1 /*
2 * libwebsockets - small server side websockets and web server implementation
3 *
4 * Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com>
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to
8 * deal in the Software without restriction, including without limitation the
9 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
10 * sell copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
21 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
22 * IN THE SOFTWARE.
23 */
24
25 #include "private-lib-core.h"
26
27 #if defined(LWS_WITH_SERVER)
28
29 static void
lws_sul_tls_cb(lws_sorted_usec_list_t * sul)30 lws_sul_tls_cb(lws_sorted_usec_list_t *sul)
31 {
32 struct lws_context_per_thread *pt = lws_container_of(sul,
33 struct lws_context_per_thread, sul_tls);
34
35 lws_tls_check_all_cert_lifetimes(pt->context);
36
37 __lws_sul_insert(&pt->pt_sul_owner, &pt->sul_tls,
38 (lws_usec_t)24 * 3600 * LWS_US_PER_SEC);
39 }
40
41 int
lws_context_init_server_ssl(const struct lws_context_creation_info * info,struct lws_vhost * vhost)42 lws_context_init_server_ssl(const struct lws_context_creation_info *info,
43 struct lws_vhost *vhost)
44 {
45 struct lws_context *context = vhost->context;
46 struct lws *wsi = context->pt[0].fake_wsi;
47
48 if (!lws_check_opt(info->options,
49 LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT)) {
50 vhost->tls.use_ssl = 0;
51
52 return 0;
53 }
54
55 /*
56 * If he is giving a server cert, take it as a sign he wants to use
57 * it on this vhost. User code can leave the cert filepath NULL and
58 * set the LWS_SERVER_OPTION_CREATE_VHOST_SSL_CTX option itself, in
59 * which case he's expected to set up the cert himself at
60 * LWS_CALLBACK_OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS, which
61 * provides the vhost SSL_CTX * in the user parameter.
62 */
63 if (info->ssl_cert_filepath || info->server_ssl_cert_mem)
64 vhost->options |= LWS_SERVER_OPTION_CREATE_VHOST_SSL_CTX;
65
66 if (info->port != CONTEXT_PORT_NO_LISTEN) {
67
68 vhost->tls.use_ssl = lws_check_opt(vhost->options,
69 LWS_SERVER_OPTION_CREATE_VHOST_SSL_CTX);
70
71 if (vhost->tls.use_ssl && info->ssl_cipher_list)
72 lwsl_notice(" SSL ciphers: '%s'\n",
73 info->ssl_cipher_list);
74
75 lwsl_notice(" Vhost '%s' using %sTLS mode\n",
76 vhost->name, vhost->tls.use_ssl ? "" : "non-");
77 }
78
79 /*
80 * give him a fake wsi with context + vhost set, so he can use
81 * lws_get_context() in the callback
82 */
83 wsi->vhost = vhost; /* not a real bound wsi */
84 wsi->context = context;
85 wsi->protocol = NULL;
86
87 /*
88 * as a server, if we are requiring clients to identify themselves
89 * then set the backend up for it
90 */
91 if (lws_check_opt(info->options,
92 LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT))
93 /* Normally SSL listener rejects non-ssl, optionally allow */
94 vhost->tls.allow_non_ssl_on_ssl_port = 1;
95
96 /*
97 * give user code a chance to load certs into the server
98 * allowing it to verify incoming client certs
99 */
100 if (vhost->tls.use_ssl) {
101 if (lws_tls_server_vhost_backend_init(info, vhost, wsi))
102 return -1;
103
104 lws_tls_server_client_cert_verify_config(vhost);
105
106 if (vhost->protocols[0].callback(wsi,
107 LWS_CALLBACK_OPENSSL_LOAD_EXTRA_SERVER_VERIFY_CERTS,
108 vhost->tls.ssl_ctx, vhost, 0))
109 return -1;
110 }
111
112 if (vhost->tls.use_ssl)
113 lws_context_init_alpn(vhost);
114
115 /* check certs once a day */
116
117 context->pt[0].sul_tls.cb = lws_sul_tls_cb;
118 __lws_sul_insert(&context->pt[0].pt_sul_owner, &context->pt[0].sul_tls,
119 (lws_usec_t)24 * 3600 * LWS_US_PER_SEC);
120
121 return 0;
122 }
123 #endif
124
125 int
lws_server_socket_service_ssl(struct lws * wsi,lws_sockfd_type accept_fd)126 lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd)
127 {
128 struct lws_context *context = wsi->context;
129 struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
130 struct lws_vhost *vh;
131 int n;
132
133 if (!LWS_SSL_ENABLED(wsi->vhost))
134 return 0;
135
136 switch (lwsi_state(wsi)) {
137 case LRS_SSL_INIT:
138
139 if (wsi->tls.ssl)
140 lwsl_err("%s: leaking ssl\n", __func__);
141 if (accept_fd == LWS_SOCK_INVALID)
142 assert(0);
143
144 if (lws_tls_restrict_borrow(context))
145 return 1;
146
147 if (lws_tls_server_new_nonblocking(wsi, accept_fd)) {
148 if (accept_fd != LWS_SOCK_INVALID)
149 compatible_close(accept_fd);
150 lws_tls_restrict_return(context);
151 goto fail;
152 }
153
154 #if defined(LWS_WITH_STATS)
155 context->updated = 1;
156 #endif
157 /*
158 * we are not accepted yet, but we need to enter ourselves
159 * as a live connection. That way we can retry when more
160 * pieces come if we're not sorted yet
161 */
162 lwsi_set_state(wsi, LRS_SSL_ACK_PENDING);
163
164 lws_pt_lock(pt, __func__);
165 if (__insert_wsi_socket_into_fds(context, wsi)) {
166 lwsl_err("%s: failed to insert into fds\n", __func__);
167 goto fail;
168 }
169 lws_pt_unlock(pt);
170
171 lws_set_timeout(wsi, PENDING_TIMEOUT_SSL_ACCEPT,
172 context->timeout_secs);
173
174 lwsl_debug("inserted SSL accept into fds, trying SSL_accept\n");
175
176 /* fallthru */
177
178 case LRS_SSL_ACK_PENDING:
179
180 if (lws_change_pollfd(wsi, LWS_POLLOUT, 0)) {
181 lwsl_err("%s: lws_change_pollfd failed\n", __func__);
182 goto fail;
183 }
184
185 if (wsi->vhost->tls.allow_non_ssl_on_ssl_port && !wsi->skip_fallback) {
186
187 n = recv(wsi->desc.sockfd, (char *)pt->serv_buf,
188 context->pt_serv_buf_size, MSG_PEEK);
189 /*
190 * We have LWS_SERVER_OPTION_ALLOW_NON_SSL_ON_SSL_PORT..
191 * this just means don't hang up on him because of no
192 * tls hello... what happens next is driven by
193 * additional option flags:
194 *
195 * none: fail the connection
196 *
197 * LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS:
198 * Destroy the TLS, issue a redirect using plaintext
199 * http (this may not be accepted by a client that
200 * has visited the site before and received an STS
201 * header).
202 *
203 * LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER:
204 * Destroy the TLS, continue and serve normally
205 * using http
206 *
207 * LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG:
208 * Destroy the TLS, apply whatever role and protocol
209 * were told in the vhost info struct
210 * .listen_accept_role / .listen_accept_protocol and
211 * continue with that
212 */
213
214 if (n >= 1 && pt->serv_buf[0] >= ' ') {
215 /*
216 * TLS content-type for Handshake is 0x16, and
217 * for ChangeCipherSpec Record, it's 0x14
218 *
219 * A non-ssl session will start with the HTTP
220 * method in ASCII. If we see it's not a legit
221 * SSL handshake kill the SSL for this
222 * connection and try to handle as a HTTP
223 * connection upgrade directly.
224 */
225 wsi->tls.use_ssl = 0;
226
227 lws_tls_server_abort_connection(wsi);
228 /*
229 * care... this creates wsi with no ssl when ssl
230 * is enabled and normally mandatory
231 */
232 wsi->tls.ssl = NULL;
233
234 if (lws_check_opt(wsi->vhost->options,
235 LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS)) {
236 lwsl_info("%s: redirecting from http "
237 "to https\n", __func__);
238 wsi->tls.redirect_to_https = 1;
239 goto notls_accepted;
240 }
241
242 if (lws_check_opt(wsi->vhost->options,
243 LWS_SERVER_OPTION_ALLOW_HTTP_ON_HTTPS_LISTENER)) {
244 lwsl_info("%s: allowing unencrypted "
245 "http service on tls port\n",
246 __func__);
247 goto notls_accepted;
248 }
249
250 if (lws_check_opt(wsi->vhost->options,
251 LWS_SERVER_OPTION_FALLBACK_TO_APPLY_LISTEN_ACCEPT_CONFIG)) {
252 if (lws_http_to_fallback(wsi, NULL, 0))
253 goto fail;
254 lwsl_info("%s: allowing non-tls "
255 "fallback\n", __func__);
256 goto notls_accepted;
257 }
258
259 lwsl_notice("%s: client did not send a valid "
260 "tls hello (default vhost %s)\n",
261 __func__, wsi->vhost->name);
262 goto fail;
263 }
264 if (!n) {
265 /*
266 * connection is gone, fail out
267 */
268 lwsl_debug("PEEKed 0\n");
269 goto fail;
270 }
271 if (n < 0 && (LWS_ERRNO == LWS_EAGAIN ||
272 LWS_ERRNO == LWS_EWOULDBLOCK)) {
273 /*
274 * well, we get no way to know ssl or not
275 * so go around again waiting for something
276 * to come and give us a hint, or timeout the
277 * connection.
278 */
279 if (lws_change_pollfd(wsi, 0, LWS_POLLIN)) {
280 lwsl_info("%s: change_pollfd failed\n",
281 __func__);
282 return -1;
283 }
284
285 lwsl_info("SSL_ERROR_WANT_READ\n");
286 return 0;
287 }
288 }
289
290 /* normal SSL connection processing path */
291
292 #if defined(LWS_WITH_STATS)
293 /* only set this the first time around */
294 if (!wsi->accept_start_us)
295 wsi->accept_start_us = lws_now_usecs();
296 #endif
297 errno = 0;
298 lws_stats_bump(pt, LWSSTATS_C_SSL_ACCEPT_SPIN, 1);
299 n = lws_tls_server_accept(wsi);
300 lwsl_info("SSL_accept says %d\n", n);
301 switch (n) {
302 case LWS_SSL_CAPABLE_DONE:
303 break;
304 case LWS_SSL_CAPABLE_ERROR:
305 lws_stats_bump(pt, LWSSTATS_C_SSL_CONNECTIONS_FAILED, 1);
306 lwsl_info("SSL_accept failed socket %u: %d\n",
307 wsi->desc.sockfd, n);
308 wsi->socket_is_permanently_unusable = 1;
309 goto fail;
310
311 default: /* MORE_SERVICE */
312 return 0;
313 }
314
315 lws_stats_bump(pt, LWSSTATS_C_SSL_CONNECTIONS_ACCEPTED, 1);
316 #if defined(LWS_WITH_STATS)
317 if (wsi->accept_start_us)
318 lws_stats_bump(pt,
319 LWSSTATS_US_SSL_ACCEPT_LATENCY_AVG,
320 lws_now_usecs() -
321 wsi->accept_start_us);
322 wsi->accept_start_us = lws_now_usecs();
323 #endif
324 #if defined(LWS_WITH_DETAILED_LATENCY)
325 if (context->detailed_latency_cb) {
326 wsi->detlat.type = LDLT_TLS_NEG_SERVER;
327 wsi->detlat.latencies[LAT_DUR_PROXY_RX_TO_ONWARD_TX] =
328 lws_now_usecs() -
329 wsi->detlat.earliest_write_req_pre_write;
330 wsi->detlat.latencies[LAT_DUR_USERCB] = 0;
331 lws_det_lat_cb(wsi->context, &wsi->detlat);
332 }
333 #endif
334
335 /* adapt our vhost to match the SNI SSL_CTX that was chosen */
336 vh = context->vhost_list;
337 while (vh) {
338 if (!vh->being_destroyed && wsi->tls.ssl &&
339 vh->tls.ssl_ctx == lws_tls_ctx_from_wsi(wsi)) {
340 lwsl_info("setting wsi to vh %s\n", vh->name);
341 lws_vhost_bind_wsi(vh, wsi);
342 break;
343 }
344 vh = vh->vhost_next;
345 }
346
347 /* OK, we are accepted... give him some time to negotiate */
348 lws_set_timeout(wsi, PENDING_TIMEOUT_ESTABLISH_WITH_SERVER,
349 context->timeout_secs);
350
351 lwsi_set_state(wsi, LRS_ESTABLISHED);
352 if (lws_tls_server_conn_alpn(wsi))
353 goto fail;
354 lwsl_debug("accepted new SSL conn\n");
355 break;
356
357 default:
358 break;
359 }
360
361 return 0;
362
363 notls_accepted:
364 lwsi_set_state(wsi, LRS_ESTABLISHED);
365
366 return 0;
367
368 fail:
369 return 1;
370 }
371
372