Mirrors/libwebsockets
1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-09 00:00:04 +01:00
Code Issues Releases Wiki Activity

jit-trust: adapt for esp-idf pre v3 mbedtls

Browse source 
Ensure we still work with mbedtls_ssl_conf_verify() as well as
mbedtls_ssl_set_verify() if that's what we have got.

Make sure mbedtls tls validation is noisy and fast.

Disable Xenial + mbedtls in sai, it fails but not when the same
tests are run from the commandline.  Very few people will be
using Xenial (2016 Ubuntu release) with mbedtls.
This commit is contained in:
Andy Green 2022-02-04 07:34:54 +00:00
parent f57d84f6fc
commit ba2441585d
4 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.sai.json
View file

@ -243,11 +243,11 @@
"mbedtls": { "mbedtls": {
"cmake": "-DLWS_WITH_MBEDTLS=1 -DLWS_WITH_HTTP2=1 -DLWS_WITH_LWSWS=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_JOSE=1 -DCMAKE_BUILD_TYPE=DEBUG", "cmake": "-DLWS_WITH_MBEDTLS=1 -DLWS_WITH_HTTP2=1 -DLWS_WITH_LWSWS=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_JOSE=1 -DCMAKE_BUILD_TYPE=DEBUG",
# no distro -devel package for mbedtls # no distro -devel package for mbedtls
"platforms": "not linux-centos-7/x86_64-amd/gcc, not linux-centos-8/x86_64-amd/gcc" "platforms": "not linux-centos-7/x86_64-amd/gcc, not linux-centos-8/x86_64-amd/gcc, not linux-ubuntu-xenial/x86_64-amd/gcc"
}, },
"mbedtls-metrics": { "mbedtls-metrics": {
"cmake": "-DLWS_WITH_MBEDTLS=1 -DLWS_WITH_HTTP2=1 -DLWS_WITH_LWSWS=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_JOSE=1 -DCMAKE_BUILD_TYPE=DEBUG -DLWS_WITH_SYS_METRICS=1", "cmake": "-DLWS_WITH_MBEDTLS=1 -DLWS_WITH_HTTP2=1 -DLWS_WITH_LWSWS=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_JOSE=1 -DCMAKE_BUILD_TYPE=DEBUG -DLWS_WITH_SYS_METRICS=1",
"platforms": "not linux-centos-7/x86_64-amd/gcc, not linux-centos-8/x86_64-amd/gcc" "platforms": "not linux-centos-7/x86_64-amd/gcc, not linux-centos-8/x86_64-amd/gcc, not linux-ubuntu-xenial/x86_64-amd/gcc"
}, },
"noserver": { "noserver": {
"cmake": "-DLWS_WITHOUT_SERVER=ON -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_SECURE_STREAMS=1", "cmake": "-DLWS_WITHOUT_SERVER=ON -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_SECURE_STREAMS=1",

3
lib/tls/mbedtls/mbedtls-client.c
View file

@ -272,7 +272,8 @@ lws_tls_client_connect(struct lws *wsi, char *errbuf, size_t elen)
if (!n) /* we don't know what he wants, but he says to retry */ if (!n) /* we don't know what he wants, but he says to retry */
return LWS_SSL_CAPABLE_MORE_SERVICE; return LWS_SSL_CAPABLE_MORE_SERVICE;
if (m == SSL_ERROR_SYSCALL && !en) if (m == SSL_ERROR_SYSCALL && !en && n >= 0) /* otherwise we miss explicit failures and spin
* in hs state 17 until timeout... */
return LWS_SSL_CAPABLE_MORE_SERVICE; return LWS_SSL_CAPABLE_MORE_SERVICE;
lws_snprintf(errbuf, elen, "mbedtls connect %d %d %d", n, m, en); lws_snprintf(errbuf, elen, "mbedtls connect %d %d %d", n, m, en);

4
lib/tls/mbedtls/wrapper/platform/ssl_pm.c
View file

@ -98,7 +98,6 @@ static void ssl_platform_debug(void *ctx, int level,
} }
//#endif //#endif
#if defined(LWS_HAVE_mbedtls_ssl_set_verify)
static int static int
lws_mbedtls_f_vrfy(void *opaque, mbedtls_x509_crt *x509, int state, uint32_t *pflags) lws_mbedtls_f_vrfy(void *opaque, mbedtls_x509_crt *x509, int state, uint32_t *pflags)
{ {
@ -109,7 +108,6 @@ lws_mbedtls_f_vrfy(void *opaque, mbedtls_x509_crt *x509, int state, uint32_t *pf
return 0; return 0;
} }
#endif
/** /**
* @brief create SSL low-level object * @brief create SSL low-level object
@ -151,6 +149,8 @@ int ssl_pm_new(SSL *ssl)
#if defined(LWS_HAVE_mbedtls_ssl_set_verify) #if defined(LWS_HAVE_mbedtls_ssl_set_verify)
mbedtls_ssl_set_verify(&ssl_pm->ssl, lws_mbedtls_f_vrfy, ssl_pm); mbedtls_ssl_set_verify(&ssl_pm->ssl, lws_mbedtls_f_vrfy, ssl_pm);
#else
mbedtls_ssl_conf_verify(&ssl_pm->conf, lws_mbedtls_f_vrfy, ssl_pm);
#endif #endif
ret = mbedtls_ctr_drbg_seed(&ssl_pm->ctr_drbg, mbedtls_entropy_func, &ssl_pm->entropy, pers, pers_len); ret = mbedtls_ctr_drbg_seed(&ssl_pm->ctr_drbg, mbedtls_entropy_func, &ssl_pm->entropy, pers, pers_len);

6
lib/tls/tls-client.c
View file

@ -66,6 +66,12 @@ lws_ssl_client_connect2(struct lws *wsi, char *errbuf, size_t len)
switch (n) { switch (n) {
case LWS_SSL_CAPABLE_ERROR: case LWS_SSL_CAPABLE_ERROR:
lws_tls_restrict_return_handshake(wsi); lws_tls_restrict_return_handshake(wsi);
if (lws_tls_client_confirm_peer_cert(wsi, errbuf, len)) {
lws_metrics_caliper_report(wsi->cal_conn, METRES_NOGO);
return -1;
}
// lws_snprintf(errbuf, len, "client connect failed"); // lws_snprintf(errbuf, len, "client connect failed");
return -1; return -1;
case LWS_SSL_CAPABLE_DONE: case LWS_SSL_CAPABLE_DONE: