1 /* 2 * libwebsockets - small server side websockets and web server implementation 3 * 4 * Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com> 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to 8 * deal in the Software without restriction, including without limitation the 9 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or 10 * sell copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 21 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 22 * IN THE SOFTWARE. 23 * 24 * This is included from private-lib-core.h if LWS_WITH_TLS 25 */ 26 27 struct lws_context_per_thread; 28 struct lws_tls_ops { 29 int (*fake_POLLIN_for_buffered)(struct lws_context_per_thread *pt); 30 }; 31 32 struct lws_context_tls { 33 char alpn_discovered[32]; 34 const char *alpn_default; 35 time_t last_cert_check_s; 36 struct lws_dll2_owner cc_owner; 37 int count_client_contexts; 38 }; 39 40 struct lws_pt_tls { 41 struct lws_dll2_owner dll_pending_tls_owner; 42 }; 43 44 struct lws_tls_ss_pieces; 45 46 struct alpn_ctx { 47 uint8_t data[23]; 48 uint8_t len; 49 }; 50 51 struct lws_vhost_tls { 52 lws_tls_ctx *ssl_ctx; 53 lws_tls_ctx *ssl_client_ctx; 54 const char *alpn; 55 struct lws_tls_ss_pieces *ss; /* for acme tls certs */ 56 char *alloc_cert_path; 57 char *key_path; 58 #if defined(LWS_WITH_MBEDTLS) 59 lws_tls_x509 *x509_client_CA; 60 #endif 61 char ecdh_curve[16]; 62 struct alpn_ctx alpn_ctx; 63 64 int use_ssl; 65 int allow_non_ssl_on_ssl_port; 66 int ssl_info_event_mask; 67 68 unsigned int user_supplied_ssl_ctx:1; 69 unsigned int skipped_certs:1; 70 }; 71 72 struct lws_lws_tls { 73 lws_tls_conn *ssl; 74 lws_tls_bio *client_bio; 75 struct lws_dll2 dll_pending_tls; 76 unsigned int use_ssl; 77 unsigned int redirect_to_https:1; 78 }; 79 80 81 LWS_EXTERN void 82 lws_context_init_alpn(struct lws_vhost *vhost); 83 LWS_EXTERN int LWS_WARN_UNUSED_RESULT 84 lws_ssl_capable_read(struct lws *wsi, unsigned char *buf, int len); 85 LWS_EXTERN int LWS_WARN_UNUSED_RESULT 86 lws_ssl_capable_write(struct lws *wsi, unsigned char *buf, int len); 87 LWS_EXTERN int LWS_WARN_UNUSED_RESULT 88 lws_ssl_pending(struct lws *wsi); 89 LWS_EXTERN int LWS_WARN_UNUSED_RESULT 90 lws_server_socket_service_ssl(struct lws *new_wsi, lws_sockfd_type accept_fd); 91 LWS_EXTERN int 92 lws_ssl_close(struct lws *wsi); 93 LWS_EXTERN void 94 lws_ssl_SSL_CTX_destroy(struct lws_vhost *vhost); 95 LWS_EXTERN void 96 lws_ssl_context_destroy(struct lws_context *context); 97 void 98 __lws_ssl_remove_wsi_from_buffered_list(struct lws *wsi); 99 LWS_VISIBLE void 100 lws_ssl_remove_wsi_from_buffered_list(struct lws *wsi); 101 LWS_EXTERN int 102 lws_ssl_client_bio_create(struct lws *wsi); 103 LWS_EXTERN int 104 lws_ssl_client_connect1(struct lws *wsi); 105 LWS_EXTERN int 106 lws_ssl_client_connect2(struct lws *wsi, char *errbuf, int len); 107 LWS_EXTERN int 108 lws_tls_fake_POLLIN_for_buffered(struct lws_context_per_thread *pt); 109 LWS_EXTERN int 110 lws_gate_accepts(struct lws_context *context, int on); 111 LWS_EXTERN void 112 lws_ssl_bind_passphrase(lws_tls_ctx *ssl_ctx, int is_client, 113 const struct lws_context_creation_info *info); 114 LWS_EXTERN void 115 lws_ssl_info_callback(const lws_tls_conn *ssl, int where, int ret); 116 LWS_EXTERN int 117 lws_tls_server_certs_load(struct lws_vhost *vhost, struct lws *wsi, 118 const char *cert, const char *private_key, 119 const char *mem_cert, size_t len_mem_cert, 120 const char *mem_privkey, size_t mem_privkey_len); 121 LWS_EXTERN enum lws_tls_extant 122 lws_tls_generic_cert_checks(struct lws_vhost *vhost, const char *cert, 123 const char *private_key); 124 #if defined(LWS_WITH_SERVER) 125 LWS_EXTERN int 126 lws_context_init_server_ssl(const struct lws_context_creation_info *info, 127 struct lws_vhost *vhost); 128 void 129 lws_tls_acme_sni_cert_destroy(struct lws_vhost *vhost); 130 #else 131 #define lws_context_init_server_ssl(_a, _b) (0) 132 #define lws_tls_acme_sni_cert_destroy(_a) 133 #endif 134 135 LWS_EXTERN void 136 lws_ssl_destroy(struct lws_vhost *vhost); 137 138 /* 139 * lws_tls_ abstract backend implementations 140 */ 141 142 LWS_EXTERN int 143 lws_tls_server_client_cert_verify_config(struct lws_vhost *vh); 144 LWS_EXTERN int 145 lws_tls_server_vhost_backend_init(const struct lws_context_creation_info *info, 146 struct lws_vhost *vhost, struct lws *wsi); 147 LWS_EXTERN int 148 lws_tls_server_new_nonblocking(struct lws *wsi, lws_sockfd_type accept_fd); 149 150 LWS_EXTERN enum lws_ssl_capable_status 151 lws_tls_server_accept(struct lws *wsi); 152 153 LWS_EXTERN enum lws_ssl_capable_status 154 lws_tls_server_abort_connection(struct lws *wsi); 155 156 LWS_EXTERN enum lws_ssl_capable_status 157 __lws_tls_shutdown(struct lws *wsi); 158 159 LWS_EXTERN enum lws_ssl_capable_status 160 lws_tls_client_connect(struct lws *wsi); 161 LWS_EXTERN int 162 lws_tls_client_confirm_peer_cert(struct lws *wsi, char *ebuf, int ebuf_len); 163 LWS_EXTERN int 164 lws_tls_client_create_vhost_context(struct lws_vhost *vh, 165 const struct lws_context_creation_info *info, 166 const char *cipher_list, 167 const char *ca_filepath, 168 const void *ca_mem, 169 unsigned int ca_mem_len, 170 const char *cert_filepath, 171 const void *cert_mem, 172 unsigned int cert_mem_len, 173 const char *private_key_filepath); 174 175 LWS_EXTERN lws_tls_ctx * 176 lws_tls_ctx_from_wsi(struct lws *wsi); 177 LWS_EXTERN int 178 lws_ssl_get_error(struct lws *wsi, int n); 179 180 LWS_EXTERN int 181 lws_context_init_client_ssl(const struct lws_context_creation_info *info, 182 struct lws_vhost *vhost); 183 184 LWS_EXTERN void 185 lws_ssl_info_callback(const lws_tls_conn *ssl, int where, int ret); 186 187 int 188 lws_tls_fake_POLLIN_for_buffered(struct lws_context_per_thread *pt); 189