/*
* libwebsockets - small server side websockets and web server implementation
*
- * Copyright (C) 2010-201
6 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2010-201
7 Andy Green <andy@warmcat.com>
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
#include "private-libwebsockets.h"
+/* workaround for mingw */
+#if !defined(ECONNABORTED)
+#define ECONNABORTED 103
+#endif
+
+int lws_alloc_vfs_file(struct lws_context *context, const char *filename, uint8_t **buf,
+ lws_filepos_t *amount)
+{
+ lws_filepos_t len;
+ lws_fop_flags_t flags = LWS_O_RDONLY;
+ lws_fop_fd_t fops_fd = lws_vfs_file_open(
+ lws_get_fops(context), filename, &flags);
+ int ret = 1;
+
+ if (!fops_fd)
+ return 1;
+
+ len = lws_vfs_get_length(fops_fd);
+
+ *buf = malloc((size_t)len);
+ if (!buf)
+ goto bail;
+
+ if (lws_vfs_file_read(fops_fd, amount, *buf, len))
+ goto bail;
+
+ ret = 0;
+bail:
+ lws_vfs_file_close(&fops_fd);
+
+ return ret;
+}
+
+#if defined(LWS_WITH_ESP32)
+int alloc_file(struct lws_context *context, const char *filename, uint8_t **buf,
+ lws_filepos_t *amount)
+{
+ nvs_handle nvh;
+ size_t s;
+ int n = 0;
+
+ ESP_ERROR_CHECK(nvs_open("lws-station", NVS_READWRITE, &nvh));
+ if (nvs_get_blob(nvh, filename, NULL, &s) != ESP_OK) {
+ n = 1;
+ goto bail;
+ }
+ *buf = malloc(s);
+ if (!*buf) {
+ n = 2;
+ goto bail;
+ }
+ if (nvs_get_blob(nvh, filename, (char *)*buf, &s) != ESP_OK) {
+ free(*buf);
+ n = 1;
+ goto bail;
+ }
+
+ *amount = s;
+
+bail:
+ nvs_close(nvh);
+
+ return n;
+}
+int alloc_pem_to_der_file(struct lws_context *context, const char *filename, uint8_t **buf,
+ lws_filepos_t *amount)
+{
+ uint8_t *pem, *p, *q, *end;
+ lws_filepos_t len;
+ int n;
+
+ n = alloc_file(context, filename, &pem, &len);
+ if (n)
+ return n;
+
+ /* trim the first line */
+
+ p = pem;
+ end = p + len;
+ if (strncmp((char *)p, "-----", 5))
+ goto bail;
+ p += 5;
+ while (p < end && *p != '\n' && *p != '-')
+ p++;
+
+ if (*p != '-')
+ goto bail;
+
+ while (p < end && *p != '\n')
+ p++;
+
+ if (p >= end)
+ goto bail;
+
+ p++;
+
+ /* trim the last line */
+
+ q = end - 2;
+
+ while (q > pem && *q != '\n')
+ q--;
+
+ if (*q != '\n')
+ goto bail;
+
+ *q = '\0';
+
+ *amount = lws_b64_decode_string((char *)p, (char *)pem, len);
+ *buf = pem;
+
+ return 0;
+
+bail:
+ free(pem);
+
+ return 4;
+}
+#endif
int openssl_websocket_private_data_index,
openssl_SSL_CTX_private_data_index;
int lws_ssl_get_error(struct lws *wsi, int n)
{
+ if (!wsi->ssl)
+ return 99;
+ lwsl_debug("%s: %p %d\n", __func__, wsi->ssl, n);
return SSL_get_error(wsi->ssl, n);
}
case SSL_ERROR_SYSCALL:
switch (ret) {
case 0:
- snprintf(buf, len, "SSL_ERROR_SYSCALL: EOF");
+ lws_snprintf(buf, len, "SSL_ERROR_SYSCALL: EOF");
return buf;
case -1:
#ifndef LWS_PLAT_OPTEE
- snprintf(buf, len, "SSL_ERROR_SYSCALL: %s", strerror(errno));
+ lws_snprintf(buf, len, "SSL_ERROR_SYSCALL: %s", strerror(errno));
#else
- snprintf(buf, len, "SSL_ERROR_SYSCALL: %d", errno);
+ lws_snprintf(buf, len, "SSL_ERROR_SYSCALL: %d", errno);
#endif
return buf;
default:
void
lws_ssl_elaborate_error(void)
{
+#if defined(LWS_WITH_ESP32)
+#else
char buf[256];
u_long err;
ERR_error_string_n(err, buf, sizeof(buf));
lwsl_err("*** %s\n", buf);
}
+#endif
}
+#if !defined(LWS_WITH_ESP32)
+
static int
lws_context_init_ssl_pem_passwd_cb(char * buf, int size, int rwflag, void *userdata)
{
{
if (!info->ssl_private_key_password)
return;
-
/*
* password provided, set ssl callback and user data
* for checking password which will be trigered during
SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, (void *)info);
SSL_CTX_set_default_passwd_cb(ssl_ctx, lws_context_init_ssl_pem_passwd_cb);
}
+#endif
int
lws_context_init_ssl_library(struct lws_context_creation_info *info)
lwsl_notice("Doing SSL library init\n");
+#if !defined(LWS_WITH_ESP32)
SSL_library_init();
-
OpenSSL_add_all_algorithms();
SSL_load_error_strings();
openssl_SSL_CTX_private_data_index = SSL_CTX_get_ex_new_index(0,
NULL, NULL, NULL, NULL);
+#endif
return 0;
}
-
LWS_VISIBLE void
lws_ssl_destroy(struct lws_vhost *vhost)
{
SSL_CTX_free(vhost->ssl_ctx);
if (!vhost->user_supplied_ssl_ctx && vhost->ssl_client_ctx)
SSL_CTX_free(vhost->ssl_client_ctx);
+#if !defined(LWS_WITH_ESP32)
// after 1.1.0 no need
#if (OPENSSL_VERSION_NUMBER < 0x10100000)
EVP_cleanup();
CRYPTO_cleanup_all_ex_data();
#endif
-}
-
-LWS_VISIBLE void
-lws_decode_ssl_error(void)
-{
- char buf[256];
- u_long err;
- while ((err = ERR_get_error()) != 0) {
- ERR_error_string_n(err, buf, sizeof(buf));
- lwsl_err("*** %lu %s\n", err, buf);
- }
+#endif
}
LWS_VISIBLE void
struct lws_context *context = wsi->context;
struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
int n = 0;
- int ssl_read_errno = 0;
+#if !defined(LWS_WITH_ESP32)
+ int ssl_read_errno = 0;
+#endif
if (!wsi->ssl)
return lws_ssl_capable_read_no_ssl(wsi, buf, len);
+ lws_stats_atomic_bump(context, pt, LWSSTATS_C_API_READ, 1);
+
+ errno = 0;
n = SSL_read(wsi->ssl, buf, len);
+#if defined(LWS_WITH_ESP32)
+ if (!n && errno == ENOTCONN) {
+ lwsl_debug("%p: SSL_read ENOTCONN\n", wsi);
+ return LWS_SSL_CAPABLE_ERROR;
+ }
+#endif
+#if defined(LWS_WITH_STATS)
+ if (!wsi->seen_rx) {
+ lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_MS_SSL_RX_DELAY,
+ time_in_microseconds() - wsi->accept_start_us);
+ lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_C_SSL_CONNS_HAD_RX, 1);
+ wsi->seen_rx = 1;
+ }
+#endif
+
+ lwsl_debug("%p: SSL_read says %d\n", wsi, n);
/* manpage: returning 0 means connection shut down */
if (!n) {
- n = lws_ssl_get_error(wsi, n);
-
- if (n == SSL_ERROR_ZERO_RETURN)
- return LWS_SSL_CAPABLE_ERROR;
-
- if (n == SSL_ERROR_SYSCALL) {
- int err = ERR_get_error();
- if (err == 0
- && (ssl_read_errno == EPIPE
- || ssl_read_errno == ECONNABORTED
- || ssl_read_errno == 0))
- return LWS_SSL_CAPABLE_ERROR;
- }
+ n = lws_ssl_get_error(wsi, n);
+ lwsl_debug("%p: ssl err %d errno %d\n", wsi, n, errno);
+ if (n == SSL_ERROR_ZERO_RETURN)
+ return LWS_SSL_CAPABLE_ERROR;
+
+ if (n == SSL_ERROR_SYSCALL) {
+#if !defined(LWS_WITH_ESP32)
+ int err = ERR_get_error();
+ if (err == 0 && (ssl_read_errno == EPIPE ||
+ ssl_read_errno == ECONNABORTED ||
+ ssl_read_errno == 0))
+ return LWS_SSL_CAPABLE_ERROR;
+#endif
+ }
lwsl_err("%s failed: %s\n",__func__,
ERR_error_string(lws_ssl_get_error(wsi, 0), NULL));
- lws_decode_ssl_error();
+ lws_ssl_elaborate_error();
return LWS_SSL_CAPABLE_ERROR;
}
if (n < 0) {
n = lws_ssl_get_error(wsi, n);
- if (n == SSL_ERROR_WANT_READ || n == SSL_ERROR_WANT_WRITE)
+ // lwsl_notice("get_ssl_err result %d\n", n);
+ if (n == SSL_ERROR_WANT_READ || SSL_want_read(wsi->ssl)) {
+ lwsl_debug("%s: WANT_READ\n", __func__);
+ lwsl_debug("%p: LWS_SSL_CAPABLE_MORE_SERVICE\n", wsi);
return LWS_SSL_CAPABLE_MORE_SERVICE;
+ }
+ if (n == SSL_ERROR_WANT_WRITE || SSL_want_write(wsi->ssl)) {
+ lwsl_debug("%s: WANT_WRITE\n", __func__);
+ lwsl_debug("%p: LWS_SSL_CAPABLE_MORE_SERVICE\n", wsi);
+ return LWS_SSL_CAPABLE_MORE_SERVICE;
+ }
+
lwsl_err("%s failed2: %s\n",__func__,
ERR_error_string(lws_ssl_get_error(wsi, 0), NULL));
- lws_decode_ssl_error();
+ lws_ssl_elaborate_error();
return LWS_SSL_CAPABLE_ERROR;
}
+ lws_stats_atomic_bump(context, pt, LWSSTATS_B_READ, n);
+
if (wsi->vhost)
wsi->vhost->conn_stats.rx += n;
lws_ssl_capable_write(struct lws *wsi, unsigned char *buf, int len)
{
int n;
- int ssl_read_errno = 0;
+#if !defined(LWS_WITH_ESP32)
+ int ssl_read_errno = 0;
+#endif
if (!wsi->ssl)
return lws_ssl_capable_write_no_ssl(wsi, buf, len);
n = lws_ssl_get_error(wsi, n);
if (n == SSL_ERROR_WANT_READ || n == SSL_ERROR_WANT_WRITE) {
- if (n == SSL_ERROR_WANT_WRITE)
+ if (n == SSL_ERROR_WANT_WRITE) {
+ lwsl_debug("%s: WANT_WRITE\n", __func__);
lws_set_blocking_send(wsi);
+ }
return LWS_SSL_CAPABLE_MORE_SERVICE;
}
if (n == SSL_ERROR_ZERO_RETURN)
return LWS_SSL_CAPABLE_ERROR;
+#if !defined(LWS_WITH_ESP32)
if (n == SSL_ERROR_SYSCALL) {
+
int err = ERR_get_error();
if (err == 0
&& (ssl_read_errno == EPIPE
|| ssl_read_errno == 0))
return LWS_SSL_CAPABLE_ERROR;
}
+#endif
lwsl_err("%s failed: %s\n",__func__,
ERR_error_string(lws_ssl_get_error(wsi, 0), NULL));
- lws_decode_ssl_error();
+ lws_ssl_elaborate_error();
return LWS_SSL_CAPABLE_ERROR;
}
+static int
+lws_gate_accepts(struct lws_context *context, int on)
+{
+ struct lws_vhost *v = context->vhost_list;
+
+ lwsl_info("gating accepts %d\n", on);
+ context->ssl_gate_accepts = !on;
+#if defined(LWS_WITH_STATS)
+ context->updated = 1;
+#endif
+
+ while (v) {
+ if (v->use_ssl && v->lserv_wsi) /* gate ability to accept incoming connections */
+ if (lws_change_pollfd(v->lserv_wsi, (LWS_POLLIN) * !on, (LWS_POLLIN) * on))
+ lwsl_err("Unable to set accept POLLIN %d\n", on);
+
+ v = v->vhost_next;
+ }
+
+ return 0;
+}
+
LWS_VISIBLE int
lws_ssl_close(struct lws *wsi)
{
- int n;
+ lws_sockfd_type n;
if (!wsi->ssl)
return 0; /* not handled */
SSL_free(wsi->ssl);
wsi->ssl = NULL;
+ if (wsi->context->simultaneous_ssl_restriction &&
+ wsi->context->simultaneous_ssl-- ==
+ wsi->context->simultaneous_ssl_restriction)
+ /* we made space and can do an accept */
+ lws_gate_accepts(wsi->context, 1);
+#if defined(LWS_WITH_STATS)
+ wsi->context->updated = 1;
+#endif
+
return 1; /* handled */
}
struct lws_context *context = wsi->context;
struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
int n, m;
-#if !defined(USE_WOLFSSL)
+#if !defined(USE_WOLFSSL) && !defined(LWS_WITH_ESP32)
BIO *bio;
#endif
char buf[256];
lwsl_err("%s: leaking ssl\n", __func__);
if (accept_fd == LWS_SOCK_INVALID)
assert(0);
-
+ if (context->simultaneous_ssl_restriction &&
+ context->simultaneous_ssl >= context->simultaneous_ssl_restriction) {
+ lwsl_notice("unable to deal with SSL connection\n");
+ return 1;
+ }
+ errno = 0;
wsi->ssl = SSL_new(wsi->vhost->ssl_ctx);
if (wsi->ssl == NULL) {
- lwsl_err("SSL_new failed: %s\n",
- ERR_error_string(lws_ssl_get_error(wsi, 0), NULL));
- lws_decode_ssl_error();
+ lwsl_err("SSL_new failed: %d (errno %d)\n",
+ lws_ssl_get_error(wsi, 0), errno);
+
+ lws_ssl_elaborate_error();
if (accept_fd != LWS_SOCK_INVALID)
compatible_close(accept_fd);
goto fail;
}
+ if (context->simultaneous_ssl_restriction &&
+ ++context->simultaneous_ssl == context->simultaneous_ssl_restriction)
+ /* that was the last allowed SSL connection */
+ lws_gate_accepts(context, 0);
+#if defined(LWS_WITH_STATS)
+ context->updated = 1;
+#endif
+#if !defined(LWS_WITH_ESP32)
SSL_set_ex_data(wsi->ssl,
openssl_websocket_private_data_index, wsi);
-
+#endif
SSL_set_fd(wsi->ssl, accept_fd);
#ifdef USE_WOLFSSL
wolfSSL_set_using_nonblock(wsi->ssl, 1);
#endif
#else
+#if defined(LWS_WITH_ESP32)
+ lws_plat_set_socket_options(wsi->vhost, accept_fd);
+#else
SSL_set_mode(wsi->ssl, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
bio = SSL_get_rbio(wsi->ssl);
if (bio)
else
lwsl_notice("NULL rbio\n");
#endif
+#endif
/*
* we are not accepted yet, but we need to enter ourselves
lws_set_timeout(wsi, PENDING_TIMEOUT_SSL_ACCEPT,
context->timeout_secs);
- lwsl_info("inserted SSL accept into fds, trying SSL_accept\n");
+ lwsl_debug("inserted SSL accept into fds, trying SSL_accept\n");
/* fallthru */
lws_latency_pre(context, wsi);
- n = recv(wsi->sock, (char *)pt->serv_buf, context->pt_serv_buf_size,
- MSG_PEEK);
+ if (wsi->vhost->allow_non_ssl_on_ssl_port) {
+
+ n = recv(wsi->desc.sockfd, (char *)pt->serv_buf, context->pt_serv_buf_size,
+ MSG_PEEK);
/*
* optionally allow non-SSL connect on SSL listening socket
* it disabled unless you know it's not a problem for you
*/
- if (wsi->vhost->allow_non_ssl_on_ssl_port) {
if (n >= 1 && pt->serv_buf[0] >= ' ') {
/*
* TLS content-type for Handshake is 0x16, and
/* normal SSL connection processing path */
+#if defined(LWS_WITH_STATS)
+ if (!wsi->accept_start_us)
+ wsi->accept_start_us = time_in_microseconds();
+#endif
+
n = SSL_accept(wsi->ssl);
lws_latency(context, wsi,
"SSL_accept LWSCM_SSL_ACK_PENDING\n", n, n == 1);
-
+ lwsl_info("SSL_accept says %d\n", n);
if (n == 1)
goto accepted;
m = lws_ssl_get_error(wsi, n);
+
+#if defined(LWS_WITH_ESP32)
+ if (m == 5 && errno == 11)
+ m = SSL_ERROR_WANT_READ;
+#endif
+
go_again:
- if (m == SSL_ERROR_WANT_READ) {
+ if (m == SSL_ERROR_WANT_READ || SSL_want_read(wsi->ssl)) {
if (lws_change_pollfd(wsi, 0, LWS_POLLIN)) {
lwsl_err("%s: WANT_READ change_pollfd failed\n", __func__);
goto fail;
lwsl_info("SSL_ERROR_WANT_READ\n");
break;
}
- if (m == SSL_ERROR_WANT_WRITE) {
+ if (m == SSL_ERROR_WANT_WRITE || SSL_want_write(wsi->ssl)) {
+ lwsl_debug("%s: WANT_WRITE\n", __func__);
+
if (lws_change_pollfd(wsi, 0, LWS_POLLOUT)) {
lwsl_err("%s: WANT_WRITE change_pollfd failed\n", __func__);
goto fail;
break;
}
-
- lwsl_err("SSL_accept failed socket %u: %s\n", wsi->sock,
+ lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_C_SSL_CONNECTIONS_FAILED, 1);
+ lwsl_err("SSL_accept failed socket %u: %s\n", wsi->desc.sockfd,
lws_ssl_get_error_string(m, n, buf, sizeof(buf)));
lws_ssl_elaborate_error();
goto fail;
accepted:
+ lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_C_SSL_CONNECTIONS_ACCEPTED, 1);
+#if defined(LWS_WITH_STATS)
+ lws_stats_atomic_bump(wsi->context, pt, LWSSTATS_MS_SSL_CONNECTIONS_ACCEPTED_DELAY, time_in_microseconds() - wsi->accept_start_us);
+ wsi->accept_start_us = time_in_microseconds();
+#endif
+
/* OK, we are accepted... give him some time to negotiate */
lws_set_timeout(wsi, PENDING_TIMEOUT_ESTABLISH_WITH_SERVER,
context->timeout_secs);
lws_ssl_context_destroy(struct lws_context *context)
{
+#if !defined(LWS_WITH_ESP32)
+
// after 1.1.0 no need
#if (OPENSSL_VERSION_NUMBER < 0x10100000)
// <= 1.0.1f = old api, 1.0.1g+ = new api
EVP_cleanup();
CRYPTO_cleanup_all_ex_data();
#endif
+#endif
}
projects / platform / upstream / libwebsockets.git / blobdiff