Mirrors/libwebsockets
1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-30 00:00:16 +01:00
Code Issues Releases Wiki Activity

remove LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY callback

Browse source 
When a certificate for a TLS connection is provided, but a private
key is not, the SSL_CTX initialization exits early, before the
CONTEXT_REQUIRES_PRIVATE_KEY callback can be issued.
Remove the now obsolete callback and update the vhost
field description to state that the LOAD_EXTRA_SERVER_VERIFY_CERTS
callback should be used instead.
This commit is contained in:
Damian Hobson-Garcia 2022-08-17 00:16:27 +09:00 • committed by Andy Green
parent 50f32d0da2
commit a5ea6eabca
3 changed files with 17 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
include/libwebsockets/lws-callbacks.h
View file

@ -160,15 +160,6 @@ enum lws_callback_reasons {
* the default callback action of returning 0 allows the client * the default callback action of returning 0 allows the client
* certificates. */ * certificates. */
LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY = 37,
/**< if configured for including OpenSSL support but no private key
* file has been specified (ssl_private_key_filepath is NULL), this is
* called to allow the user to set the private key directly via
* libopenssl and perform further operations if required; this might be
* useful in situations where the private key is not directly accessible
* by the OS, for example if it is stored on a smartcard.
* user is the server's OpenSSL SSL_CTX* */
LWS_CALLBACK_SSL_INFO = 67, LWS_CALLBACK_SSL_INFO = 67,
/**< SSL connections only. An event you registered an /**< SSL connections only. An event you registered an
* interest in at the vhost has occurred on a connection * interest in at the vhost has occurred on a connection

13
include/libwebsockets/lws-context-vhost.h
View file

@ -393,10 +393,15 @@ struct lws_context_creation_info {
*/ */
const char *ssl_private_key_filepath; const char *ssl_private_key_filepath;
/**< VHOST: filepath to private key if wanting SSL mode; /**< VHOST: filepath to private key if wanting SSL mode;
* if this is set to NULL but ssl_cert_filepath is set, the * this should not be set to NULL when ssl_cert_filepath is set.
* OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY callback is called *
* to allow setting of the private key directly via openSSL * Alteratively, the certificate and private key can both be set in
* library calls. (For backwards compatibility, this can also be used * the OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS callback directly via
* openSSL library calls. This requires that
* LWS_SERVER_OPTION_CREATE_VHOST_SSL_CTX is set in the vhost info options
* to force initializtion of the SSL_CTX context.
*
* (For backwards compatibility, this can also be used
* to pass the client cert private key filepath when setting up a * to pass the client cert private key filepath when setting up a
* vhost client SSL context, but it is preferred to use * vhost client SSL context, but it is preferred to use
* .client_ssl_private_key_filepath for that.) * .client_ssl_private_key_filepath for that.)

26
lib/tls/openssl/openssl-server.c
View file

@ -228,7 +228,10 @@ lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi,
return 1; return 1;
} }
if (private_key) { if (!private_key) {
lwsl_err("ssl private key not set\n");
return 1;
} else {
/* set the private key from KeyFile */ /* set the private key from KeyFile */
if (SSL_CTX_use_PrivateKey_file(vhost->tls.ssl_ctx, private_key, if (SSL_CTX_use_PrivateKey_file(vhost->tls.ssl_ctx, private_key,
SSL_FILETYPE_PEM) != 1) { SSL_FILETYPE_PEM) != 1) {
@ -244,14 +247,6 @@ lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi,
private_key, error, s); private_key, error, s);
return 1; return 1;
} }
} else {
if (vhost->protocols[0].callback(wsi,
LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY,
vhost->tls.ssl_ctx, NULL, 0)) {
lwsl_err("ssl private key not set\n");
return 1;
}
} }
return 0; return 0;
@ -389,7 +384,10 @@ lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi,
return 1; return 1;
} }
if (n != LWS_TLS_EXTANT_ALTERNATIVE && private_key) { if (n == LWS_TLS_EXTANT_ALTERNATIVE || !private_key) {
lwsl_err("ssl private key not set\n");
return 1;
} else {
/* set the private key from KeyFile */ /* set the private key from KeyFile */
if (SSL_CTX_use_PrivateKey_file(vhost->tls.ssl_ctx, private_key, if (SSL_CTX_use_PrivateKey_file(vhost->tls.ssl_ctx, private_key,
SSL_FILETYPE_PEM) != 1) { SSL_FILETYPE_PEM) != 1) {
@ -400,14 +398,6 @@ lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi,
(char *)vhost->context->pt[0].serv_buf)); (char *)vhost->context->pt[0].serv_buf));
return 1; return 1;
} }
} else {
if (vhost->protocols[0].callback(wsi,
LWS_CALLBACK_OPENSSL_CONTEXT_REQUIRES_PRIVATE_KEY,
vhost->tls.ssl_ctx, NULL, 0)) {
lwsl_err("ssl private key not set\n");
return 1;
}
} }
check_key: check_key: