL_connect(wsi->tls.ssl), en;
|
2018-03-27 06:29:49 +08:00
|
|
|
|
|
|
|
|
if (n == 1) {
|
2021-06-16 07:08:50 +01:00
|
|
|
lws_tls_server_conn_alpn(wsi);
|
2021-04-01 17:34:38 +01:00
|
|
|
#if defined(LWS_WITH_TLS_SESSIONS)
|
|
|
|
|
lws_tls_session_new_mbedtls(wsi);
|
|
|
|
|
#endif
|
2021-06-16 07:08:50 +01:00
|
|
|
lwsl_info("%s: client connect OK\n", __func__);
|
2017-10-18 09:41:44 +08:00
|
|
|
return LWS_SSL_CAPABLE_DONE;
|
2018-03-27 06:29:49 +08:00
|
|
|
}
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2021-02-28 17:17:55 +00:00
|
|
|
en = (int)LWS_ERRNO;
|
2018-05-01 12:41:42 +08:00
|
|
|
m = SSL_get_error(wsi->tls.ssl, n);
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2018-05-01 12:41:42 +08:00
|
|
|
if (m == SSL_ERROR_WANT_READ || SSL_want_read(wsi->tls.ssl))
|
2017-10-18 09:41:44 +08:00
|
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE_READ;
|
|
|
|
|
|
2018-05-01 12:41:42 +08:00
|
|
|
if (m == SSL_ERROR_WANT_WRITE || SSL_want_write(wsi->tls.ssl))
|
2017-10-18 09:41:44 +08:00
|
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE_WRITE;
|
|
|
|
|
|
|
|
|
|
if (!n) /* we don't know what he wants, but he says to retry */
|
|
|
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE;
|
|
|
|
|
|
2022-02-04 07:34:54 +00:00
|
|
|
if (m == SSL_ERROR_SYSCALL && !en && n >= 0) /* otherwise we miss explicit failures and spin
|
|
|
|
|
* in hs state 17 until timeout... */
|
2021-02-28 17:17:55 +00:00
|
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE;
|
|
|
|
|
|
|
|
|
|
lws_snprintf(errbuf, elen, "mbedtls connect %d %d %d", n, m, en);
|
2020-04-14 19:04:13 +01:00
|
|
|
|
2017-10-18 09:41:44 +08:00
|
|
|
return LWS_SSL_CAPABLE_ERROR;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int
|
2020-12-12 06:21:40 +00:00
|
|
|
lws_tls_client_confirm_peer_cert(struct lws *wsi, char *ebuf, size_t ebuf_len)
|
2017-10-18 09:41:44 +08:00
|
|
|
{
|
2018-03-24 17:52:57 +01:00
|
|
|
int n;
|
2021-01-06 15:08:22 +00:00
|
|
|
unsigned int avoid = 0;
|
2018-05-01 12:41:42 +08:00
|
|
|
X509 *peer = SSL_get_peer_certificate(wsi->tls.ssl);
|
fakewsi: replace with smaller substructure
Currently we always reserve a fakewsi per pt so events that don't have a related actual
wsi, like vhost-protocol-init or vhost cert init via protocol callback can make callbacks
that look reasonable to user protocol handler code expecting a valid wsi every time.
This patch splits out stuff that user callbacks often unconditionally expect to be in
a wsi, like context pointer, vhost pointer etc into a substructure, which is composed
into struct lws at the top of it. Internal references (struct lws is opaque, so there
are only internal references) are all updated to go via the substructre, the compiler
should make that a NOP.
Helpers are added when fakewsi is used and referenced.
If not PLAT_FREERTOS, we continue to provide a full fakewsi in the pt as before,
although the helpers improve consistency by zeroing down the substructure. There is
a huge amount of user code out there over the last 10 years that did not always have
the minimal examples to follow, some of it does some unexpected things.
If it is PLAT_FREERTOS, that is a newer thing in lws and users have the benefit of
being able to follow the minimal examples' approach. For PLAT_FREERTOS we don't
reserve the fakewsi in the pt any more, saving around 800 bytes. The helpers then
create a struct lws_a (the substructure) on the stack, zero it down (but it is only
like 4 pointers) and prepare it with whatever we know like the context.
Then we cast it to a struct lws * and use it in the user protocol handler call.
In this case, the remainder of the struct lws is undefined. However the amount of
old protocol handlers that might touch things outside of the substructure in
PLAT_FREERTOS is very limited compared to legacy lws user code and the saving is
significant on constrained devices.
User handlers should not be touching everything in a wsi every time anyway, there
are several cases where there is no valid wsi to do the call with. Dereference of
things outside the substructure should only happen when the callback reason shows
there is a valid wsi bound to the activity (as in all the minimal examples).
2020-07-19 08:33:46 +01:00
|
|
|
struct lws_context_per_thread *pt = &wsi->a.context->pt[(int)wsi->tsi];
|
2021-01-06 15:08:22 +00:00
|
|
|
const char *type = "";
|
2018-03-24 17:52:57 +01:00
|
|
|
char *sb = (char *)&pt->serv_buf[0];
|
2017-10-18 09:41:44 +08:00
|
|
|
|
|
|
|
|
if (!peer) {
|
2021-01-06 15:08:22 +00:00
|
|
|
#if defined(LWS_WITH_SYS_METRICS)
|
|
|
|
|
lws_metrics_hist_bump_describe_wsi(wsi, lws_metrics_priv_to_pub(
|
|
|
|
|
wsi->a.context->mth_conn_failures),
|
|
|
|
|
"tls=\"nocert\"");
|
|
|
|
|
#endif
|
2017-10-18 09:41:44 +08:00
|
|
|
lwsl_info("peer did not provide cert\n");
|
2019-07-24 16:48:24 -07:00
|
|
|
lws_snprintf(ebuf, ebuf_len, "no peer cert");
|
2017-10-18 09:41:44 +08:00
|
|
|
|
|
|
|
|
return -1;
|
|
|
|
|
}
|
|
|
|
|
|
2020-12-12 06:21:40 +00:00
|
|
|
n = (int)SSL_get_verify_result(wsi->tls.ssl);
|
2021-01-06 15:08:22 +00:00
|
|
|
lwsl_debug("get_verify says %d\n", n);
|
2018-03-24 17:52:57 +01:00
|
|
|
|
2021-01-06 15:08:22 +00:00
|
|
|
switch (n) {
|
|
|
|
|
case X509_V_OK:
|
2018-03-24 17:52:57 +01:00
|
|
|
return 0;
|
|
|
|
|
|
2021-01-06 15:08:22 +00:00
|
|
|
case X509_V_ERR_HOSTNAME_MISMATCH:
|
|
|
|
|
type = "hostname";
|
|
|
|
|
avoid = LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case X509_V_ERR_INVALID_CA:
|
|
|
|
|
type = "invalidca";
|
|
|
|
|
avoid = LCCSCF_ALLOW_SELFSIGNED;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case X509_V_ERR_CERT_NOT_YET_VALID:
|
|
|
|
|
type = "notyetvalid";
|
|
|
|
|
avoid = LCCSCF_ALLOW_EXPIRED;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case X509_V_ERR_CERT_HAS_EXPIRED:
|
|
|
|
|
type = "expired";
|
|
|
|
|
avoid = LCCSCF_ALLOW_EXPIRED;
|
|
|
|
|
break;
|
2018-03-24 17:52:57 +01:00
|
|
|
}
|
|
|
|
|
|
2021-01-06 15:08:22 +00:00
|
|
|
lwsl_info("%s: cert problem: %s\n", __func__, type);
|
|
|
|
|
#if defined(LWS_WITH_SYS_METRICS)
|
|
|
|
|
{
|
|
|
|
|
char buckname[64];
|
|
|
|
|
lws_snprintf(buckname, sizeof(buckname), "tls=\"%s\"", type);
|
|
|
|
|
lws_metrics_hist_bump_describe_wsi(wsi,
|
|
|
|
|
lws_metrics_priv_to_pub(wsi->a.context->mth_conn_failures),
|
|
|
|
|
buckname);
|
2018-03-24 17:52:57 +01:00
|
|
|
}
|
2021-01-06 15:08:22 +00:00
|
|
|
#endif
|
|
|
|
|
if (wsi->tls.use_ssl & avoid) {
|
|
|
|
|
lwsl_info("%s: allowing anyway\n", __func__);
|
2018-03-24 17:52:57 +01:00
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
2021-01-06 15:08:22 +00:00
|
|
|
|
2021-05-21 14:32:21 +01:00
|
|
|
#if defined(LWS_WITH_TLS_JIT_TRUST)
|
|
|
|
|
if (n == X509_V_ERR_INVALID_CA)
|
|
|
|
|
lws_tls_jit_trust_sort_kids(wsi, &wsi->tls.ssl->kid_chain);
|
|
|
|
|
#endif
|
2018-03-24 17:52:57 +01:00
|
|
|
lws_snprintf(ebuf, ebuf_len,
|
2021-01-06 15:08:22 +00:00
|
|
|
"server's cert didn't look good, %s (use_ssl 0x%x) X509_V_ERR = %d: %s\n",
|
|
|
|
|
type, (unsigned int)wsi->tls.use_ssl, n,
|
|
|
|
|
ERR_error_string((unsigned long)n, sb));
|
|
|
|
|
|
2018-03-24 17:52:57 +01:00
|
|
|
lwsl_info("%s\n", ebuf);
|
2021-01-06 15:08:22 +00:00
|
|
|
|
2019-07-13 13:28:14 -07:00
|
|
|
lws_tls_err_describe_clear();
|
2018-03-24 17:52:57 +01:00
|
|
|
|
|
|
|
|
return -1;
|
2017-10-18 09:41:44 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int
|
|
|
|
|
lws_tls_client_create_vhost_context(struct lws_vhost *vh,
|
2018-04-27 08:27:16 +08:00
|
|
|
const struct lws_context_creation_info *info,
|
2017-10-18 09:41:44 +08:00
|
|
|
const char *cipher_list,
|
|
|
|
|
const char *ca_filepath,
|
2018-07-16 11:45:55 +02:00
|
|
|
const void *ca_mem,
|
|
|
|
|
unsigned int ca_mem_len,
|
2017-10-18 09:41:44 +08:00
|
|
|
const char *cert_filepath,
|
2019-01-11 13:13:34 +08:00
|
|
|
const void *cert_mem,
|
|
|
|
|
unsigned int cert_mem_len,
|
2020-06-04 19:59:37 -07:00
|
|
|
const char *private_key_filepath,
|
|
|
|
|
const void *key_mem,
|
|
|
|
|
unsigned int key_mem_len
|
|
|
|
|
)
|
2017-10-18 09:41:44 +08:00
|
|
|
{
|
2024-03-18 19:38:43 +08:00
|
|
|
X509 *d2i_X509(X509 **cert, const unsigned char **buffer, long len);
|
2024-04-24 11:30:04 +08:00
|
|
|
SSL_METHOD *method;
|
2017-10-18 09:41:44 +08:00
|
|
|
unsigned long error;
|
2019-01-11 13:13:34 +08:00
|
|
|
int n;
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2021-04-01 17:34:38 +01:00
|
|
|
#if defined(LWS_WITH_TLS_SESSIONS)
|
|
|
|
|
vh->tls_session_cache_max = info->tls_session_cache_max ?
|
|
|
|
|
info->tls_session_cache_max : 10;
|
|
|
|
|
lws_tls_session_cache(vh, info->tls_session_timeout);
|
|
|
|
|
#endif
|
|
|
|
|
|
2024-04-24 11:30:04 +08:00
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
|
|
|
|
method = (SSL_METHOD *)TLSv1_2_client_method();
|
|
|
|
|
#elif defined(MBEDTLS_SSL_PROTO_TLS1_1)
|
|
|
|
|
method = (SSL_METHOD *)TLSv1_1_client_method();
|
|
|
|
|
#elif defined(MBEDTLS_SSL_PROTO_TLS1)
|
|
|
|
|
method = (SSL_METHOD *)TLSv1_client_method();
|
|
|
|
|
#else
|
|
|
|
|
method = (SSL_METHOD *)TLS_client_method();
|
|
|
|
|
#endif
|
|
|
|
|
|
2017-10-18 09:41:44 +08:00
|
|
|
if (!method) {
|
2020-12-12 06:21:40 +00:00
|
|
|
error = (unsigned long)ERR_get_error();
|
2017-10-18 09:41:44 +08:00
|
|
|
lwsl_err("problem creating ssl method %lu: %s\n",
|
|
|
|
|
error, ERR_error_string(error,
|
|
|
|
|
(char *)vh->context->pt[0].serv_buf));
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
/* create context */
|
2021-07-09 18:04:08 +01:00
|
|
|
vh->tls.ssl_client_ctx = SSL_CTX_new(method, &vh->context->mcdc);
|
2018-05-01 12:41:42 +08:00
|
|
|
if (!vh->tls.ssl_client_ctx) {
|
2020-12-12 06:21:40 +00:00
|
|
|
error = (unsigned long)ERR_get_error();
|
2017-10-18 09:41:44 +08:00
|
|
|
lwsl_err("problem creating ssl context %lu: %s\n",
|
|
|
|
|
error, ERR_error_string(error,
|
|
|
|
|
(char *)vh->context->pt[0].serv_buf));
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
2018-07-16 11:45:55 +02:00
|
|
|
if (!ca_filepath && (!ca_mem || !ca_mem_len))
|
2017-10-18 09:41:44 +08:00
|
|
|
return 0;
|
|
|
|
|
|
2018-07-16 11:45:55 +02:00
|
|
|
if (ca_filepath) {
|
2019-01-15 06:59:48 +08:00
|
|
|
#if !defined(LWS_PLAT_OPTEE)
|
|
|
|
|
uint8_t *buf;
|
|
|
|
|
lws_filepos_t len;
|
|
|
|
|
|
2018-07-16 11:45:55 +02:00
|
|
|
if (alloc_file(vh->context, ca_filepath, &buf, &len)) {
|
|
|
|
|
lwsl_err("Load CA cert file %s failed\n", ca_filepath);
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
2024-03-18 19:38:43 +08:00
|
|
|
vh->tls.x509_client_CA = d2i_X509(NULL, (const uint8_t **)&buf, (long)len);
|
2018-07-16 11:45:55 +02:00
|
|
|
free(buf);
|
2021-04-13 20:40:02 +01:00
|
|
|
|
2021-10-02 13:50:35 +01:00
|
|
|
lwsl_info("Loading vh %s client CA for verification %s\n", vh->name, ca_filepath);
|
2019-01-15 06:59:48 +08:00
|
|
|
#endif
|
2018-07-16 11:45:55 +02:00
|
|
|
} else {
|
2024-03-18 19:38:43 +08:00
|
|
|
vh->tls.x509_client_CA = d2i_X509(NULL, (const uint8_t **)&ca_mem, (long)ca_mem_len);
|
2020-12-29 12:10:24 +00:00
|
|
|
lwsl_info("%s: using mem client CA cert %d\n",
|
2019-01-11 13:13:34 +08:00
|
|
|
__func__, ca_mem_len);
|
2017-10-18 09:41:44 +08:00
|
|
|
}
|
|
|
|
|
|
2018-05-01 12:41:42 +08:00
|
|
|
if (!vh->tls.x509_client_CA) {
|
2017-10-18 09:41:44 +08:00
|
|
|
lwsl_err("client CA: x509 parse failed\n");
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
2018-05-01 12:41:42 +08:00
|
|
|
if (!vh->tls.ssl_ctx)
|
|
|
|
|
SSL_CTX_add_client_CA(vh->tls.ssl_client_ctx, vh->tls.x509_client_CA);
|
2018-03-21 08:47:39 +08:00
|
|
|
else
|
2018-05-01 12:41:42 +08:00
|
|
|
SSL_CTX_add_client_CA(vh->tls.ssl_ctx, vh->tls.x509_client_CA);
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2019-01-11 13:13:34 +08:00
|
|
|
/* support for client-side certificate authentication */
|
|
|
|
|
if (cert_filepath) {
|
2019-01-15 06:59:48 +08:00
|
|
|
#if !defined(LWS_PLAT_OPTEE)
|
2019-01-11 13:13:34 +08:00
|
|
|
uint8_t *buf;
|
|
|
|
|
lws_filepos_t amount;
|
|
|
|
|
|
|
|
|
|
if (lws_tls_use_any_upgrade_check_extant(cert_filepath) !=
|
|
|
|
|
LWS_TLS_EXTANT_YES &&
|
|
|
|
|
(info->options & LWS_SERVER_OPTION_IGNORE_MISSING_CERT))
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
lwsl_notice("%s: doing cert filepath %s\n", __func__,
|
|
|
|
|
cert_filepath);
|
|
|
|
|
|
|
|
|
|
if (alloc_file(vh->context, cert_filepath, &buf, &amount))
|
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
|
|
buf[amount++] = '\0';
|
|
|
|
|
|
|
|
|
|
n = SSL_CTX_use_certificate_ASN1(vh->tls.ssl_client_ctx,
|
2020-12-12 06:21:40 +00:00
|
|
|
(int)amount, buf);
|
2019-01-11 13:13:34 +08:00
|
|
|
lws_free(buf);
|
|
|
|
|
if (n < 1) {
|
|
|
|
|
lwsl_err("problem %d getting cert '%s'\n", n,
|
|
|
|
|
cert_filepath);
|
2019-07-13 13:28:14 -07:00
|
|
|
lws_tls_err_describe_clear();
|
2019-01-11 13:13:34 +08:00
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
2020-12-29 12:10:24 +00:00
|
|
|
lwsl_info("Loaded client cert %s\n", cert_filepath);
|
2019-01-15 06:59:48 +08:00
|
|
|
#endif
|
2019-01-11 13:13:34 +08:00
|
|
|
} else if (cert_mem && cert_mem_len) {
|
2020-06-04 19:59:37 -07:00
|
|
|
/* lwsl_hexdump_notice(cert_mem, cert_mem_len - 1); */
|
2019-01-11 13:13:34 +08:00
|
|
|
n = SSL_CTX_use_certificate_ASN1(vh->tls.ssl_client_ctx,
|
2020-12-12 06:21:40 +00:00
|
|
|
(int)cert_mem_len, cert_mem);
|
2019-01-11 13:13:34 +08:00
|
|
|
if (n < 1) {
|
2020-06-04 19:59:37 -07:00
|
|
|
lwsl_err("%s: (mbedtls) problem interpreting client cert\n",
|
2019-01-11 13:13:34 +08:00
|
|
|
__func__);
|
2019-07-13 13:28:14 -07:00
|
|
|
lws_tls_err_describe_clear();
|
2019-01-11 13:13:34 +08:00
|
|
|
return 1;
|
|
|
|
|
}
|
2020-12-29 12:10:24 +00:00
|
|
|
lwsl_info("%s: using mem client cert %d\n",
|
2019-01-11 13:13:34 +08:00
|
|
|
__func__, cert_mem_len);
|
|
|
|
|
}
|
2017-10-18 09:41:44 +08:00
|
|
|
|
2021-05-20 17:02:28 +08:00
|
|
|
if (private_key_filepath) {
|
|
|
|
|
#if !defined(LWS_PLAT_OPTEE)
|
|
|
|
|
|
|
|
|
|
uint8_t *buf;
|
|
|
|
|
lws_filepos_t amount;
|
|
|
|
|
|
|
|
|
|
lwsl_notice("%s: doing private key filepath %s\n", __func__,
|
|
|
|
|
private_key_filepath);
|
|
|
|
|
if (alloc_file(vh->context, private_key_filepath, &buf, &amount))
|
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
|
|
buf[amount++] = '\0';
|
|
|
|
|
|
|
|
|
|
n = SSL_CTX_use_PrivateKey_ASN1(0, vh->tls.ssl_client_ctx,
|
|
|
|
|
buf, (long)amount);
|
|
|
|
|
|
|
|
|
|
lws_free(buf);
|
|
|
|
|
if (n < 1) {
|
|
|
|
|
lwsl_err("problem %d getting private key '%s'\n", n,
|
|
|
|
|
private_key_filepath);
|
|
|
|
|
lws_tls_err_describe_clear();
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
lwsl_notice("Loaded private key %s\n", private_key_filepath);
|
|
|
|
|
#endif
|
|
|
|
|
} else if (key_mem && key_mem_len) {
|
|
|
|
|
/* lwsl_hexdump_notice(cert_mem, cert_mem_len - 1); */
|
|
|
|
|
n = SSL_CTX_use_PrivateKey_ASN1(0, vh->tls.ssl_client_ctx,
|
|
|
|
|
key_mem, (long)key_mem_len - 1);
|
|
|
|
|
|
|
|
|
|
if (n < 1) {
|
|
|
|
|
lwsl_err("%s: (mbedtls) problem interpreting private key\n",
|
|
|
|
|
__func__);
|
|
|
|
|
lws_tls_err_describe_clear();
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
lwsl_info("%s: using mem private key %d\n",
|
|
|
|
|
__func__, key_mem_len);
|
|
|
|
|
|
|
|
|
|
}
|
2017-10-18 09:41:44 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
2019-08-21 20:22:40 +01:00
|
|
|
|
|
|
|
|
int
|
|
|
|
|
lws_tls_client_vhost_extra_cert_mem(struct lws_vhost *vh,
|
|
|
|
|
const uint8_t *der, size_t der_len)
|
|
|
|
|
{
|
2020-12-12 06:21:40 +00:00
|
|
|
if (SSL_CTX_add_client_CA_ASN1(vh->tls.ssl_client_ctx, (int)der_len, der) != 1) {
|
2019-08-21 20:22:40 +01:00
|
|
|
lwsl_err("%s: failed\n", __func__);
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|