From 9ec48e41f772b10aab3bf574f8f71eefa94dee5d Mon Sep 17 00:00:00 2001 From: cpq Date: Thu, 21 Sep 2023 18:43:33 +0100 Subject: [PATCH] Restore tickets support --- mongoose.c | 56 ++++++++++++++++++++++++++++++++++++++++------- mongoose.h | 12 ++++++++++ src/net.c | 2 ++ src/net.h | 1 + src/tls.h | 4 ++++ src/tls_dummy.c | 6 +++++ src/tls_mbed.c | 40 ++++++++++++++++++++++++++------- src/tls_mbed.h | 7 ++++++ src/tls_openssl.c | 8 +++++++ 9 files changed, 120 insertions(+), 16 deletions(-) diff --git a/mongoose.c b/mongoose.c index 48f4d3f3..119c75a1 100644 --- a/mongoose.c +++ b/mongoose.c @@ -3788,6 +3788,7 @@ void mg_mgr_free(struct mg_mgr *mgr) { #if MG_ENABLE_EPOLL if (mgr->epoll_fd >= 0) close(mgr->epoll_fd), mgr->epoll_fd = -1; #endif + mg_tls_ctx_free(mgr); } void mg_mgr_init(struct mg_mgr *mgr) { @@ -3812,6 +3813,7 @@ void mg_mgr_init(struct mg_mgr *mgr) { mgr->dnstimeout = 3000; mgr->dns4.url = "udp://8.8.8.8:53"; mgr->dns6.url = "udp://[2001:4860:4860::8888]:53"; + mg_tls_ctx_init(mgr); } #ifdef MG_ENABLE_LINES @@ -6990,6 +6992,12 @@ size_t mg_tls_pending(struct mg_connection *c) { (void) c; return 0; } +void mg_tls_ctx_init(struct mg_mgr *mgr) { + (void) mgr; +} +void mg_tls_ctx_free(struct mg_mgr *mgr) { + (void) mgr; +} #endif #ifdef MG_ENABLE_LINES @@ -7141,14 +7149,9 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) { } #ifdef MBEDTLS_SSL_SESSION_TICKETS - mbedtls_ssl_ticket_init(&tls->ticket); - if ((rc = mbedtls_ssl_ticket_setup(&tls->ticket, mg_mbed_rng, NULL, - MBEDTLS_CIPHER_AES_128_GCM, 86400)) != 0) { - mg_error(c, " mbedtls_ssl_ticket_setup %#x", -rc); - goto fail; - } - mbedtls_ssl_conf_session_tickets_cb(&tls->conf, mbedtls_ssl_ticket_write, - mbedtls_ssl_ticket_parse, &tls->ticket); + mbedtls_ssl_conf_session_tickets_cb( + &tls->conf, mbedtls_ssl_ticket_write, mbedtls_ssl_ticket_parse, + &((struct mg_tls_ctx *) c->mgr->tls_ctx)->tickets); #endif if ((rc = mbedtls_ssl_setup(&tls->ssl, &tls->conf)) != 0) { @@ -7188,6 +7191,35 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) { if (n <= 0) return MG_IO_ERR; return n; } + +void mg_tls_ctx_init(struct mg_mgr *mgr) { + struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) calloc(1, sizeof(*ctx)); + if (ctx == NULL) { + MG_ERROR(("TLS context init OOM")); + } else { +#ifdef MBEDTLS_SSL_SESSION_TICKETS + int rc; + mbedtls_ssl_ticket_init(&ctx->tickets); + if ((rc = mbedtls_ssl_ticket_setup(&ctx->tickets, mg_mbed_rng, NULL, + MBEDTLS_CIPHER_AES_128_GCM, 86400)) != + 0) { + MG_ERROR((" mbedtls_ssl_ticket_setup %#x", -rc)); + } +#endif + mgr->tls_ctx = ctx; + } +} + +void mg_tls_ctx_free(struct mg_mgr *mgr) { + struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) mgr->tls_ctx; + if (ctx != NULL) { +#ifdef MBEDTLS_SSL_SESSION_TICKETS + mbedtls_ssl_ticket_free(&ctx->tickets); +#endif + free(ctx); + mgr->tls_ctx = NULL; + } +} #endif #ifdef MG_ENABLE_LINES @@ -7384,6 +7416,14 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) { if (n <= 0) return MG_IO_ERR; return n; } + +void mg_tls_ctx_init(struct mg_mgr *mgr) { + (void) mgr; +} + +void mg_tls_ctx_free(struct mg_mgr *mgr) { + (void) mgr; +} #endif #ifdef MG_ENABLE_LINES diff --git a/mongoose.h b/mongoose.h index 90268f4d..29becf93 100644 --- a/mongoose.h +++ b/mongoose.h @@ -1180,6 +1180,7 @@ struct mg_mgr { unsigned long nextid; // Next connection ID unsigned long timerid; // Next timer ID void *userdata; // Arbitrary user data pointer + void *tls_ctx; // TLS context shared by all TLS sessions uint16_t mqtt_id; // MQTT IDs for pub/sub void *active_dns_requests; // DNS requests in progress struct mg_timer *timers; // Active timers @@ -1358,6 +1359,10 @@ long mg_tls_recv(struct mg_connection *, void *buf, size_t len); size_t mg_tls_pending(struct mg_connection *); void mg_tls_handshake(struct mg_connection *); +// Private +void mg_tls_ctx_init(struct mg_mgr *); +void mg_tls_ctx_free(struct mg_mgr *); + @@ -1370,6 +1375,13 @@ void mg_tls_handshake(struct mg_connection *); #include #include +struct mg_tls_ctx { + int dummy; +#ifdef MBEDTLS_SSL_SESSION_TICKETS + mbedtls_ssl_ticket_context tickets; +#endif +}; + struct mg_tls { mbedtls_x509_crt ca; // Parsed CA certificate mbedtls_x509_crt cert; // Parsed certificate diff --git a/src/net.c b/src/net.c index c83ed945..c8ad7345 100644 --- a/src/net.c +++ b/src/net.c @@ -228,6 +228,7 @@ void mg_mgr_free(struct mg_mgr *mgr) { #if MG_ENABLE_EPOLL if (mgr->epoll_fd >= 0) close(mgr->epoll_fd), mgr->epoll_fd = -1; #endif + mg_tls_ctx_free(mgr); } void mg_mgr_init(struct mg_mgr *mgr) { @@ -252,4 +253,5 @@ void mg_mgr_init(struct mg_mgr *mgr) { mgr->dnstimeout = 3000; mgr->dns4.url = "udp://8.8.8.8:53"; mgr->dns6.url = "udp://[2001:4860:4860::8888]:53"; + mg_tls_ctx_init(mgr); } diff --git a/src/net.h b/src/net.h index 2e04d977..fac5fe8f 100644 --- a/src/net.h +++ b/src/net.h @@ -27,6 +27,7 @@ struct mg_mgr { unsigned long nextid; // Next connection ID unsigned long timerid; // Next timer ID void *userdata; // Arbitrary user data pointer + void *tls_ctx; // TLS context shared by all TLS sessions uint16_t mqtt_id; // MQTT IDs for pub/sub void *active_dns_requests; // DNS requests in progress struct mg_timer *timers; // Active timers diff --git a/src/tls.h b/src/tls.h index c57177eb..a8623d2f 100644 --- a/src/tls.h +++ b/src/tls.h @@ -27,3 +27,7 @@ long mg_tls_send(struct mg_connection *, const void *buf, size_t len); long mg_tls_recv(struct mg_connection *, void *buf, size_t len); size_t mg_tls_pending(struct mg_connection *); void mg_tls_handshake(struct mg_connection *); + +// Private +void mg_tls_ctx_init(struct mg_mgr *); +void mg_tls_ctx_free(struct mg_mgr *); diff --git a/src/tls_dummy.c b/src/tls_dummy.c index 601655af..2c8dedcc 100644 --- a/src/tls_dummy.c +++ b/src/tls_dummy.c @@ -21,4 +21,10 @@ size_t mg_tls_pending(struct mg_connection *c) { (void) c; return 0; } +void mg_tls_ctx_init(struct mg_mgr *mgr) { + (void) mgr; +} +void mg_tls_ctx_free(struct mg_mgr *mgr) { + (void) mgr; +} #endif diff --git a/src/tls_mbed.c b/src/tls_mbed.c index 72d2b605..d0d06ff5 100644 --- a/src/tls_mbed.c +++ b/src/tls_mbed.c @@ -144,14 +144,9 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) { } #ifdef MBEDTLS_SSL_SESSION_TICKETS - mbedtls_ssl_ticket_init(&tls->ticket); - if ((rc = mbedtls_ssl_ticket_setup(&tls->ticket, mg_mbed_rng, NULL, - MBEDTLS_CIPHER_AES_128_GCM, 86400)) != 0) { - mg_error(c, " mbedtls_ssl_ticket_setup %#x", -rc); - goto fail; - } - mbedtls_ssl_conf_session_tickets_cb(&tls->conf, mbedtls_ssl_ticket_write, - mbedtls_ssl_ticket_parse, &tls->ticket); + mbedtls_ssl_conf_session_tickets_cb( + &tls->conf, mbedtls_ssl_ticket_write, mbedtls_ssl_ticket_parse, + &((struct mg_tls_ctx *) c->mgr->tls_ctx)->tickets); #endif if ((rc = mbedtls_ssl_setup(&tls->ssl, &tls->conf)) != 0) { @@ -191,4 +186,33 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) { if (n <= 0) return MG_IO_ERR; return n; } + +void mg_tls_ctx_init(struct mg_mgr *mgr) { + struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) calloc(1, sizeof(*ctx)); + if (ctx == NULL) { + MG_ERROR(("TLS context init OOM")); + } else { +#ifdef MBEDTLS_SSL_SESSION_TICKETS + int rc; + mbedtls_ssl_ticket_init(&ctx->tickets); + if ((rc = mbedtls_ssl_ticket_setup(&ctx->tickets, mg_mbed_rng, NULL, + MBEDTLS_CIPHER_AES_128_GCM, 86400)) != + 0) { + MG_ERROR((" mbedtls_ssl_ticket_setup %#x", -rc)); + } +#endif + mgr->tls_ctx = ctx; + } +} + +void mg_tls_ctx_free(struct mg_mgr *mgr) { + struct mg_tls_ctx *ctx = (struct mg_tls_ctx *) mgr->tls_ctx; + if (ctx != NULL) { +#ifdef MBEDTLS_SSL_SESSION_TICKETS + mbedtls_ssl_ticket_free(&ctx->tickets); +#endif + free(ctx); + mgr->tls_ctx = NULL; + } +} #endif diff --git a/src/tls_mbed.h b/src/tls_mbed.h index 82265bb2..a2f3b8b4 100644 --- a/src/tls_mbed.h +++ b/src/tls_mbed.h @@ -11,6 +11,13 @@ #include #include +struct mg_tls_ctx { + int dummy; +#ifdef MBEDTLS_SSL_SESSION_TICKETS + mbedtls_ssl_ticket_context tickets; +#endif +}; + struct mg_tls { mbedtls_x509_crt ca; // Parsed CA certificate mbedtls_x509_crt cert; // Parsed certificate diff --git a/src/tls_openssl.c b/src/tls_openssl.c index 69d1c0af..af81039a 100644 --- a/src/tls_openssl.c +++ b/src/tls_openssl.c @@ -189,4 +189,12 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) { if (n <= 0) return MG_IO_ERR; return n; } + +void mg_tls_ctx_init(struct mg_mgr *mgr) { + (void) mgr; +} + +void mg_tls_ctx_free(struct mg_mgr *mgr) { + (void) mgr; +} #endif