diff --git a/CMakeLists.txt b/CMakeLists.txt index 378368007..9c0e7cabf 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -47,7 +47,8 @@ option(LWS_WITH_HTTP_BROTLI "Also offer brotli http stream compression (requires option(LWS_WITH_ACME "Enable support for ACME automatic cert acquisition + maintenance (letsencrypt etc)" OFF) option(LWS_WITH_HUBBUB "Enable libhubbub rewriting support" OFF) option(LWS_WITH_FTS "Full Text Search support" OFF) -option(LWS_WITH_SYS_ASYNC_DNS "Nonblocking internal IPv4 DNS resolver" OFF) +option(LWS_WITH_SYS_ASYNC_DNS "Nonblocking internal IPv4 + IPv6 DNS resolver" OFF) +option(LWS_WITH_SYS_NTPCLIENT "Build in tiny ntpclient good for tls date validation and run via lws_system" OFF) # # TLS library options... all except mbedTLS are basically OpenSSL variants. # @@ -1027,6 +1028,11 @@ if (LWS_WITH_NETWORK) lib/system/async-dns/async-dns-parse.c) endif() + if (LWS_WITH_SYS_NTPCLIENT) + list(APPEND SOURCES + lib/system/ntpclient/ntpclient.c) + endif() + if (LWS_WITH_DETAILED_LATENCY) list(APPEND SOURCES lib/core-net/detailed-latency.c) diff --git a/README.md b/README.md index b0b80d6ee..ab3b3d177 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,13 @@ functions like requesting a device reboot. See `READMEs/README.lws_system.md` for details. +## `lws_system`: ntpclient + +Optional lws system service enabled by cmake `-DLWS_WITH_SYS_NTPCLIENT` intercepts +the `lws_system` `TIME_VALID` state and performs ntpclient to get the date and time +before entering `TIME_VALID`. This allows user code to validate tls certificates +correctly knowing the current date and time by the time it reached OPERATIONAL. + ## Connection Validity tracking Lws now allows you to apply a policy for how long a network connection may go diff --git a/cmake/lws_config.h.in b/cmake/lws_config.h.in index 9adf8f4ce..4fbb868a7 100644 --- a/cmake/lws_config.h.in +++ b/cmake/lws_config.h.in @@ -140,6 +140,7 @@ #cmakedefine LWS_WITH_STRUCT_SQLITE3 #cmakedefine LWS_WITH_STRUCT_JSON #cmakedefine LWS_WITH_SQLITE3 +#cmakedefine LWS_WITH_SYS_NTPCLIENT #cmakedefine LWS_WITH_THREADPOOL #cmakedefine LWS_WITH_TLS #cmakedefine LWS_WITH_UNIX_SOCK diff --git a/lib/core/context.c b/lib/core/context.c index 0709d612a..e6f66880b 100644 --- a/lib/core/context.c +++ b/lib/core/context.c @@ -149,7 +149,7 @@ lws_create_context(const struct lws_context_creation_info *info) int lpf = info->fd_limit_per_thread; if (lpf) { - lpf++; + lpf+= 2; #if defined(LWS_WITH_SYS_ASYNC_DNS) lpf++; #endif diff --git a/lib/roles/http/client/client-handshake.c b/lib/roles/http/client/client-handshake.c index b7b10b134..77af3f11d 100644 --- a/lib/roles/http/client/client-handshake.c +++ b/lib/roles/http/client/client-handshake.c @@ -933,7 +933,7 @@ create_new_conn: */ lwsi_set_state(wsi, LRS_WAITING_DNS); - lwsl_warn("%s: %p: lookup %s:%u\n", __func__, wsi, ads, port); + lwsl_info("%s: %p: lookup %s:%u\n", __func__, wsi, ads, port); (void)port; #if defined(LWS_WITH_DETAILED_LATENCY) diff --git a/lib/system/async-dns/async-dns.c b/lib/system/async-dns/async-dns.c index 930499370..a72f3c98e 100644 --- a/lib/system/async-dns/async-dns.c +++ b/lib/system/async-dns/async-dns.c @@ -138,8 +138,8 @@ lws_async_dns_writeable(struct lws *wsi, lws_adns_q_t *q) * in the policy, just close without another write. */ if (lws_dll2_is_detached(&q->sul.list) && - lws_retry_sul_schedule_retry_wsi(wsi, &q->sul, lws_async_dns_sul_cb_retry, - &q->retry)) { + lws_retry_sul_schedule_retry_wsi(wsi, &q->sul, + lws_async_dns_sul_cb_retry, &q->retry)) { /* we have reached the end of our concealed retries */ lwsl_notice("%s: failing query\n", __func__); /* @@ -208,14 +208,6 @@ lws_async_dns_writeable(struct lws *wsi, lws_adns_q_t *q) assert(p < pkt + sizeof(pkt) - LWS_PRE); n = lws_ptr_diff(p, pkt + LWS_PRE); -/* - fd = lws_get_socket_fd(wsi); - if (fd < 0) - goto qfail; - - m = send(fd, pkt + LWS_PRE, n, 0); - */ - m = lws_write(wsi, pkt + LWS_PRE, n, 0); if (m != n) { lwsl_notice("%s: dns write failed %d %d\n", __func__, @@ -266,7 +258,7 @@ callback_async_dns(struct lws *wsi, enum lws_callback_reasons reason, case LWS_CALLBACK_RAW_RX: // lwsl_user("LWS_CALLBACK_RAW_RX (%d)\n", (int)len); - //lwsl_hexdump_level(LLL_NOTICE, in, len); + // lwsl_hexdump_level(LLL_NOTICE, in, len); lws_adns_parse_udp(dns, in, len); break; diff --git a/lib/system/ntpclient/ntpclient.c b/lib/system/ntpclient/ntpclient.c new file mode 100644 index 000000000..3a1ba3469 --- /dev/null +++ b/lib/system/ntpclient/ntpclient.c @@ -0,0 +1,283 @@ + /* + * libwebsockets - small server side websockets and web server implementation + * + * Copyright (C) 2010 - 2019 Andy Green + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to + * deal in the Software without restriction, including without limitation the + * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or + * sell copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS + * IN THE SOFTWARE. + */ + +#include "private-lib-core.h" + +#define LWSNTPC_LI_NONE 0 +#define LWSNTPC_VN_3 3 +#define LWSNTPC_MODE_CLIENT 3 + +struct vhd_ntpc { + struct lws_context *context; + struct lws_vhost *vhost; + const struct lws_protocols *protocol; + lws_sorted_usec_list_t sul_conn; + lws_sorted_usec_list_t sul_write; /* track write retries */ + lws_state_notify_link_t notify_link; + const char *ntp_server_ads; + struct lws *wsi_udp; + uint16_t retry_count_conn; + uint16_t retry_count_write; + + char set_time; +}; + +/* + * Without a valid ntp we won't be able to do anything requiring client tls. + * + * We have our own outer backoff scheme that just keeps retrying dns lookup + * and the transaction forever. + */ + +static const uint32_t botable[] = { 1000, 1250, 1500, 2000, 3000 }; +static const lws_retry_bo_t bo = { + botable, LWS_ARRAY_SIZE(botable), LWS_RETRY_CONCEAL_ALWAYS, 0, 0, 20 }; + +/* + * Once we resolved the remote server (implying we should have network), + * we use a different policy on the wsi itself that gives it a few tries before + * failing the wsi and using to outer retry policy to get dns to a different + * server in the pool and try fresh + */ + +static const uint32_t botable2[] = { 1000, 1250, 5000 /* in case dog slow */ }; +static const lws_retry_bo_t bo2 = { + botable2, LWS_ARRAY_SIZE(botable2), LWS_ARRAY_SIZE(botable2), + /* don't conceal after the last table entry */ 0, 0, 20 }; + +static void +lws_ntpc_retry_conn(struct lws_sorted_usec_list *sul) +{ + struct vhd_ntpc *v = lws_container_of(sul, struct vhd_ntpc, sul_conn); + + lwsl_debug("%s: wsi_udp: %p\n", __func__, v->wsi_udp); + + if (v->wsi_udp || !lws_dll2_is_detached(&v->sul_conn.list)) + return; + + /* create the UDP socket aimed at the server */ + + lwsl_debug("%s: server %s\n", __func__, v->ntp_server_ads); + + v->retry_count_write = 0; + v->wsi_udp = lws_create_adopt_udp(v->vhost, v->ntp_server_ads, 123, 0, + v->protocol->name, NULL, &bo2); + lwsl_debug("%s: created wsi_udp: %p\n", __func__, v->wsi_udp); + if (!v->wsi_udp) { + lwsl_err("%s: unable to create udp skt\n", __func__); + + lws_retry_sul_schedule(v->context, 0, &v->sul_conn, &bo, + lws_ntpc_retry_conn, &v->retry_count_conn); + } +} + +static void +lws_ntpc_retry_write(struct lws_sorted_usec_list *sul) +{ + struct vhd_ntpc *v = lws_container_of(sul, struct vhd_ntpc, sul_write); + + lwsl_debug("%s\n", __func__); + + if (v && v->wsi_udp) + lws_callback_on_writable(v->wsi_udp); +} + +static int +lws_sys_ntpc_notify_cb(lws_state_manager_t *mgr, lws_state_notify_link_t *l, + int current, int target) +{ + struct vhd_ntpc *v = lws_container_of(l, struct vhd_ntpc, notify_link); + + if (target != LWS_SYSTATE_TIME_VALID || v->set_time) + return 0; + + /* it's trying to do it ever since the protocol / vhost was set up */ + + return 1; +} + +static int +callback_ntpc(struct lws *wsi, enum lws_callback_reasons reason, void *user, + void *in, size_t len) +{ + struct vhd_ntpc *v = (struct vhd_ntpc *) + lws_protocol_vh_priv_get(lws_get_vhost(wsi), + lws_get_protocol(wsi)); + uint8_t pkt[LWS_PRE + 48]; + lws_system_arg_t arg; + uint64_t ns; + + switch (reason) { + + case LWS_CALLBACK_PROTOCOL_INIT: /* per vhost */ + if (v) + break; + + lwsl_debug("%s: LWS_CALLBACK_PROTOCOL_INIT\n", __func__); + lws_protocol_vh_priv_zalloc(wsi->vhost, wsi->protocol, + sizeof(*v)); + v = (struct vhd_ntpc *)lws_protocol_vh_priv_get(wsi->vhost, + wsi->protocol); + v->context = lws_get_context(wsi); + v->vhost = lws_get_vhost(wsi); + v->protocol = lws_get_protocol(wsi); + + if (!lws_system_get_ops(wsi->context) || + !lws_system_get_ops(wsi->context)->set_clock) { + lwsl_err("%s: set up system ops for set_clock\n", + __func__); + + // return -1; + } + + /* register our lws_system notifier */ + + v->notify_link.notify_cb = lws_sys_ntpc_notify_cb; + v->notify_link.name = "ntpclient"; + lws_state_reg_notifier(&wsi->context->mgr_system, &v->notify_link); + + if (lws_system_get_info(wsi->context, LWS_SYSI_HRS_NTP_SERVER, + &arg)) + v->ntp_server_ads = "pool.ntp.org"; + else + v->ntp_server_ads = arg.u.hrs; + + lws_ntpc_retry_conn(&v->sul_conn); + break; + + case LWS_CALLBACK_PROTOCOL_DESTROY: /* per vhost */ + if (!v) + break; + if (v->wsi_udp) + lws_set_timeout(v->wsi_udp, 1, LWS_TO_KILL_ASYNC); + v->wsi_udp = NULL; + goto cancel_conn_timer; + + /* callbacks related to raw socket descriptor */ + + case LWS_CALLBACK_RAW_ADOPT: + lwsl_debug("%s: LWS_CALLBACK_RAW_ADOPT\n", __func__); + lws_callback_on_writable(wsi); + break; + + case LWS_CALLBACK_CLIENT_CONNECTION_ERROR: + case LWS_CALLBACK_RAW_CLOSE: + lwsl_debug("%s: LWS_CALLBACK_RAW_CLOSE\n", __func__); + v->wsi_udp = NULL; + + /* cancel any pending write retry */ + lws_sul_schedule(v->context, 0, &v->sul_write, NULL, + LWS_SET_TIMER_USEC_CANCEL); + + if (v->set_time) + goto cancel_conn_timer; + + lws_retry_sul_schedule(v->context, 0, &v->sul_conn, &bo, + lws_ntpc_retry_conn, + &v->retry_count_conn); + break; + + case LWS_CALLBACK_RAW_RX: + + if (len != 48) + return 0; /* ignore it */ + + /* + * First get the seconds, corrected for the ntp epoch of 1900 + * vs the unix epoch of 1970. Then shift the seconds up by 1bn + * and add in the ns + */ + + ns = lws_ser_ru32be(((uint8_t *)in) + 40) - 2208988800; + ns = (ns * 1000000000) + lws_ser_ru32be(((uint8_t *)in) + 44); + + lwsl_notice("%s: Unix time: %llu\n", __func__, + (unsigned long long)ns / 1000000000); + + // lws_system_get_ops(wsi->context)->set_clock(ns / 1000); + + v->set_time = 1; + lws_state_transition_steps(&wsi->context->mgr_system, + LWS_SYSTATE_OPERATIONAL); + + /* close the wsi */ + return -1; + + case LWS_CALLBACK_RAW_WRITEABLE: + + /* + * UDP is not reliable, it can be locally dropped, or dropped + * by any intermediary or the remote peer. So even though we + * will do the write in a moment, we schedule another request + * for rewrite according to the wsi retry policy. + * + * If the result came before, we'll cancel it in the close flow. + * + * If we have already reached the end of our concealed retries + * in the policy, just close without another write. + */ + if (lws_dll2_is_detached(&v->sul_write.list) && + lws_retry_sul_schedule_retry_wsi(wsi, &v->sul_write, + lws_ntpc_retry_write, + &v->retry_count_write)) { + /* we have reached the end of our concealed retries */ + lwsl_warn("%s: concealed retries done, failing\n", __func__); + goto retry_conn; + } + + memset(pkt + LWS_PRE, 0, sizeof(pkt) - LWS_PRE); + pkt[LWS_PRE] = (LWSNTPC_LI_NONE << 6) | + (LWSNTPC_VN_3 << 3) | + (LWSNTPC_MODE_CLIENT << 0); + + if (lws_write(wsi, pkt + LWS_PRE, sizeof(pkt) - LWS_PRE, 0) == + sizeof(pkt) - LWS_PRE) + break; + + lwsl_err("%s: Failed to write ntp client req\n", __func__); + +retry_conn: + lws_retry_sul_schedule(wsi->context, 0, &v->sul_conn, &bo, + lws_ntpc_retry_conn, + &v->retry_count_conn); + + return -1; + + default: + break; + } + + return 0; + + +cancel_conn_timer: + lws_sul_schedule(v->context, 0, &v->sul_conn, NULL, + LWS_SET_TIMER_USEC_CANCEL); + + return 0; +} + +struct lws_protocols lws_system_protocol_ntpc = + { "lws-ntpclient", callback_ntpc, 0, 128, }; +