1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-09 00:00:04 +01:00
Commit graph

178 commits

Author SHA1 Message Date
Jed Lu
0a453e3be3 tls: wrapper: make sure alpn freed once 2021-02-03 08:49:59 +00:00
Andy Green
334212ef2e windows: mbedtls: clean warnings 2021-01-29 21:22:35 +00:00
Andy Green
fd24392cd3 tls: add cmake options to dump tls 2021-01-23 20:58:36 +00:00
Andy Green
e5b191be35 h2: post buflist: track rx_content_length
On h2 server POST, there's a race to see if the POST body is going to be
received coalesced with the headers.

The problem is on h2, we can't action the stream http request or body until
the stream is writeable, since we may start issuing the response right away;
there's already DEFERRING_ACTION state to manage this.  And indeed, the
coalesced, not-immediately-actionable POST body is buflisted properly.

However when we come to action the POST using buflisted data, we don't follow
the same pattern as dealing with the incoming data immediately.

This patch aligns the pattern dumping the buflist content to track
expected rx_content_length and handle BODY_COMPLETION if we got to
the end of it, along with removal from the pt list of wsi with pending
buflists if we used it up.
2021-01-18 19:49:02 +00:00
Andy Green
c403b129ad mbedtls: change cert load semantics to append
Adapt the wrapper for SSL_CTX_add_client_CA_ASN1 to reuse
any existing x.509 chain and just add to it.  Previously it
was replacing it.
2021-01-13 20:05:59 +00:00
Andy Green
ce3b99cd8f clean: reduce logging and add some conditional debug helpers 2021-01-05 10:56:38 +00:00
Andy Green
c9731c5f17 type comparisons: fixes
This is a huge patch that should be a global NOP.

For unix type platforms it enables -Wconversion to issue warnings (-> error)
for all automatic casts that seem less than ideal but are normally concealed
by the toolchain.

This is things like passing an int to a size_t argument.  Once enabled, I
went through all args on my default build (which build most things) and
tried to make the removed default cast explicit.

With that approach it neither change nor bloat the code, since it compiles
to whatever it was doing before, just with the casts made explicit... in a
few cases I changed some length args from int to size_t but largely left
the causes alone.

From now on, new code that is relying on less than ideal casting
will complain and nudge me to improve it by warnings.
2021-01-05 10:56:38 +00:00
Andy Green
0ceba15d9c lws_lifecycle
This adds some new objects and helpers for keeping and logging
info on grouped allocations, a group is, eg, SS handles or client
wsis.

Allocated objects get a context-unique "tag" string intended to replace
%p / wsi pointers etc.  Pointers quickly become confusing when
allocations are freed and reused, the tag string won't repeat
until you produce 2^64 objects in a context.

In addition the tag string documents the object group, with prefixes
like "wsi-" or "vh-" and contain object-specific additional
information like the vhost name, address / port  or the role of the wsi.
At creation time the lws code can use a format string and args
to add whatever group-specific info makes sense, eg, a wsi bound
to a secure stream can also append the guid of the secure stream,
it's copied into the new object tag and so is still available
cleanly after the stream is destroyed if the wsi outlives it.
2021-01-04 05:26:50 +00:00
Sakthi Kannan
1a8979b68c mbedtls: use lws helper for PEM DER import 2020-09-16 07:07:04 +01:00
Andy Green
692f269045 coverity: 62140: if newer mbedtls apis available use and check returns
mbedtls has older and newer hashing apis, if we detected the newer ones
we use them like the older ones since generally, hashing doesn't have a
way to fail for sha and md5 update etc.

Coverity objects... change it to dumbly check the retcode.
2020-08-19 07:46:21 +01:00
Andy Green
cc5fb48598 coverity: 21034: dont bother assigning shutdown api return 2020-08-18 14:00:54 +01:00
Andy Green
520befb554 coverity: 61708: privkey required for mbedtls 2020-08-18 14:00:54 +01:00
Andy Green
7b847f8315 coverity: 62212: coverity says its dead code 2020-08-18 14:00:54 +01:00
Andy Green
a424623dc6 docs: add README-debugging.md and provide example points for decrypted traffic handling
Some general debugging advice but also really clarify the official way of how to dump
what is going out and coming in directly from the tls tunnel, so you can see the
actual data unencrypted.
2020-07-30 16:23:59 +01:00
Andy Green
1a93e73402 fakewsi: replace with smaller substructure
Currently we always reserve a fakewsi per pt so events that don't have a related actual
wsi, like vhost-protocol-init or vhost cert init via protocol callback can make callbacks
that look reasonable to user protocol handler code expecting a valid wsi every time.

This patch splits out stuff that user callbacks often unconditionally expect to be in
a wsi, like context pointer, vhost pointer etc into a substructure, which is composed
into struct lws at the top of it.  Internal references (struct lws is opaque, so there
are only internal references) are all updated to go via the substructre, the compiler
should make that a NOP.

Helpers are added when fakewsi is used and referenced.

If not PLAT_FREERTOS, we continue to provide a full fakewsi in the pt as before,
although the helpers improve consistency by zeroing down the substructure.  There is
a huge amount of user code out there over the last 10 years that did not always have
the minimal examples to follow, some of it does some unexpected things.

If it is PLAT_FREERTOS, that is a newer thing in lws and users have the benefit of
being able to follow the minimal examples' approach.  For PLAT_FREERTOS we don't
reserve the fakewsi in the pt any more, saving around 800 bytes.  The helpers then
create a struct lws_a (the substructure) on the stack, zero it down (but it is only
like 4 pointers) and prepare it with whatever we know like the context.

Then we cast it to a struct lws * and use it in the user protocol handler call.
In this case, the remainder of the struct lws is undefined.  However the amount of
old protocol handlers that might touch things outside of the substructure in
PLAT_FREERTOS is very limited compared to legacy lws user code and the saving is
significant on constrained devices.

User handlers should not be touching everything in a wsi every time anyway, there
are several cases where there is no valid wsi to do the call with.  Dereference of
things outside the substructure should only happen when the callback reason shows
there is a valid wsi bound to the activity (as in all the minimal examples).
2020-07-20 06:28:52 +01:00
Andy Green
6b3221ffc1 mbedtls: only free crt_parse when something came back
Mbedtls mbedtls_x509_crt_parse() returns 0 for success which is good.
But it has a complicated idea about what to return on fail... if it
couldn't make even one cert from the data, then it returns a negative
return indicating the parsing problem and there is nothing to free.

If it managed to parse at least one cert, instead it retuns a positive
number indicating the number of certs it didn't parse successfully,
and there is something to free.

Adapt the code to understand this quirk.
2020-07-09 15:30:34 +01:00
Andy Green
2a772776a9 windows: for data exports use explicit extern
LWS_EXTERN needs to be empty for windows when declaring functions in the
headers.  But for data, it needs the explicit extern otherwise on windows
or mingw based builds, it thinks we are redeclaring the data each time.
2020-06-07 07:53:36 +01:00
alex
5d514b35fc tls: add read client .pem or .der from memory #1941
and added read private key from mem
2020-06-06 13:09:31 +01:00
Andy Green
b3131fdfdd cmakelist: Augean Stables refactor
Establish a new distributed CMake architecture with CMake code related to
a source directory moving to be in the subdir in its own CMakeLists.txt.
In particular, there's now one in ./lib which calls through to ones
further down the directory tree like ./lib/plat/xxx, ./lib/roles/xxx etc.

This cuts the main CMakelists.txt from 98KB -> 33KB, about a 66% reduction,
and it's much easier to maintain sub-CMakeLists.txt that are in the same
directory as the sources they manage, and conceal all the details that that
level.

Child CMakelists.txt become responsible for:

 - include_directories() definition (this is not supported by CMake
   directly, it passes it back up via PARENT_SCOPE vars in helper
   macros)

 - Addition child CMakeLists.txt inclusion, for example toplevel ->
   role -> role subdir

 - Source file addition to the build

 - Dependent library path resolution... this is now a private thing
   in the child CMakeLists.txt, it just passes back any adaptations
   to include_directories() and the LIB_LIST without filling the
   parent namespace with the details
2020-05-27 08:40:12 +01:00
Andy Green
cabe021955 esp32: shift to support latest esp-idf
Esp-idf has an improved but still kind of abused cmake-
based build system now.

If we see ESP_PLATFORM coming as a cmake var, we can know we
are being built from inside the esp-idf config system.

Leave the existing esp32 arrangements alone but triggered off
ESP_PLATFORM, adapt to use the cross toolchain file and
various quirks automatically.

In this way you can build lws a part of your project in a
much cleaner way.

Prepare a minimal esp32 test app for use in Sai

Adapt .sai.json to build for esp32
2020-05-27 08:40:12 +01:00
Andy Green
33f8e219eb tls: defer listing of pending tls wsi to be managed by tls read only
https://github.com/warmcat/libwebsockets/issues/1920
2020-05-27 08:40:12 +01:00
Andy Green
9f1d019352 CTest: migrate and deprecate existing selftest scripts
Replace the bash selftest plumbing with CTest.

To use the selftests, build with -DLWS_WITH_MINIMAL_EXAMPLES=1
and `CTEST_OUTPUT_ON_FAILURE=1 make test` or just
`make test`.

To disable tests that require internet access, also give
-DLWS_CTEST_INTERNET_AVAILABLE=0

Remove travis and appveyor scripts on master.

Remove travis and appveyor decals on README.md.
2020-05-11 15:40:13 +01:00
Andy Green
e4c59e3a91 osx: mbedtls: SYSCALL and errno 35 is WANT_READ 2020-04-17 12:39:53 +01:00
Andy Green
39b05e7db3 mbedtls: remove mbedtls_x509_crt_info reference
Nobody uses this from the wrapper... it brings in mbedtls_x509_crt_info()
even if you're using -ffunctionsections for a loss of about 1.7KB on Arm.


Let's chop it out...
2020-03-31 11:36:47 +01:00
Andy Green
be32d0554e mbedtls: attempt to remove dependency on net_sockets.c
The mbedtls openssl wrapper wants to use exports from mbedtls' net_sockets.c,
but this is only supposed to work on *nix and windows.  Typically people
are using mbedtls on RTOS type platforms and to use it, net_sockets.c
needs some hacking.

Try to avoid that situation by porting the two exports we need into the
lws plat code and call from the wrapper.
2020-03-27 13:24:44 +00:00
Andy Green
2a7a92f4d5 mbedtls: support old 2.2-era version from xenial 2020-03-21 14:43:53 +00:00
Andy Green
11837db0e0 mbedtls: support older versions without net_sockets.h 2020-03-19 10:14:25 +00:00
Andy Green
7efe93bb34 fallback: dont check after first ssl accept attempt 2020-03-06 10:18:43 +00:00
Andy Green
bb1a8d37fb rtos diet: make basic auth support a config option on by default
Remove wrapper content for < tls v1.2
2020-03-04 11:00:04 +00:00
Andy Green
3c663da99e rtos diet: mbedtls: wrapper: delete unused functions
Surprisingly -fdata-sections -ffunction-sections does not remove any string literals and __func__
implicit .rodata generated by the removed function's compilation.

That means potentially considerable deadweight is in the image even if the function is removed
at linktime.
2020-03-04 11:00:04 +00:00
Andy Green
0dd23d7073 tls restriction: account for pipelining and add test 2020-03-01 08:14:43 +00:00
dzakarias
3d8fbdd3ac Added missing PKCS#7 padding/unpadding from AES-CBC in JWE 2020-02-21 17:32:41 +00:00
Andy Green
ac1229f2f7 minimal-http-client-multi: add POST
This adds support for POST in both h1 and h2 queues / stream binding.

The previous queueing tried to keep the "leader" wsi who made the
actual connection around and have it act on the transaction queue
tail if it had done its own thing.

This refactors it so instead, who is the "leader" moves down the
queue and the queued guys inherit the fd, SSL * and queue from the
old leader as they take over.

This lets them operate in their own wsi identity directly and gets
rid of all the "effective wsi" checks, which was applied incompletely
and getting out of hand considering the separate lws_mux checks for
h2 and other muxed protocols alongside it.

This change also allows one wsi at a time to own the transaction for
POST.  --post is added as an option to lws-minimal-http-client-multi
and 6 extra selftests with POST on h1/h2, pipelined or not and
staggered or not are added to the CI.
2020-02-21 17:32:41 +00:00
Andy Green
66b2a4a645 tls: apply restriction if any also to client connections 2020-01-15 16:32:48 +00:00
Andy Green
0bfd39135e cleaning 2020-01-05 22:17:58 +00:00
Andy Green
2eeec91d3d tls: lws_system per-connection client certs
Now the generic lws_system blobs can cover client certs + key, let's
add support for applying one of the blob sets to a specific client
connection (rather than doing it via the vhost).
2019-12-09 14:48:54 +00:00
Andy Green
8e91a0d723 mbedtls: cast ecdh enum type for some toolchains 2019-11-27 07:39:37 +00:00
Andy Green
6ed3d8a9dd client: also allow stashed host param for client tls
Client connection items for protocols other than http ones
will never get into an ah.  Allow use of the values from the
client stash allocation instead if present.
2019-11-20 10:24:48 +00:00
Andy Green
0f7f27801e http redirect: 303: force method to GET
This teaches http client stuff how to handle 303 redirects... these
can happen after POST where the server side wants you to come back with
a GET to the Location: mentioned.

lws client will follow the redirect and force GET, this works for both
h1 and h2.  Client protocol handler has to act differently if it finds
it is connecting for the initial POST or the subsequent GET, it can
find out which by checking a new api lws_http_is_redirected_to_get(wsi)
which returns nonzero if in GET mode.

Minimal example for server form-post has a new --303 switch to enable
this behaviour there and the client post example has additions to
check lws_http_is_redirected_to_get().
2019-11-17 10:47:01 +00:00
Andy Green
2bc0b97b45 acme: mbedtls: update genrsa apis 2019-11-06 16:02:33 +00:00
Andy Green
d808748cd6 detailed latency stats
Remove LWS_LATENCY.

Add the option LWS_WITH_DETAILED_LATENCY, allowing lws to collect very detailed
information on every read and write, and allow the user code to provide
a callback to process events.
2019-09-22 03:06:59 -07:00
Andy Green
3cbeef5d26 lws_tls_client_vhost_extra_cert_mem 2019-09-06 15:30:51 +01:00
Andy Green
0fa5563d18 freertos: rename esp32 plat to freertos 2019-08-26 09:58:57 +01:00
Andy Green
ae69bfbd10 debloat: remove things from being built by default that should be conditional 2019-08-26 09:58:57 +01:00
Andy Green
d7f0521aeb private.h: rename to contain dir
Having unique private header names is a requirement of a particular
platform build system it's desirable to work with
2019-08-15 10:49:52 +01:00
Andy Green
26319663f7 license: switch LGPLv2.1+SLE parts to MIT 2019-08-14 10:44:38 +01:00
Andy Green
2fc35ef6bd stats: move to pt and improve presentation 2019-08-12 06:18:04 +01:00
Andy Green
498a4e2bd7 sul: all timed objects use a single pt sul list
wsi timeout, wsi hrtimer, sequencer timeout and vh-protocol timer
all now participate on a single sorted us list.

The whole idea of polling wakes is thrown out, poll waits ignore the
timeout field and always use infinite timeouts.

Introduce a public api that can schedule its own callback from the event
loop with us resolution (usually ms is all the platform can do).

Upgrade timeouts and sequencer timeouts to also be able to use us resolution.

Introduce a prepared fakewsi in the pt, so we don't have to allocate
one on the heap when we need it.

Directly handle vh-protocol timer if LWS_MAX_SMP == 1
2019-08-09 10:12:09 +01:00
Andy Green
3c12fd72e8 unify us sorted waits
There are quite a few linked-lists of things that want events after
some period.  This introduces a type binding an lws_dll2 for the
list and a lws_usec_t for the duration.

The wsi timeouts, the hrtimer and the sequencer timeouts are converted
to use these, also in the common event wait calculation.
2019-08-08 22:39:47 +01:00
Andy Green
45ec3ce369 lws_dll: upgrade all instances to lws_dll2
lws_dll2 removes the downsides of lws_dll and adds new features like a
running member count and explicit owner type... it's cleaner and more
robust (eg, nodes know their owner, so they can casually switch between
list owners and remove themselves without the code knowing the owner).

This deprecates lws_dll, but since it's public it allows it to continue
to be built for 4.0 release if you give cmake LWS_WITH_DEPRECATED_LWS_DLL.

All remaining internal users of lws_dll are migrated to lws_dll2.
2019-08-08 16:58:55 +01:00