mirror of
https://github.com/warmcat/libwebsockets.git
synced 2025-03-16 00:00:07 +01:00
317 lines
7.8 KiB
C
317 lines
7.8 KiB
C
/*
|
|
* libwebsockets - mbedTLS-specific lws apis
|
|
*
|
|
* Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com>
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation:
|
|
* version 2.1 of the License.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
|
|
* MA 02110-1301 USA
|
|
*/
|
|
|
|
#include "core/private.h"
|
|
#include "tls/mbedtls/private.h"
|
|
|
|
|
|
LWS_VISIBLE void
|
|
lws_ssl_destroy(struct lws_vhost *vhost)
|
|
{
|
|
if (!lws_check_opt(vhost->context->options,
|
|
LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT))
|
|
return;
|
|
|
|
if (vhost->tls.ssl_ctx)
|
|
SSL_CTX_free(vhost->tls.ssl_ctx);
|
|
if (!vhost->tls.user_supplied_ssl_ctx && vhost->tls.ssl_client_ctx)
|
|
SSL_CTX_free(vhost->tls.ssl_client_ctx);
|
|
|
|
if (vhost->tls.x509_client_CA)
|
|
X509_free(vhost->tls.x509_client_CA);
|
|
}
|
|
|
|
LWS_VISIBLE int
|
|
lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len)
|
|
{
|
|
struct lws_context *context = wsi->context;
|
|
struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
|
|
int n = 0, m;
|
|
|
|
if (!wsi->tls.ssl)
|
|
return lws_ssl_capable_read_no_ssl(wsi, buf, len);
|
|
|
|
lws_stats_bump(pt, LWSSTATS_C_API_READ, 1);
|
|
|
|
errno = 0;
|
|
n = SSL_read(wsi->tls.ssl, buf, len);
|
|
#if defined(LWS_WITH_ESP32)
|
|
if (!n && errno == LWS_ENOTCONN) {
|
|
lwsl_debug("%p: SSL_read ENOTCONN\n", wsi);
|
|
return LWS_SSL_CAPABLE_ERROR;
|
|
}
|
|
#endif
|
|
#if defined(LWS_WITH_STATS)
|
|
if (!wsi->seen_rx && wsi->accept_start_us) {
|
|
lws_stats_bump(pt, LWSSTATS_US_SSL_RX_DELAY_AVG,
|
|
lws_now_usecs() - wsi->accept_start_us);
|
|
lws_stats_bump(pt, LWSSTATS_C_SSL_CONNS_HAD_RX, 1);
|
|
wsi->seen_rx = 1;
|
|
}
|
|
#endif
|
|
|
|
|
|
lwsl_debug("%p: SSL_read says %d\n", wsi, n);
|
|
/* manpage: returning 0 means connection shut down */
|
|
if (!n) {
|
|
wsi->socket_is_permanently_unusable = 1;
|
|
|
|
return LWS_SSL_CAPABLE_ERROR;
|
|
}
|
|
|
|
if (n < 0) {
|
|
m = SSL_get_error(wsi->tls.ssl, n);
|
|
lwsl_debug("%p: ssl err %d errno %d\n", wsi, m, errno);
|
|
if (errno == LWS_ENOTCONN) {
|
|
/* If the socket isn't connected anymore, bail out. */
|
|
wsi->socket_is_permanently_unusable = 1;
|
|
return LWS_SSL_CAPABLE_ERROR;
|
|
}
|
|
if (m == SSL_ERROR_ZERO_RETURN ||
|
|
m == SSL_ERROR_SYSCALL)
|
|
return LWS_SSL_CAPABLE_ERROR;
|
|
|
|
if (m == SSL_ERROR_WANT_READ || SSL_want_read(wsi->tls.ssl)) {
|
|
lwsl_debug("%s: WANT_READ\n", __func__);
|
|
lwsl_debug("%p: LWS_SSL_CAPABLE_MORE_SERVICE\n", wsi);
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE;
|
|
}
|
|
if (m == SSL_ERROR_WANT_WRITE || SSL_want_write(wsi->tls.ssl)) {
|
|
lwsl_debug("%s: WANT_WRITE\n", __func__);
|
|
lwsl_debug("%p: LWS_SSL_CAPABLE_MORE_SERVICE\n", wsi);
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE;
|
|
}
|
|
wsi->socket_is_permanently_unusable = 1;
|
|
|
|
return LWS_SSL_CAPABLE_ERROR;
|
|
}
|
|
|
|
lws_stats_bump(pt, LWSSTATS_B_READ, n);
|
|
|
|
if (wsi->vhost)
|
|
wsi->vhost->conn_stats.rx += n;
|
|
|
|
/*
|
|
* if it was our buffer that limited what we read,
|
|
* check if SSL has additional data pending inside SSL buffers.
|
|
*
|
|
* Because these won't signal at the network layer with POLLIN
|
|
* and if we don't realize, this data will sit there forever
|
|
*/
|
|
if (n != len)
|
|
goto bail;
|
|
if (!wsi->tls.ssl)
|
|
goto bail;
|
|
|
|
if (SSL_pending(wsi->tls.ssl) &&
|
|
lws_dll2_is_detached(&wsi->tls.dll_pending_tls))
|
|
lws_dll2_add_head(&wsi->tls.dll_pending_tls,
|
|
&pt->tls.dll_pending_tls_owner);
|
|
|
|
return n;
|
|
bail:
|
|
lws_ssl_remove_wsi_from_buffered_list(wsi);
|
|
|
|
return n;
|
|
}
|
|
|
|
LWS_VISIBLE int
|
|
lws_ssl_pending(struct lws *wsi)
|
|
{
|
|
if (!wsi->tls.ssl)
|
|
return 0;
|
|
|
|
return SSL_pending(wsi->tls.ssl);
|
|
}
|
|
|
|
LWS_VISIBLE int
|
|
lws_ssl_capable_write(struct lws *wsi, unsigned char *buf, int len)
|
|
{
|
|
int n, m;
|
|
|
|
if (!wsi->tls.ssl)
|
|
return lws_ssl_capable_write_no_ssl(wsi, buf, len);
|
|
|
|
n = SSL_write(wsi->tls.ssl, buf, len);
|
|
if (n > 0)
|
|
return n;
|
|
|
|
m = SSL_get_error(wsi->tls.ssl, n);
|
|
if (m != SSL_ERROR_SYSCALL) {
|
|
if (m == SSL_ERROR_WANT_READ || SSL_want_read(wsi->tls.ssl)) {
|
|
lwsl_notice("%s: want read\n", __func__);
|
|
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE;
|
|
}
|
|
|
|
if (m == SSL_ERROR_WANT_WRITE || SSL_want_write(wsi->tls.ssl)) {
|
|
lws_set_blocking_send(wsi);
|
|
lwsl_debug("%s: want write\n", __func__);
|
|
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE;
|
|
}
|
|
}
|
|
|
|
lwsl_debug("%s failed: %d\n",__func__, m);
|
|
wsi->socket_is_permanently_unusable = 1;
|
|
|
|
return LWS_SSL_CAPABLE_ERROR;
|
|
}
|
|
|
|
int openssl_SSL_CTX_private_data_index;
|
|
|
|
void
|
|
lws_ssl_info_callback(const SSL *ssl, int where, int ret)
|
|
{
|
|
struct lws *wsi;
|
|
struct lws_context *context;
|
|
struct lws_ssl_info si;
|
|
|
|
context = (struct lws_context *)SSL_CTX_get_ex_data(
|
|
SSL_get_SSL_CTX(ssl),
|
|
openssl_SSL_CTX_private_data_index);
|
|
if (!context)
|
|
return;
|
|
wsi = wsi_from_fd(context, SSL_get_fd(ssl));
|
|
if (!wsi)
|
|
return;
|
|
|
|
if (!(where & wsi->vhost->tls.ssl_info_event_mask))
|
|
return;
|
|
|
|
si.where = where;
|
|
si.ret = ret;
|
|
|
|
if (user_callback_handle_rxflow(wsi->protocol->callback,
|
|
wsi, LWS_CALLBACK_SSL_INFO,
|
|
wsi->user_space, &si, 0))
|
|
lws_set_timeout(wsi, PENDING_TIMEOUT_KILLED_BY_SSL_INFO, -1);
|
|
}
|
|
|
|
|
|
LWS_VISIBLE int
|
|
lws_ssl_close(struct lws *wsi)
|
|
{
|
|
lws_sockfd_type n;
|
|
|
|
if (!wsi->tls.ssl)
|
|
return 0; /* not handled */
|
|
|
|
#if defined (LWS_HAVE_SSL_SET_INFO_CALLBACK)
|
|
/* kill ssl callbacks, becausse we will remove the fd from the
|
|
* table linking it to the wsi
|
|
*/
|
|
if (wsi->vhost->tls.ssl_info_event_mask)
|
|
SSL_set_info_callback(wsi->tls.ssl, NULL);
|
|
#endif
|
|
|
|
n = SSL_get_fd(wsi->tls.ssl);
|
|
if (!wsi->socket_is_permanently_unusable)
|
|
SSL_shutdown(wsi->tls.ssl);
|
|
compatible_close(n);
|
|
SSL_free(wsi->tls.ssl);
|
|
wsi->tls.ssl = NULL;
|
|
|
|
if (!lwsi_role_client(wsi) &&
|
|
wsi->context->simultaneous_ssl_restriction &&
|
|
wsi->context->simultaneous_ssl-- ==
|
|
wsi->context->simultaneous_ssl_restriction)
|
|
/* we made space and can do an accept */
|
|
lws_gate_accepts(wsi->context, 1);
|
|
|
|
#if defined(LWS_WITH_STATS)
|
|
wsi->context->updated = 1;
|
|
#endif
|
|
|
|
return 1; /* handled */
|
|
}
|
|
|
|
void
|
|
lws_ssl_SSL_CTX_destroy(struct lws_vhost *vhost)
|
|
{
|
|
if (vhost->tls.ssl_ctx)
|
|
SSL_CTX_free(vhost->tls.ssl_ctx);
|
|
|
|
if (!vhost->tls.user_supplied_ssl_ctx && vhost->tls.ssl_client_ctx)
|
|
SSL_CTX_free(vhost->tls.ssl_client_ctx);
|
|
#if defined(LWS_WITH_ACME)
|
|
lws_tls_acme_sni_cert_destroy(vhost);
|
|
#endif
|
|
}
|
|
|
|
void
|
|
lws_ssl_context_destroy(struct lws_context *context)
|
|
{
|
|
}
|
|
|
|
lws_tls_ctx *
|
|
lws_tls_ctx_from_wsi(struct lws *wsi)
|
|
{
|
|
if (!wsi->tls.ssl)
|
|
return NULL;
|
|
|
|
return SSL_get_SSL_CTX(wsi->tls.ssl);
|
|
}
|
|
|
|
enum lws_ssl_capable_status
|
|
__lws_tls_shutdown(struct lws *wsi)
|
|
{
|
|
int n = SSL_shutdown(wsi->tls.ssl);
|
|
|
|
lwsl_debug("SSL_shutdown=%d for fd %d\n", n, wsi->desc.sockfd);
|
|
|
|
switch (n) {
|
|
case 1: /* successful completion */
|
|
n = shutdown(wsi->desc.sockfd, SHUT_WR);
|
|
return LWS_SSL_CAPABLE_DONE;
|
|
|
|
case 0: /* needs a retry */
|
|
__lws_change_pollfd(wsi, 0, LWS_POLLIN);
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE;
|
|
|
|
default: /* fatal error, or WANT */
|
|
n = SSL_get_error(wsi->tls.ssl, n);
|
|
if (n != SSL_ERROR_SYSCALL && n != SSL_ERROR_SSL) {
|
|
if (SSL_want_read(wsi->tls.ssl)) {
|
|
lwsl_debug("(wants read)\n");
|
|
__lws_change_pollfd(wsi, 0, LWS_POLLIN);
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE_READ;
|
|
}
|
|
if (SSL_want_write(wsi->tls.ssl)) {
|
|
lwsl_debug("(wants write)\n");
|
|
__lws_change_pollfd(wsi, 0, LWS_POLLOUT);
|
|
return LWS_SSL_CAPABLE_MORE_SERVICE_WRITE;
|
|
}
|
|
}
|
|
return LWS_SSL_CAPABLE_ERROR;
|
|
}
|
|
}
|
|
|
|
|
|
static int
|
|
tops_fake_POLLIN_for_buffered_mbedtls(struct lws_context_per_thread *pt)
|
|
{
|
|
return lws_tls_fake_POLLIN_for_buffered(pt);
|
|
}
|
|
|
|
const struct lws_tls_ops tls_ops_mbedtls = {
|
|
/* fake_POLLIN_for_buffered */ tops_fake_POLLIN_for_buffered_mbedtls,
|
|
};
|