After startup, and once per day, check the validity dates on our ssl certs,
and broadcast callbacks with the information so interested plugins can
know.
If our clock is < May 2016, we don't try to judge the certs, because clearly
we don't know what time it is.
apart from LWS_WITHOUT_TEST_SERVER the test server will also not be
built if LWS_WITHOUT_TESTAPPS or LWS_WITHOUT_SERVER is defined,
we update the CMake configuration to skip cert generation and
installation in those cases.
Signed-off-by: Adam Wolk <adam.wolk@koparo.com>
Check for LWS_SERVER_OPTION_PEER_CERT_NOT_REQUIRED...
AG: Fix missing stanza needed to confirm client cert needed at all
Signed-off-by: Petar Paradzik <petar.paradzik@sartura.hr>
This adds a single api on lws that allows querying elements from the
peer certificate on a connection.
The api works the same regardless of the TLS backend.
- Add platform helpers for pipe creation.
- Change the direct-to-fds implementation to create a wsi for each
pt and use the normal apis to bind it to the event loop.
- Modifiy context creation and destroy to create and remove the
event pipe wsis.
- Create the event pipe wsis during context create if using the
default poll() event loop, or when the other event loops start
otherwise.
- Add handler that calls back user code with
LWS_CALLBACK_EVENT_WAIT_CANCELLED
This patch allows you to call `lws_cancel_service(struct lws_context *context)`
from another thread.
It's very cheap for the other thread to call and is safe without
locking.
Every use protocol receives a LWS_CALLBACK_EVENT_WAIT_CANCELLED from
the main thread serialized normally in the event loop.
This adds some optional apis around JSON Web Keys and JSON Web Signatures.
HMAC SHA256/384/512 and RSA + SHA256/384/512 are supported.
This also add a new "LWS_WITH_SELFTESTS" that enables the selftests.
Like the simple hashes, these work the same regardless of if the backend is
OpenSSL or mbedTLS.
Also move into ./lib/tls/ and split into two specific to mbedtls or openssl
backends.
The URL encode variant is the same, except + is coded as -, and / is coded as _
to avoid urlencoding when the base64 is used in situations that are urlencoded.
1) The original wrapper logic for accounting for partial
sends on mbedtls is broken... adapt it
2) mbedtls has an additional restriction you MUST come
back to retry with EXACTLY the unsent part that you
originally asked for, or it loses coherency in the TLS
tunnel.
3) the wrapper is inconsistent between read WANT state
dynamically reported from mbedtls apis and the
SSL_want() api results. Check both on read.
