1
0
Fork 0
mirror of https://github.com/warmcat/libwebsockets.git synced 2025-03-16 00:00:07 +01:00
Commit graph

96 commits

Author SHA1 Message Date
Chunho Lee
8eb6cbf5ac minimal: ss: policy2c: update MQTT fields 2022-05-17 15:37:16 +01:00
Chunho Lee
a80fbeb820 ss: mqtt: add support for retained message 2022-02-07 09:37:34 +00:00
Chunho Lee
7e3125b818 minimal: ss: policy2c: add more MQTT related fields
This adds 'aws_iot', 'birth_topic', and 'birth_message'
on policy2c.
2022-02-03 11:28:33 +00:00
Andy Green
ee15b82b6e cmake: unbreak LWS_WITH_SYS_STATE disabled build 2021-10-05 07:40:17 +01:00
Andy Green
3e54c84a18 ss: mass update LE root to isrg part 2 2021-10-05 06:48:03 +01:00
Andy Green
d075d4f9ca ctest: increase timeouts on tests using warmcat 2021-09-09 15:27:41 +01:00
Andy Green
81a3ca3e84 ss: port binance example 2021-08-31 05:45:40 +01:00
Andy Green
f6911cdab8 minimal: perf: add --test404[red] switches
--test404 sends us instead to httpbin.org/status/404
 --test404red goes to warmcat.com/noexist.html which is handled as a
              redirect to a 404 page (served with a 200...), streamtype
              allows redirects to be followed
 --test404redref same as above but streamtype disallows redirect follow

These should all produce CONMON results for the first response, be it 404
or 302 and whether the 302 was followed or not, and whether the client
goes via the proxy or not.
2021-08-19 10:02:16 +01:00
Zhao Lou
2951a92ed8 conmon: fix missing quote in JSON 2021-08-19 05:28:27 +01:00
Andy Green
243c21deac ss: add fault injections in creation
Add 9 fault injection cases in SS creation flow, and 5 of those
instantiate in the minimal examples ctests.  The other 4 relate
to static policy and server, I tested the server ones by hand.

These tests confirm the recent change to unpick create using
lws_ss_destroy.
2021-08-16 08:07:35 +01:00
Andy Green
e644bb4a6e cpd: pass up lws_ss_request_tx ret 2021-08-16 08:07:32 +01:00
Andy Green
f3d5b9b99a service: assert on thread shenanigans 2021-08-13 05:25:01 +01:00
Jed Lu
62b915c879 ss: increase set_metadata length type to size_t 2021-08-09 17:31:16 +01:00
Andy Green
fabe78d222 Wextra
Add -Wextra (with -Wno-unused-parameter) to unix builds in addition to
-Wall -Werror.

This can successfully build everything in Sai without warnings / errors.
2021-07-04 10:29:54 +01:00
Andy Green
5432e8ae7b sspc: add concurrency stress
Add a way to perform sspc tests with increased concurrency and sequential
tests
2021-07-04 10:29:52 +01:00
Andy Green
8e76634ed3 logs: introduce log_cx 2021-07-01 05:20:53 +01:00
Jed Lu
c2e10db5f2 ss-policy2c-update 2021-06-26 12:31:44 +01:00
Andy Green
3ef0b0268d ctest: do not reuse ctest-ssp path 2021-06-22 15:54:05 +01:00
Jed Lu
2abf4115a8 ss: direct protocol string 2021-06-11 14:44:10 +01:00
Jed Lu
e82778e07a ss: static policy for sigv4 2021-06-11 14:25:12 +01:00
Andy Green
0517a2a629 ss: split out blob into own minimal example
The --blob option requires GENCRYPTO that's not on by default, to handle
the hash checks... that's going to cause a lot of confusion because it
means the simplest ss example won't build by default then.

Let's remove the blob support (and GENCRYPTO dependency) from the simplest
example and make a new minimal-secure-streams-blob example that has --blob
support and the GENCRYPTO dependency as well.
2021-05-28 10:10:15 +01:00
Yichen Gu
5fdd9c99b1 ss: policy2c: type error on respmap 2021-04-21 19:30:42 +01:00
Andy Green
891f28b43e ss: proxy: fix conn deref on onward
Trying to use the opaque pointer in the handle to point to the conn isn't
going to work when we need it to point to the ss handle.

Move it to have its on place in the handle.
2021-04-21 10:02:00 +01:00
Andy Green
aa6b3f418e mbedtls: allow central trust store preload
Mbedtls does not have the same concept as openssl about preloading the
system trust store into every SSL_CTX.

This patch allows you to simulate the behaviour by passing in a context
creation-time filepath that all client SSL_CTX will be initialized from.
2021-04-15 19:10:54 +01:00
Andy Green
68d9f3a7f2 ss: wire up EVENT_WAIT_CANCELLED
Currently the lws_cancel_service() api only manifests itself at lws level.
This adds a state LWSSSCS_EVENT_WAIT_CANCELLED that is broadcast to all
SS in the event loop getting the cancel service api call, and allows
SS-level user code to pick up handling events from other threads.

There's a new example minimal-secure-streams-threads which shows the
pattern for other threads to communicate with and trigger the event in the
lws service thread.
2021-04-15 19:10:54 +01:00
Andy Green
5b6a89f79d ss: add test for OS trust store mdoe
It's already the case that leaving off the "tls_trust_store" member of the
streamtype definition in the policy causes the streamtype to validate its
tls connections via the OS trust store, usually a bundle OpenSSL has been
configured to load at init automagically, but also literally the OS trust
store in windows case.

Add tests to confirm that.
2021-04-15 19:10:54 +01:00
Andy Green
42dc817d8f ss: proxy: get rx flow control working
This fixes the proxy rx flow by adding an lws_dsh helper to hide the
off-by-one in the "kind" array (kind 0 is reserved for tracking the
unallocated dsh blocks).

For testing, it adds a --blob option on minimal-secure-streams[-client]
which uses a streamtype "bulkproxflow" from here

https://warmcat.com/policy/minimal-proxy-v4.2-v2.json

		"bulkproxflow": {
			"endpoint": "warmcat.com",
			"port": 443,
			"protocol": "h1",
			"http_method": "GET",
			"http_url": "blob.bin",
			"proxy_buflen": 32768,
			"proxy_buflen_rxflow_on_above": 24576,
			"proxy_buflen_rxflow_off_below": 8192,
			"tls": true,
			"retry": "default",
			"tls_trust_store": "le_via_dst"
		}

This downloads a 51MB blob of random data with the SHA256sum

ed5720c16830810e5829dfb9b66c96b2e24efc4f93aa5e38c7ff4150d31cfbbf

The minimal-secure-streams --blob example client delays the download by
50ms every 10KiB it sees to force rx flow usage at the proxy.

It downloads the whole thing and checks the SHA256 is as expected.

Logs about rxflow status are available at LLL_INFO log level.
2021-04-07 15:54:26 +01:00
Andy Green
d7ce068543 ctest: ss: minimal-hugeurl: run correct test 2021-04-05 11:06:54 +01:00
Andy Green
d291c02a23 ss: sspc: add conmon performance telemetry
This provides a way to get ahold of LWS_WITH_CONMON telemetry from Secure
Streams, it works the same with direct onward connections or via the proxy.

You can mark streamtypes with a "perf": true policy attribute... this
causes the onward connections on those streamtypes to collect information
about the connection performance, and the unsorted DNS results.

Streams with that policy attribute receive extra data in their rx callback,
with the LWSSS_FLAG_PERF_JSON flag set on it, containing JSON describing the
performance of the onward connection taken from CONMON data, in a JSON
representation.  Streams without the "perf" attribute set never receive
this extra rx.

The received JSON is based on the CONMON struct info and looks like

{"peer":"46.105.127.147","dns_us":596,"sockconn_us":31382,"tls_us":28180,"txn_resp_us:23015,"dns":["2001:41d0:2:ee93::1","46.105.127.147"]}

A new minimal example minimal-secure-streams-perf is added that collects
this data on an HTTP GET from warmcat.com, and is built with a -client
version as well if LWS_WITH_SECURE_STREAMS_PROXY_API is set, that operates
via the ss proxy and produces the same result at the client.
2021-04-05 10:55:04 +01:00
Andy Green
51490ae6e6 Fault injection
add lws_xos: xoshiro256 PRNG
2021-04-05 10:55:04 +01:00
Pavel Otchertsov
f84b90ba03 use gmtime_r instead of gmtime if possible
Also check tm result is not NULL before using it.
2021-03-25 10:08:40 +00:00
Andy Green
1000a52df3 logs: prioritize WITH_NO_LOGS even in release
Really not having any logs makes it difficult to know what is really
happening, but if that's you're thing this will align debug and release
modes to just have ERR and USER if you give WITH_NO_LOGS
2021-03-15 12:56:15 +00:00
Andy Green
546c151555 ss: add set_metadata that takes a heap copy and make ss-h1 use it
Until now we set metadata value pointers into the onward wsi ah data
area... that's OK until we get a situation the wsi has gone away before we
have a chance to deliver the metadata over the proxy link.

Add a variant lws_ss_alloc_set_metadata() that allocates space on the heap
and takes a copy of the input metadata.  Change ss-h1 to alloc copies of
its metadata so we no longer race the wsi ah lifetime.
2021-03-14 15:05:18 +00:00
Andy Green
4804624905 ss: force check all set_metadata returns
lws_ss_set_metadata can fail... eg, due to transient OOM situation... if it does,
caller must take appropriate action like disconnect and retry.

So mark the api as requiring the result checking, and make sure all the
examples do it.
2021-03-14 08:58:26 +00:00
Andy Green
9d13b97e37 client: DNS failure should retry while waiting for connect timeout
If the DNS lookup fails, we just sit out the remaining connect time.

The adapts it to reuse the wsi->sul_connect_timeout to schedule DNS lookup
retries until we're out of time.

Eventually we want to try other things as well, this is aligned with that.

Found with fault injection.
2021-03-11 06:58:59 +00:00
Andy Green
3f4623bb36 lws_metrics
There are a few build options that are trying to keep and report
various statistics

 - DETAILED_LATENCY
 - SERVER_STATUS
 - WITH_STATS

remove all those and establish a generic rplacement, lws_metrics.

lws_metrics makes its stats available via an lws_system ops function
pointer that the user code can set.

Openmetrics export is supported, for, eg, prometheus scraping.
2021-03-08 21:47:28 +00:00
Andy Green
ede7f8b0f3 ss: support huge urls 2021-03-05 14:13:26 +00:00
Andy Green
8d6f59d74f minimal-ss-client-tx: add -c flag for count of rx to get 2021-02-26 08:23:12 +00:00
Andy Green
ddf24783b3 minimal ss proxy: use updated policy 2021-02-25 21:57:52 +00:00
Andy Green
cb5c0059a3 sai-resource 2021-02-24 08:56:27 +00:00
Andy Green
d92a099374 ss: client-tx example: modernize and add to CI 2021-02-20 13:54:35 +00:00
Andy Green
8a087043c6 smd: account for new interested peers joining while queue exists 2021-02-20 13:54:35 +00:00
Andy Green
eb782bd41e ip tos support 2021-02-04 10:28:02 +00:00
Jed Lu
e588f308ac sigv4: allow arbitrary hash payloads 2021-01-29 15:53:49 +00:00
Andy Green
56f7007185 ctest: adapt background script 2021-01-26 07:48:10 +00:00
Andy Green
06662a64fa LE-root-cert-update
warmcat.com and libwebsockets.org use Let's Encrypt certificates... LE
have changed their CA signing arrangements and after 2021-01-12 (the
point I renewed the LE server certs and received one signed using the
new arrangements) it's required to trust new root certs for the examples
to connect to warmcat.com and libwebsockets.org.

https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html

This updates the in-tree CA copies, the remote policies on warmcat.com
have also been updated.

Just goes to show for real client infrastructure, you need to run your own
CA (that doesn't have to be trusted by anything outside the clients)
where you can control the CA lifetime.
2021-01-13 04:32:13 +00:00
Jed Lu
c82910d30c ss: auth: sigv4
Add SS pieces for Sigv4 auth support
2021-01-05 10:56:38 +00:00
Andy Green
abc60c755a smd: add more scenarios to tests
Let's have 4 x forked clients all intercommunicate via the SS proxy,
and add it to ctest.
2021-01-05 10:56:38 +00:00
Andy Green
8ff35b819a smd-add-ss-rx-forwarder-helper
Add a helper to simplify passing smd ss rx traffic into the local
smd participants, excluding the rx that received it externally to
avoid looping.

Make the smd readme clearer with three diagrams and more explanation
of how the ss proxying works.
2021-01-05 10:56:38 +00:00
Andy Green
962993fd24 smd: add ss tx helper 2021-01-05 10:56:38 +00:00