mirror of
https://github.com/cesanta/mongoose.git
synced 2026-11-03 13:28:44 +00:00
TLS API refactor
This commit is contained in:
cpq committed
1 parent
d9cbcb5fa8
commit
0613cc62f4
26 files changed
+1180
-1088
No files matched your search
+150
-51
@@ -1,7 +1,7 @@
|
||||
#include "printf.h"
|
||||
#include "tls.h"
|
||||
|
||||
#if MG_ENABLE_OPENSSL
|
||||
#if MG_TLS == MG_TLS_OPENSSL
|
||||
static int mg_tls_err(struct mg_tls *tls, int res) {
|
||||
int err = SSL_get_error(tls->ssl, res);
|
||||
// We've just fetched the last error from the queue.
|
||||
@@ -20,38 +20,63 @@ static int mg_tls_err(struct mg_tls *tls, int res) {
|
||||
return err;
|
||||
}
|
||||
|
||||
void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
|
||||
static STACK_OF(X509_INFO) * load_ca_certs(const char *ca, int ca_len) {
|
||||
BIO *ca_bio = BIO_new_mem_buf(ca, ca_len);
|
||||
if (!ca_bio) return NULL;
|
||||
STACK_OF(X509_INFO) *certs = PEM_X509_INFO_read_bio(ca_bio, NULL, NULL, NULL);
|
||||
BIO_free(ca_bio);
|
||||
return certs;
|
||||
}
|
||||
|
||||
static bool add_ca_certs(SSL_CTX *ctx, STACK_OF(X509_INFO) * certs) {
|
||||
X509_STORE *cert_store = SSL_CTX_get_cert_store(ctx);
|
||||
for (int i = 0; i < sk_X509_INFO_num(certs); i++) {
|
||||
X509_INFO *cert_info = sk_X509_INFO_value(certs, i);
|
||||
if (cert_info->x509 && !X509_STORE_add_cert(cert_store, cert_info->x509))
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
static EVP_PKEY *load_key(const char *key, int key_len) {
|
||||
BIO *key_bio = BIO_new_mem_buf(key, key_len);
|
||||
if (!key_bio) return NULL;
|
||||
EVP_PKEY *priv_key = PEM_read_bio_PrivateKey(key_bio, NULL, 0, NULL);
|
||||
BIO_free(key_bio);
|
||||
return priv_key;
|
||||
}
|
||||
|
||||
static X509 *load_cert(const char *cert, int cert_len) {
|
||||
BIO *cert_bio = BIO_new_mem_buf(cert, cert_len);
|
||||
if (!cert_bio) return NULL;
|
||||
X509 *x509 = PEM_read_bio_X509(cert_bio, NULL, 0, NULL);
|
||||
BIO_free(cert_bio);
|
||||
return x509;
|
||||
}
|
||||
|
||||
void mg_tls_init(struct mg_connection *c, struct mg_str hostname) {
|
||||
struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) c->mgr->tls_ctx;
|
||||
struct mg_tls *tls = (struct mg_tls *) calloc(1, sizeof(*tls));
|
||||
const char *id = "mongoose";
|
||||
static unsigned char s_initialised = 0;
|
||||
int rc;
|
||||
|
||||
if (ctx == NULL) {
|
||||
mg_error(c, "TLS context not initialized");
|
||||
goto fail;
|
||||
}
|
||||
|
||||
if (tls == NULL) {
|
||||
mg_error(c, "TLS OOM");
|
||||
goto fail;
|
||||
}
|
||||
|
||||
if (!s_initialised) {
|
||||
SSL_library_init();
|
||||
s_initialised++;
|
||||
}
|
||||
MG_DEBUG(("%lu Setting TLS, CA: %s, cert: %s, key: %s", c->id,
|
||||
opts->ca == NULL ? "null" : opts->ca,
|
||||
opts->cert == NULL ? "null" : opts->cert,
|
||||
opts->certkey == NULL ? "null" : opts->certkey));
|
||||
tls->ctx = c->is_client ? SSL_CTX_new(SSLv23_client_method())
|
||||
: SSL_CTX_new(SSLv23_server_method());
|
||||
tls->ctx = c->is_client ? SSL_CTX_new(TLS_client_method())
|
||||
: SSL_CTX_new(TLS_server_method());
|
||||
if ((tls->ssl = SSL_new(tls->ctx)) == NULL) {
|
||||
mg_error(c, "SSL_new");
|
||||
goto fail;
|
||||
}
|
||||
SSL_set_session_id_context(tls->ssl, (const uint8_t *) id,
|
||||
(unsigned) strlen(id));
|
||||
// Disable deprecated protocols
|
||||
SSL_set_options(tls->ssl, SSL_OP_NO_SSLv2);
|
||||
SSL_set_options(tls->ssl, SSL_OP_NO_SSLv3);
|
||||
SSL_set_options(tls->ssl, SSL_OP_NO_TLSv1);
|
||||
SSL_set_options(tls->ssl, SSL_OP_NO_TLSv1_1);
|
||||
|
||||
SSL_set_min_proto_version(tls->ssl, TLS1_2_VERSION);
|
||||
|
||||
#ifdef MG_ENABLE_OPENSSL_NO_COMPRESSION
|
||||
SSL_set_options(tls->ssl, SSL_OP_NO_COMPRESSION);
|
||||
#endif
|
||||
@@ -59,45 +84,54 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
|
||||
SSL_set_options(tls->ssl, SSL_OP_CIPHER_SERVER_PREFERENCE);
|
||||
#endif
|
||||
|
||||
if (opts->ca != NULL && opts->ca[0] != '\0') {
|
||||
SSL_set_verify(tls->ssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
|
||||
NULL);
|
||||
if ((rc = SSL_CTX_load_verify_locations(tls->ctx, opts->ca, NULL)) != 1) {
|
||||
mg_error(c, "load('%s') %d err %d", opts->ca, rc, mg_tls_err(tls, rc));
|
||||
goto fail;
|
||||
if (c->is_client) {
|
||||
if (ctx->client_ca) {
|
||||
SSL_set_verify(tls->ssl,
|
||||
SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
|
||||
if (!add_ca_certs(tls->ctx, ctx->client_ca)) goto fail;
|
||||
}
|
||||
if (ctx->client_cert && ctx->client_key) {
|
||||
if (SSL_use_certificate(tls->ssl, ctx->client_cert) != 1) {
|
||||
mg_error(c, "SSL_CTX_use_certificate");
|
||||
goto fail;
|
||||
}
|
||||
if (SSL_use_PrivateKey(tls->ssl, ctx->client_key) != 1) {
|
||||
mg_error(c, "SSL_CTX_use_PrivateKey");
|
||||
goto fail;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if (ctx->server_ca) {
|
||||
SSL_set_verify(tls->ssl,
|
||||
SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
|
||||
if (!add_ca_certs(tls->ctx, ctx->server_ca)) goto fail;
|
||||
}
|
||||
if (ctx->server_cert && ctx->server_key) {
|
||||
if (SSL_use_certificate(tls->ssl, ctx->server_cert) != 1) {
|
||||
mg_error(c, "SSL_CTX_use_certificate");
|
||||
goto fail;
|
||||
}
|
||||
if (SSL_use_PrivateKey(tls->ssl, ctx->server_key) != 1) {
|
||||
mg_error(c, "SSL_CTX_use_PrivateKey");
|
||||
goto fail;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (opts->cert != NULL && opts->cert[0] != '\0') {
|
||||
const char *key = opts->certkey;
|
||||
if (key == NULL) key = opts->cert;
|
||||
if ((rc = SSL_use_certificate_file(tls->ssl, opts->cert, 1)) != 1) {
|
||||
mg_error(c, "Invalid SSL cert, err %d", mg_tls_err(tls, rc));
|
||||
goto fail;
|
||||
} else if ((rc = SSL_use_PrivateKey_file(tls->ssl, key, 1)) != 1) {
|
||||
mg_error(c, "Invalid SSL key, err %d", mg_tls_err(tls, rc));
|
||||
goto fail;
|
||||
#if OPENSSL_VERSION_NUMBER > 0x10100000L
|
||||
} else if ((rc = SSL_use_certificate_chain_file(tls->ssl, opts->cert)) !=
|
||||
1) {
|
||||
mg_error(c, "Invalid chain, err %d", mg_tls_err(tls, rc));
|
||||
goto fail;
|
||||
#endif
|
||||
} else {
|
||||
SSL_set_mode(tls->ssl, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
|
||||
|
||||
SSL_set_mode(tls->ssl, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
|
||||
#if OPENSSL_VERSION_NUMBER > 0x10002000L
|
||||
SSL_set_ecdh_auto(tls->ssl, 1);
|
||||
SSL_set_ecdh_auto(tls->ssl, 1);
|
||||
#endif
|
||||
}
|
||||
}
|
||||
if (opts->ciphers != NULL) SSL_set_cipher_list(tls->ssl, opts->ciphers);
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
|
||||
if (opts->srvname.len > 0) {
|
||||
char *s = mg_mprintf("%.*s", (int) opts->srvname.len, opts->srvname.ptr);
|
||||
if (c->is_client && hostname.ptr && hostname.ptr[0] != '\0') {
|
||||
char *s = mg_mprintf("%.*s", (int) hostname.len, hostname.ptr);
|
||||
SSL_set1_host(tls->ssl, s);
|
||||
SSL_set_tlsext_host_name(tls->ssl, s);
|
||||
free(s);
|
||||
}
|
||||
#endif
|
||||
|
||||
c->tls = tls;
|
||||
c->is_tls = 1;
|
||||
c->is_tls_hs = 1;
|
||||
@@ -106,6 +140,7 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
|
||||
}
|
||||
MG_DEBUG(("%lu SSL %s OK", c->id, c->is_accepted ? "accept" : "client"));
|
||||
return;
|
||||
|
||||
fail:
|
||||
c->is_closing = 1;
|
||||
free(tls);
|
||||
@@ -155,4 +190,68 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
|
||||
if (n <= 0) return MG_IO_ERR;
|
||||
return n;
|
||||
}
|
||||
|
||||
void mg_tls_ctx_free(struct mg_mgr *mgr) {
|
||||
struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) mgr->tls_ctx;
|
||||
if (ctx) {
|
||||
if (ctx->server_cert) X509_free(ctx->server_cert);
|
||||
if (ctx->server_key) EVP_PKEY_free(ctx->server_key);
|
||||
if (ctx->server_ca)
|
||||
sk_X509_INFO_pop_free(ctx->server_ca, X509_INFO_free);
|
||||
if (ctx->client_cert) X509_free(ctx->client_cert);
|
||||
if (ctx->client_key) EVP_PKEY_free(ctx->client_key);
|
||||
if (ctx->client_ca)
|
||||
sk_X509_INFO_pop_free(ctx->client_ca, X509_INFO_free);
|
||||
free(ctx);
|
||||
mgr->tls_ctx = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
void mg_tls_ctx_init(struct mg_mgr *mgr, const struct mg_tls_opts *opts) {
|
||||
static unsigned char s_initialised = 0;
|
||||
if (!s_initialised) {
|
||||
SSL_library_init();
|
||||
s_initialised++;
|
||||
}
|
||||
|
||||
struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) calloc(1, sizeof(*ctx));
|
||||
if (ctx == NULL) return;
|
||||
|
||||
if (opts->server_cert.ptr && opts->server_cert.ptr[0] != '\0') {
|
||||
struct mg_str key = opts->server_key;
|
||||
if (!key.ptr) key = opts->server_cert;
|
||||
if (!(ctx->server_cert =
|
||||
load_cert(opts->server_cert.ptr, (int) opts->server_cert.len)))
|
||||
goto fail;
|
||||
if (!(ctx->server_key = load_key(key.ptr, (int) key.len))) goto fail;
|
||||
}
|
||||
|
||||
if (opts->server_ca.ptr && opts->server_ca.ptr[0] != '\0') {
|
||||
if (!(ctx->server_ca =
|
||||
load_ca_certs(opts->server_ca.ptr, (int) opts->server_ca.len)))
|
||||
goto fail;
|
||||
}
|
||||
|
||||
if (opts->client_cert.ptr && opts->client_cert.ptr[0] != '\0') {
|
||||
struct mg_str key = opts->client_key;
|
||||
if (!key.ptr) key = opts->client_cert;
|
||||
if (!(ctx->client_cert =
|
||||
load_cert(opts->client_cert.ptr, (int) opts->client_cert.len)))
|
||||
goto fail;
|
||||
if (!(ctx->client_key = load_key(key.ptr, (int) key.len))) goto fail;
|
||||
}
|
||||
|
||||
if (opts->client_ca.ptr && opts->client_ca.ptr[0] != '\0') {
|
||||
if (!(ctx->client_ca =
|
||||
load_ca_certs(opts->client_ca.ptr, (int) opts->client_ca.len)))
|
||||
goto fail;
|
||||
}
|
||||
|
||||
mgr->tls_ctx = ctx;
|
||||
return;
|
||||
fail:
|
||||
MG_ERROR(("TLS ctx init error"));
|
||||
mg_tls_ctx_free(mgr);
|
||||
}
|
||||
|
||||
#endif
|
||||
Reference in new issue
Block a user