Add DLP hook to libwebsockets

Change-Id: I8b61f6dae79d0ec17868153f583be3b0a74c716f

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 96651aa5be407f0fa31edb76c917d4a4df0e8ed8..909130f7452bb0bc09e4aa1d2b7ae7af2fd6c567 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1440,6 +1440,17 @@ if (LWS_WITH_JOSE OR LWS_WITH_GENCRYPTO)
                lib/tls/lws-gencrypto-common.c)
 endif()
 
+if (LWS_WITH_TIZEN_DLP)
+       LIST(APPEND SOURCES
+               lib/dlp.c)
+       LIST(APPEND HDR_PRIVATE
+               lib/dlp.h)
+       MESSAGE(STATUS "TIZEN DLP ENABLED")
+       ADD_DEFINITIONS(-DLWS_WITH_TIZEN_DLP)
+else()
+       MESSAGE(STATUS "DLP DISABLED")
+endif()
+
 # Add helper files for Windows.
 if (WIN32)
        set(WIN32_HELPERS_PATH win32port/win32helpers)
@@ -1651,6 +1662,10 @@ endif()
 
 set(LIB_LIST)
 
+if (LWS_WITH_TIZEN_DLP)
+       LIST(APPEND LIB_LIST ${pkgs_LIBRARIES})
+endif()
+
 #
 # Find libraries.
 #

diff --git a/lib/core-net/output.c b/lib/core-net/output.c
index 7c43eec58088a92d5b442f74ed4abddeb8d4e6d3..15c8b49928d3e17ea2812ba6e6feff030fb3f31a 100644 (file)
--- a/lib/core-net/output.c
+++ b/lib/core-net/output.c
@@ -21,6 +21,10 @@
 
 #include "private-lib-core.h"
 
+#ifdef LWS_WITH_TIZEN_DLP
+#include "dlp.h"
+#endif
+
 /*
  * notice this returns number of bytes consumed, or -1
  */
@@ -296,6 +300,13 @@ LWS_VISIBLE int
 lws_ssl_capable_write_no_ssl(struct lws *wsi, unsigned char *buf, int len)
 {
        int n = 0;
+#ifdef LWS_WITH_TIZEN_DLP
+       PgDlpProtocol protocol = PRIV_GUARD_DLP_PROTOCOL_LIBWEBSOCKET_WSS;
+       if (!lws_is_ssl(wsi))
+               protocol = PRIV_GUARD_DLP_PROTOCOL_LIBWEBSOCKET_WS;
+       dlp_check_leak(wsi->desc.sockfd, protocol, (char *) buf, len);
+#endif
+
 #if defined(LWS_PLAT_OPTEE)
        ssize_t send(int sockfd, const void *buf, size_t len, int flags);
 #endif

diff --git a/lib/dlp.c b/lib/dlp.c
new file mode 100644 (file)
index 0000000..1ebfad2
--- /dev/null
+++ b/lib/dlp.c
@@ -0,0 +1,112 @@
+/*
+ * libwebsockets - small server side websockets and web server implementation
+ *
+ * Copyright (C) 2010-2016 Andy Green <andy@warmcat.com>
+ * Copyright (c) 2020 Samsung Electronics Co., Ltd All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation:
+ *  version 2.1 of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ *  MA  02110-1301  USA
+ */
+
+#include "dlp.h"
+
+#include <dlfcn.h>
+#include "libwebsockets.h"
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netdb.h>
+#include <limits.h>
+
+#define LIBRARY_PATH "/lib/libprivacy-guard-client.so"
+
+typedef void (*privacy_guard_dlp_init_t)();
+typedef int (*privacy_guard_dlp_check_leak_proto_info_t)(const char* const, PgDlpProtocol,
+                                                         long, long, uint32_t, const char* const, size_t);
+
+static privacy_guard_dlp_init_t privacy_guard_dlp_init = 0;
+static privacy_guard_dlp_check_leak_proto_info_t privacy_guard_dlp_check_leak_proto_info = 0;
+
+struct dlp_hook_info {
+       long source_port;
+       long destination_port;
+       uint32_t destination_ip;
+       char hostname[HOST_NAME_MAX + 1];
+};
+
+static void
+dlp_init()
+{
+       void *handle = dlopen(LIBRARY_PATH, RTLD_LAZY | RTLD_NODELETE);
+
+       if (handle) {
+               privacy_guard_dlp_init =
+                       (privacy_guard_dlp_init_t) dlsym(handle, "privacy_guard_dlp_init");
+               privacy_guard_dlp_check_leak_proto_info =
+                       (privacy_guard_dlp_check_leak_proto_info_t) dlsym(handle, "privacy_guard_dlp_check_leak_proto_info");
+               dlclose(handle);
+
+               if (privacy_guard_dlp_init)
+                       privacy_guard_dlp_init();
+       } else {
+               lwsl_err("'%s' not found!", LIBRARY_PATH);
+       }
+}
+
+static void
+dlp_get_descriptor_info(const int socket_descriptor, struct dlp_hook_info *hook_info)
+{
+       const struct sockaddr_storage address_storage = {0};
+       socklen_t address_storage_size = sizeof(address_storage);
+
+       struct sockaddr *generic_address = (struct sockaddr *)(&address_storage);
+       const struct sockaddr_in *ipv4_address = (struct sockaddr_in *)(&address_storage);
+
+       if (getsockname(socket_descriptor, generic_address, &address_storage_size) == 0 && generic_address->sa_family == AF_INET) {
+               hook_info->source_port = ntohs(ipv4_address->sin_port);
+       }
+
+       if (getpeername(socket_descriptor, generic_address, &address_storage_size) == 0 && generic_address->sa_family == AF_INET) {
+               hook_info->destination_port = ntohs(ipv4_address->sin_port);
+               hook_info->destination_ip = ipv4_address->sin_addr.s_addr;
+       }
+
+       if (generic_address->sa_family == AF_INET) {
+               if (getnameinfo((const struct sockaddr *) ipv4_address, sizeof(struct sockaddr_in),
+                               hook_info->hostname, HOST_NAME_MAX, NULL, 0, 0)) {
+                       hook_info->hostname[0] = 0;
+               }
+       }
+}
+
+void
+dlp_check_leak(const int socket_descriptor, PgDlpProtocol protocol, const char* const data, size_t data_length)
+{
+       static unsigned short int is_initialized = 0;
+
+       if (!is_initialized) {
+               dlp_init();
+               is_initialized = 1;
+       }
+
+       if (privacy_guard_dlp_check_leak_proto_info) {
+               struct dlp_hook_info hook_info = {-1, -1, 0, {0}};
+
+               dlp_get_descriptor_info(socket_descriptor, &hook_info);
+
+               privacy_guard_dlp_check_leak_proto_info(
+                       hook_info.hostname, protocol, hook_info.source_port, hook_info.destination_port,
+                       hook_info.destination_ip, data, data_length);
+       }
+}

diff --git a/lib/dlp.h b/lib/dlp.h
new file mode 100644 (file)
index 0000000..fd51a86
--- /dev/null
+++ b/lib/dlp.h
@@ -0,0 +1,32 @@
+/*
+ * libwebsockets - small server side websockets and web server implementation
+ *
+ * Copyright (C) 2010-2016 Andy Green <andy@warmcat.com>
+ * Copyright (c) 2020 Samsung Electronics Co., Ltd All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation:
+ *  version 2.1 of the License.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ *  MA  02110-1301  USA
+ */
+
+#include <stddef.h>
+
+typedef enum {
+       PRIV_GUARD_DLP_PROTOCOL_LIBWEBSOCKET_WS = 11,
+       PRIV_GUARD_DLP_PROTOCOL_LIBWEBSOCKET_WSS = 12
+} PgDlpProtocol;
+
+void
+dlp_check_leak(const int socket_descriptor, PgDlpProtocol protocol,
+                          const char* const data, size_t data_length);

diff --git a/packaging/libwebsockets.spec b/packaging/libwebsockets.spec
index 43430f99624bbe3c3bba34ab1ce26728feaed64f..44409f32e1db586f861ef45c1d39ccb2ec1ee728 100644 (file)
--- a/packaging/libwebsockets.spec
+++ b/packaging/libwebsockets.spec
@@ -33,6 +33,7 @@ Development files needed for building websocket clients and servers
 %build
 
 %cmake -DLWS_WITH_SSL=On \
+        -DLWS_WITH_TIZEN_DLP=OFF \
        -DLWS_WITHOUT_TESTAPPS=ON \
        -DLWS_WITH_SERVER_STATUS=ON \
        -DLWS_IPV6=ON \