lws_system: ntpclient

CMakeLists.txt

@@ -47,7 +47,8 @@ option(LWS_WITH_HTTP_BROTLI "Also offer brotli http stream compression (requires
 option(LWS_WITH_ACME "Enable support for ACME automatic cert acquisition + maintenance (letsencrypt etc)" OFF)
 option(LWS_WITH_HUBBUB "Enable libhubbub rewriting support" OFF)
 option(LWS_WITH_FTS "Full Text Search support" OFF)
-option(LWS_WITH_SYS_ASYNC_DNS "Nonblocking internal IPv4 DNS resolver" OFF)
+option(LWS_WITH_SYS_ASYNC_DNS "Nonblocking internal IPv4 + IPv6 DNS resolver" OFF)
+option(LWS_WITH_SYS_NTPCLIENT "Build in tiny ntpclient good for tls date validation and run via lws_system" OFF)
 #
 # TLS library options... all except mbedTLS are basically OpenSSL variants.
 #
@@ -1027,6 +1028,11 @@ if (LWS_WITH_NETWORK)
 			lib/system/async-dns/async-dns-parse.c)
 	endif()
 
+	if (LWS_WITH_SYS_NTPCLIENT)
+		list(APPEND SOURCES
+			lib/system/ntpclient/ntpclient.c)
+	endif()
+
 	if (LWS_WITH_DETAILED_LATENCY)
 		list(APPEND SOURCES
 			lib/core-net/detailed-latency.c)

README.md

@@ -56,6 +56,13 @@ functions like requesting a device reboot.
 
 See `READMEs/README.lws_system.md` for details.
 
+## `lws_system`: ntpclient
+
+Optional lws system service enabled by cmake `-DLWS_WITH_SYS_NTPCLIENT` intercepts
+the `lws_system` `TIME_VALID` state and performs ntpclient to get the date and time
+before entering `TIME_VALID`.  This allows user code to validate tls certificates
+correctly knowing the current date and time by the time it reached OPERATIONAL.
+
 ## Connection Validity tracking
 
 Lws now allows you to apply a policy for how long a network connection may go

cmake/lws_config.h.in

@@ -140,6 +140,7 @@
 #cmakedefine LWS_WITH_STRUCT_SQLITE3
 #cmakedefine LWS_WITH_STRUCT_JSON
 #cmakedefine LWS_WITH_SQLITE3
+#cmakedefine LWS_WITH_SYS_NTPCLIENT
 #cmakedefine LWS_WITH_THREADPOOL
 #cmakedefine LWS_WITH_TLS
 #cmakedefine LWS_WITH_UNIX_SOCK

lib/core/context.c

@@ -149,7 +149,7 @@ lws_create_context(const struct lws_context_creation_info *info)
 	int lpf = info->fd_limit_per_thread;
 
 	if (lpf) {
-		lpf++;
+		lpf+= 2;
 #if defined(LWS_WITH_SYS_ASYNC_DNS)
 		lpf++;
 #endif

lib/roles/http/client/client-handshake.c

@@ -933,7 +933,7 @@ create_new_conn:
 	 */
 	lwsi_set_state(wsi, LRS_WAITING_DNS);
 
-	lwsl_warn("%s: %p: lookup %s:%u\n", __func__, wsi, ads, port);
+	lwsl_info("%s: %p: lookup %s:%u\n", __func__, wsi, ads, port);
 	(void)port;
 
 #if defined(LWS_WITH_DETAILED_LATENCY)

lib/system/async-dns/async-dns.c

@@ -138,8 +138,8 @@ lws_async_dns_writeable(struct lws *wsi, lws_adns_q_t *q)
 	 * in the policy, just close without another write.
 	 */
 	if (lws_dll2_is_detached(&q->sul.list) &&
-	    lws_retry_sul_schedule_retry_wsi(wsi, &q->sul, lws_async_dns_sul_cb_retry,
-					     &q->retry)) {
+	    lws_retry_sul_schedule_retry_wsi(wsi, &q->sul,
+				       lws_async_dns_sul_cb_retry, &q->retry)) {
 		/* we have reached the end of our concealed retries */
 		lwsl_notice("%s: failing query\n", __func__);
 		/*
@@ -208,14 +208,6 @@ lws_async_dns_writeable(struct lws *wsi, lws_adns_q_t *q)
 
 	assert(p < pkt + sizeof(pkt) - LWS_PRE);
 	n = lws_ptr_diff(p, pkt + LWS_PRE);
-/*
-	fd = lws_get_socket_fd(wsi);
-	if (fd < 0)
-		goto qfail;
-
-	m = send(fd, pkt + LWS_PRE, n, 0);
-	*/
-
 	m = lws_write(wsi, pkt + LWS_PRE, n, 0);
 	if (m != n) {
 		lwsl_notice("%s: dns write failed %d %d\n", __func__,
@@ -266,7 +258,7 @@ callback_async_dns(struct lws *wsi, enum lws_callback_reasons reason,
 
 	case LWS_CALLBACK_RAW_RX:
 		// lwsl_user("LWS_CALLBACK_RAW_RX (%d)\n", (int)len);
-		//lwsl_hexdump_level(LLL_NOTICE, in, len);
+		// lwsl_hexdump_level(LLL_NOTICE, in, len);
 		lws_adns_parse_udp(dns, in, len);
 		break;
 

lib/system/ntpclient/ntpclient.c

@@ -0,0 +1,283 @@
+ /*
+ * libwebsockets - small server side websockets and web server implementation
+ *
+ * Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+#include "private-lib-core.h"
+
+#define LWSNTPC_LI_NONE			0
+#define LWSNTPC_VN_3			3
+#define LWSNTPC_MODE_CLIENT		3
+
+struct vhd_ntpc {
+	struct lws_context		*context;
+	struct lws_vhost		*vhost;
+	const struct lws_protocols	*protocol;
+	lws_sorted_usec_list_t		sul_conn;
+	lws_sorted_usec_list_t		sul_write; /* track write retries */
+	lws_state_notify_link_t		notify_link;
+	const char			*ntp_server_ads;
+	struct lws			*wsi_udp;
+	uint16_t			retry_count_conn;
+	uint16_t			retry_count_write;
+
+	char				set_time;
+};
+
+/*
+ * Without a valid ntp we won't be able to do anything requiring client tls.
+ *
+ * We have our own outer backoff scheme that just keeps retrying dns lookup
+ * and the transaction forever.
+ */
+
+static const uint32_t botable[] = { 1000, 1250, 1500, 2000, 3000 };
+static const lws_retry_bo_t bo = {
+	botable, LWS_ARRAY_SIZE(botable), LWS_RETRY_CONCEAL_ALWAYS, 0, 0, 20 };
+
+/*
+ * Once we resolved the remote server (implying we should have network),
+ * we use a different policy on the wsi itself that gives it a few tries before
+ * failing the wsi and using to outer retry policy to get dns to a different
+ * server in the pool and try fresh
+ */
+
+static const uint32_t botable2[] = { 1000, 1250, 5000 /* in case dog slow */ };
+static const lws_retry_bo_t bo2 = {
+	botable2, LWS_ARRAY_SIZE(botable2), LWS_ARRAY_SIZE(botable2),
+	/* don't conceal after the last table entry */ 0, 0, 20 };
+
+static void
+lws_ntpc_retry_conn(struct lws_sorted_usec_list *sul)
+{
+	struct vhd_ntpc *v = lws_container_of(sul, struct vhd_ntpc, sul_conn);
+
+	lwsl_debug("%s: wsi_udp: %p\n", __func__, v->wsi_udp);
+
+	if (v->wsi_udp || !lws_dll2_is_detached(&v->sul_conn.list))
+		return;
+
+	/* create the UDP socket aimed at the server */
+
+	lwsl_debug("%s: server %s\n", __func__, v->ntp_server_ads);
+
+	v->retry_count_write = 0;
+	v->wsi_udp = lws_create_adopt_udp(v->vhost, v->ntp_server_ads, 123, 0,
+					  v->protocol->name, NULL, &bo2);
+	lwsl_debug("%s: created wsi_udp: %p\n", __func__, v->wsi_udp);
+	if (!v->wsi_udp) {
+		lwsl_err("%s: unable to create udp skt\n", __func__);
+
+		lws_retry_sul_schedule(v->context, 0, &v->sul_conn, &bo,
+				       lws_ntpc_retry_conn, &v->retry_count_conn);
+	}
+}
+
+static void
+lws_ntpc_retry_write(struct lws_sorted_usec_list *sul)
+{
+	struct vhd_ntpc *v = lws_container_of(sul, struct vhd_ntpc, sul_write);
+
+	lwsl_debug("%s\n", __func__);
+
+	if (v && v->wsi_udp)
+		lws_callback_on_writable(v->wsi_udp);
+}
+
+static int
+lws_sys_ntpc_notify_cb(lws_state_manager_t *mgr, lws_state_notify_link_t *l,
+		       int current, int target)
+{
+	struct vhd_ntpc *v = lws_container_of(l, struct vhd_ntpc, notify_link);
+
+	if (target != LWS_SYSTATE_TIME_VALID || v->set_time)
+		return 0;
+
+	/* it's trying to do it ever since the protocol / vhost was set up */
+
+	return 1;
+}
+
+static int
+callback_ntpc(struct lws *wsi, enum lws_callback_reasons reason, void *user,
+	      void *in, size_t len)
+{
+	struct vhd_ntpc *v = (struct vhd_ntpc *)
+			lws_protocol_vh_priv_get(lws_get_vhost(wsi),
+						 lws_get_protocol(wsi));
+	uint8_t pkt[LWS_PRE + 48];
+	lws_system_arg_t arg;
+	uint64_t ns;
+
+	switch (reason) {
+
+	case LWS_CALLBACK_PROTOCOL_INIT: /* per vhost */
+		if (v)
+			break;
+
+		lwsl_debug("%s: LWS_CALLBACK_PROTOCOL_INIT\n", __func__);
+		lws_protocol_vh_priv_zalloc(wsi->vhost, wsi->protocol,
+					    sizeof(*v));
+		v = (struct vhd_ntpc *)lws_protocol_vh_priv_get(wsi->vhost,
+								wsi->protocol);
+		v->context = lws_get_context(wsi);
+		v->vhost = lws_get_vhost(wsi);
+		v->protocol = lws_get_protocol(wsi);
+
+		if (!lws_system_get_ops(wsi->context) ||
+		    !lws_system_get_ops(wsi->context)->set_clock) {
+			lwsl_err("%s: set up system ops for set_clock\n",
+					__func__);
+
+		//	return -1;
+		}
+
+		/* register our lws_system notifier */
+
+		v->notify_link.notify_cb = lws_sys_ntpc_notify_cb;
+		v->notify_link.name = "ntpclient";
+		lws_state_reg_notifier(&wsi->context->mgr_system, &v->notify_link);
+
+		if (lws_system_get_info(wsi->context, LWS_SYSI_HRS_NTP_SERVER,
+					&arg))
+			v->ntp_server_ads = "pool.ntp.org";
+		else
+			v->ntp_server_ads = arg.u.hrs;
+
+		lws_ntpc_retry_conn(&v->sul_conn);
+		break;
+
+	case LWS_CALLBACK_PROTOCOL_DESTROY: /* per vhost */
+		if (!v)
+			break;
+		if (v->wsi_udp)
+			lws_set_timeout(v->wsi_udp, 1, LWS_TO_KILL_ASYNC);
+		v->wsi_udp = NULL;
+		goto cancel_conn_timer;
+
+	/* callbacks related to raw socket descriptor */
+
+        case LWS_CALLBACK_RAW_ADOPT:
+		lwsl_debug("%s: LWS_CALLBACK_RAW_ADOPT\n", __func__);
+		lws_callback_on_writable(wsi);
+		break;
+
+        case LWS_CALLBACK_CLIENT_CONNECTION_ERROR:
+	case LWS_CALLBACK_RAW_CLOSE:
+		lwsl_debug("%s: LWS_CALLBACK_RAW_CLOSE\n", __func__);
+		v->wsi_udp = NULL;
+
+		/* cancel any pending write retry */
+		lws_sul_schedule(v->context, 0, &v->sul_write, NULL,
+				 LWS_SET_TIMER_USEC_CANCEL);
+
+		if (v->set_time)
+			goto cancel_conn_timer;
+
+		lws_retry_sul_schedule(v->context, 0, &v->sul_conn, &bo,
+				       lws_ntpc_retry_conn,
+				       &v->retry_count_conn);
+		break;
+
+	case LWS_CALLBACK_RAW_RX:
+
+		if (len != 48)
+			return 0; /* ignore it */
+
+		/*
+		 * First get the seconds, corrected for the ntp epoch of 1900
+		 * vs the unix epoch of 1970.  Then shift the seconds up by 1bn
+		 * and add in the ns
+		 */
+
+		ns = lws_ser_ru32be(((uint8_t *)in) + 40) - 2208988800;
+		ns = (ns * 1000000000) + lws_ser_ru32be(((uint8_t *)in) + 44);
+
+		lwsl_notice("%s: Unix time: %llu\n", __func__,
+				(unsigned long long)ns / 1000000000);
+
+	//	lws_system_get_ops(wsi->context)->set_clock(ns / 1000);
+
+		v->set_time = 1;
+		lws_state_transition_steps(&wsi->context->mgr_system,
+					   LWS_SYSTATE_OPERATIONAL);
+
+		/* close the wsi */
+		return -1;
+
+	case LWS_CALLBACK_RAW_WRITEABLE:
+
+		/*
+		 * UDP is not reliable, it can be locally dropped, or dropped
+		 * by any intermediary or the remote peer.  So even though we
+		 * will do the write in a moment, we schedule another request
+		 * for rewrite according to the wsi retry policy.
+		 *
+		 * If the result came before, we'll cancel it in the close flow.
+		 *
+		 * If we have already reached the end of our concealed retries
+		 * in the policy, just close without another write.
+		 */
+		if (lws_dll2_is_detached(&v->sul_write.list) &&
+		    lws_retry_sul_schedule_retry_wsi(wsi, &v->sul_write,
+						     lws_ntpc_retry_write,
+						     &v->retry_count_write)) {
+			/* we have reached the end of our concealed retries */
+			lwsl_warn("%s: concealed retries done, failing\n", __func__);
+			goto retry_conn;
+		}
+
+		memset(pkt + LWS_PRE, 0, sizeof(pkt) - LWS_PRE);
+		pkt[LWS_PRE] = (LWSNTPC_LI_NONE << 6) |
+			       (LWSNTPC_VN_3 << 3) |
+			       (LWSNTPC_MODE_CLIENT << 0);
+
+		if (lws_write(wsi, pkt + LWS_PRE, sizeof(pkt) - LWS_PRE, 0) ==
+						  sizeof(pkt) - LWS_PRE)
+			break;
+
+		lwsl_err("%s: Failed to write ntp client req\n", __func__);
+
+retry_conn:
+		lws_retry_sul_schedule(wsi->context, 0, &v->sul_conn, &bo,
+				       lws_ntpc_retry_conn,
+				       &v->retry_count_conn);
+
+		return -1;
+
+	default:
+		break;
+	}
+
+	return 0;
+
+
+cancel_conn_timer:
+	lws_sul_schedule(v->context, 0, &v->sul_conn, NULL,
+			 LWS_SET_TIMER_USEC_CANCEL);
+
+	return 0;
+}
+
+struct lws_protocols lws_system_protocol_ntpc =
+	{ "lws-ntpclient", callback_ntpc, 0, 128, };
+