Mirrors/libwebsockets
1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-09 00:00:04 +01:00
Code Issues Releases Wiki Activity

From df9761a261 Mon Sep 17 00:00:00 2001

Browse source 
Subject: [PATCH] remove LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY
 callback

When a certificate for a TLS connection is provided, but a private
key is not, the SSL_CTX initialization exits early, before the
CONTEXT_REQUIRES_PRIVATE_KEY callback can be issued.
Remove the now obsolete callback and update the vhost
field description to state that the LOAD_EXTRA_SERVER_VERIFY_CERTS
callback should be used instead.
This commit is contained in:
Damian Hobson-Garcia 2022-08-17 00:16:27 +09:00 • committed by Andy Green
parent 8796dc00f5
commit 58af7b4409
3 changed files with 17 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
include/libwebsockets/lws-callbacks.h
View file

@ -160,15 +160,6 @@ enum lws_callback_reasons {
* the default callback action of returning 0 allows the client
* certificates. */
LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY = 37,
/**< if configured for including OpenSSL support but no private key
* file has been specified (ssl_private_key_filepath is NULL), this is
* called to allow the user to set the private key directly via
* libopenssl and perform further operations if required; this might be
* useful in situations where the private key is not directly accessible
* by the OS, for example if it is stored on a smartcard.
* user is the server's OpenSSL SSL_CTX* */
LWS_CALLBACK_SSL_INFO = 67,
/**< SSL connections only. An event you registered an
* interest in at the vhost has occurred on a connection

13
include/libwebsockets/lws-context-vhost.h
View file

@ -390,10 +390,15 @@ struct lws_context_creation_info {
*/
const char *ssl_private_key_filepath;
/**< VHOST: filepath to private key if wanting SSL mode;
* if this is set to NULL but ssl_cert_filepath is set, the
* OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY callback is called
* to allow setting of the private key directly via openSSL
* library calls. (For backwards compatibility, this can also be used
* this should not be set to NULL when ssl_cert_filepath is set.
*
* Alteratively, the certificate and private key can both be set in
* the OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS callback directly via
* openSSL library calls. This requires that
* LWS_SERVER_OPTION_CREATE_VHOST_SSL_CTX is set in the vhost info options
* to force initializtion of the SSL_CTX context.
*
* (For backwards compatibility, this can also be used
* to pass the client cert private key filepath when setting up a
* vhost client SSL context, but it is preferred to use
* .client_ssl_private_key_filepath for that.)

26
lib/tls/openssl/openssl-server.c
View file

@ -228,7 +228,10 @@ lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi,
return 1;
}
if (private_key) {
if (!private_key) {
lwsl_err("ssl private key not set\n");
return 1;
} else {
/* set the private key from KeyFile */
if (SSL_CTX_use_PrivateKey_file(vhost->tls.ssl_ctx, private_key,
SSL_FILETYPE_PEM) != 1) {
@ -244,14 +247,6 @@ lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi,
private_key, error, s);
return 1;
}
} else {
if (vhost->protocols[0].callback(wsi,
LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY,
vhost->tls.ssl_ctx, NULL, 0)) {
lwsl_err("ssl private key not set\n");
return 1;
}
}
return 0;
@ -389,7 +384,10 @@ lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi,
return 1;
}
if (n != LWS_TLS_EXTANT_ALTERNATIVE && private_key) {
if (n == LWS_TLS_EXTANT_ALTERNATIVE || !private_key) {
lwsl_err("ssl private key not set\n");
return 1;
} else {
/* set the private key from KeyFile */
if (SSL_CTX_use_PrivateKey_file(vhost->tls.ssl_ctx, private_key,
SSL_FILETYPE_PEM) != 1) {
@ -400,14 +398,6 @@ lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi,
(char *)vhost->context->pt[0].serv_buf));
return 1;
}
} else {
if (vhost->protocols[0].callback(wsi,
LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY,
vhost->tls.ssl_ctx, NULL, 0)) {
lwsl_err("ssl private key not set\n");
return 1;
}
}
check_key: