/*

 * libwebsockets - small server side websockets and web server implementation

 *

 * Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com>

 *

 * Permission is hereby granted, free of charge, to any person obtaining a copy

 * of this software and associated documentation files (the "Software"), to

 * deal in the Software without restriction, including without limitation the

 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or

 * sell copies of the Software, and to permit persons to whom the Software is

 * furnished to do so, subject to the following conditions:

 *

 * The above copyright notice and this permission notice shall be included in

 * all copies or substantial portions of the Software.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING

 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS

 * IN THE SOFTWARE.

 */

#include "lws_config.h"

#ifdef LWS_HAVE_X509_VERIFY_PARAM_set1_host

/* Before glibc 2.10, strnlen required _GNU_SOURCE */

#if !defined(_GNU_SOURCE)

#define _GNU_SOURCE

#endif

#endif

#include <string.h>

#include "private-lib-core.h"

#include "private-lib-tls-openssl.h"

/*

 * Care: many openssl apis return 1 for success.  These are translated to the

 * lws convention of 0 for success.

 */

int lws_openssl_describe_cipher(struct lws *wsi);

extern int openssl_websocket_private_data_index,

    openssl_SSL_CTX_private_data_index;

#if !defined(USE_WOLFSSL)

#if 0

#if defined(LWS_WITH_TLS_JIT_TRUST)

/*

 * Completion of sync or async JIT trust lookup

 */

int

lws_tls_jit_trust_got_cert_cb(void *got_opaque, const uint8_t *der,

            size_t der_len)

{

  X509 *x = d2i_X509(NULL, &der, (long)der_len);

  /** !!! this is not safe for async atm */

  struct lws *wsi = (struct lws *)got_opaque;

  X509_STORE *xs;

  int ret = 0;

  if (!x) {

    lwsl_err("%s: failed\n", __func__);

    return 1;

  }

  xs = SSL_CTX_get_cert_store(SSL_get_SSL_CTX(wsi->tls.ssl));

  if (xs) {

    if (X509_STORE_add_cert(xs, x) != 1) {

      lwsl_warn("%s: unable to set trusted CA\n", __func__);

      ret = 1;

    } else

      lwsl_notice("%s: added trusted CA to CTX for next time\n",

          __func__);

  } else

    lwsl_warn("%s: couldn't get cert store\n", __func__);

  X509_free(x);

  return ret;

}

#endif

#endif

static int

OpenSSL_client_verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)

{

  SSL *ssl;

  int n, err = 0;

  struct lws *wsi;

  const struct lws_protocols *lp;

  /* keep old behaviour accepting self-signed server certs */

  if (!preverify_ok) {

    err = X509_STORE_CTX_get_error(x509_ctx);

    if (err != X509_V_OK) {

      ssl = X509_STORE_CTX_get_ex_data(x509_ctx,

          SSL_get_ex_data_X509_STORE_CTX_idx());

      wsi = SSL_get_ex_data(ssl,

          openssl_websocket_private_data_index);

      if (!wsi) {

        lwsl_err("%s: can't get wsi from ssl privdata\n",

           __func__);

        return 0;

      }

      if ((err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT ||

           err == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) &&

           wsi->tls.use_ssl & LCCSCF_ALLOW_SELFSIGNED) {

        lwsl_notice("accepting self-signed "

              "certificate (verify_callback)\n");

        X509_STORE_CTX_set_error(x509_ctx, X509_V_OK);

        return 1; // ok

    } else if ((err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY ||

          err == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE) &&

          wsi->tls.use_ssl & LCCSCF_ALLOW_INSECURE) {

        lwsl_notice("accepting non-trusted certificate\n");

        X509_STORE_CTX_set_error(x509_ctx, X509_V_OK);

        return 1;  /* ok */

      } else if ((err == X509_V_ERR_CERT_NOT_YET_VALID ||

            err == X509_V_ERR_CERT_HAS_EXPIRED) &&

            wsi->tls.use_ssl & LCCSCF_ALLOW_EXPIRED) {

        if (err == X509_V_ERR_CERT_NOT_YET_VALID)

          lwsl_notice("accepting not yet valid "

                "certificate (verify_"

                "callback)\n");

        else if (err == X509_V_ERR_CERT_HAS_EXPIRED)

          lwsl_notice("accepting expired "

                "certificate (verify_"

                "callback)\n");

        X509_STORE_CTX_set_error(x509_ctx, X509_V_OK);

        return 1; // ok

      }

    }

  }

  ssl = X509_STORE_CTX_get_ex_data(x509_ctx,

           SSL_get_ex_data_X509_STORE_CTX_idx());

  wsi = SSL_get_ex_data(ssl, openssl_websocket_private_data_index);

  if (!wsi) {

    lwsl_err("%s: can't get wsi from ssl privdata\n",  __func__);

    return 0;

  }

#if defined(LWS_WITH_TLS_JIT_TRUST)

  if (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) {

    union lws_tls_cert_info_results ci;

    STACK_OF(X509) *x509_stack;

    x509_stack = X509_STORE_CTX_get1_chain(x509_ctx);

    if (x509_stack) {

      for (n = 0; n < OPENSSL_sk_num((const OPENSSL_STACK *)x509_stack) &&

            wsi->tls.kid_chain.count !=

             LWS_ARRAY_SIZE(wsi->tls.kid_chain.akid); n++) {

        X509 *x509 = OPENSSL_sk_value((const OPENSSL_STACK *)x509_stack, n);

        /* the len is the buffer size, 0 meant "never fits" */

        if (!lws_tls_openssl_cert_info(x509,

              LWS_TLS_CERT_INFO_SUBJECT_KEY_ID,

              &ci, sizeof(ci.ns.name)))

          lws_tls_kid_copy(&ci,

            &wsi->tls.kid_chain.skid[

                 wsi->tls.kid_chain.count]);

        if (!lws_tls_openssl_cert_info(x509,

               LWS_TLS_CERT_INFO_AUTHORITY_KEY_ID,

               &ci, sizeof(ci.ns.name)))

          lws_tls_kid_copy(&ci,

             &wsi->tls.kid_chain.akid[

                 wsi->tls.kid_chain.count]);

        wsi->tls.kid_chain.count++;

      }

      sk_X509_pop_free(x509_stack, X509_free);

    }

    lws_tls_jit_trust_sort_kids(wsi, &wsi->tls.kid_chain);

  }

#endif

  lp = &(lws_get_context_protocol(wsi->a.context, 0));

  if (wsi->a.protocol)

    lp = wsi->a.protocol;

  n = lp->callback(wsi,

      LWS_CALLBACK_OPENSSL_PERFORM_SERVER_CERT_VERIFICATION,

      x509_ctx, ssl, (unsigned int)preverify_ok);

  /* keep old behaviour if something wrong with server certs */

  /* if ssl error is overruled in callback and cert is ok,

   * X509_STORE_CTX_set_error(x509_ctx, X509_V_OK); must be set and

   * return value is 0 from callback */

  if (!preverify_ok) {

    int err = X509_STORE_CTX_get_error(x509_ctx);

    if (err != X509_V_OK) {

      /* cert validation error was not handled in callback */

      int depth = X509_STORE_CTX_get_error_depth(x509_ctx);

      const char *msg = X509_verify_cert_error_string(err);

      lws_strncpy(wsi->tls.err_helper, msg,

            sizeof(wsi->tls.err_helper));

      lwsl_err("SSL error: %s (preverify_ok=%d;err=%d;"

         "depth=%d)\n", msg, preverify_ok, err, depth);

      if (err == X509_V_ERR_HOSTNAME_MISMATCH) {

        const char *expected = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);

        char cert_cn[256] = "unknown";

        X509 *cert = X509_STORE_CTX_get_current_cert(x509_ctx);

        if (cert) {

          const X509_NAME *subject = X509_get_subject_name(cert);

          if (subject)

            X509_NAME_get_text_by_NID(subject, NID_commonName, cert_cn, sizeof(cert_cn));

        }

        lwsl_err("Hostname mismatch details: Expected='%s', Cert CN='%s'\n",

          expected ? expected : "unknown", cert_cn);

      }

#if defined(LWS_WITH_SYS_METRICS)

      {

        char buckname[64];

        lws_snprintf(buckname, sizeof(buckname),

               "tls=\"%s\"", msg);

        lws_metrics_hist_bump_describe_wsi(wsi,

          lws_metrics_priv_to_pub(wsi->a.context->mth_conn_failures),

          buckname);

      }

#endif

      return preverify_ok;  // not ok

    }

  }

  /*

   * convert callback return code from 0 = OK to verify callback

   * return value 1 = OK

   */

  return !n;

}

#endif

int

lws_ssl_client_bio_create(struct lws *wsi)

{

  char hostname[128];

#if (defined(LWS_HAVE_SSL_set_alpn_protos) || defined(OPENSSL_IS_AWSLC)) && \

    (defined(LWS_HAVE_SSL_get0_alpn_selected) || defined(OPENSSL_IS_AWSLC))

  uint8_t openssl_alpn[40];

  const char *alpn_comma = wsi->a.context->tls.alpn_default;

  int n;

#endif

  if (wsi->stash) {

    lws_strncpy(hostname, wsi->stash->cis[CIS_HOST], sizeof(hostname));

#if (defined(LWS_HAVE_SSL_set_alpn_protos) || defined(OPENSSL_IS_AWSLC)) && \

    (defined(LWS_HAVE_SSL_get0_alpn_selected) || defined(OPENSSL_IS_AWSLC))

    alpn_comma = wsi->stash->cis[CIS_ALPN];

#endif

  } else {

#if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)

    if (lws_hdr_copy(wsi, hostname, sizeof(hostname),

         _WSI_TOKEN_CLIENT_HOST) <= 0)

#endif

    {

      lwsl_err("%s: Unable to get hostname\n", __func__);

      return -1;

    }

  }

  /*

   * remove any :port part on the hostname... necessary for network

   * connection but typical certificates do not contain it

   */

  if (lws_tls_client_strip_port(hostname) &&

      !(wsi->tls.use_ssl & LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK)) {

    /*

     * There is no name left to check the peer cert against, and we

     * were not told to skip that check.  Fail closed: continuing

     * would ask openssl to verify the chain and nothing else

     */

    lwsl_err("%s: no usable hostname for peer cert check\n",

       __func__);

    return -1;

  }

  wsi->tls.ssl = SSL_new(wsi->a.vhost->tls.ssl_client_ctx);

  if (!wsi->tls.ssl) {

    unsigned long err = ERR_get_error();

    const char *es = ERR_error_string(LWS_TLS_ERR_CAST(err), NULL);

    lwsl_err("SSL_new failed: %s (real error %lu)\n", es, err);

    lws_tls_err_describe_clear();

    return -1;

  }

#if defined(LWS_WITH_TLS_SESSIONS)

  if (!(wsi->a.vhost->options & LWS_SERVER_OPTION_DISABLE_TLS_SESSION_CACHE))

    lws_tls_reuse_session(wsi);

#endif

#if defined (LWS_HAVE_SSL_SET_INFO_CALLBACK)

  if (wsi->a.vhost->tls.ssl_info_event_mask)

    SSL_set_info_callback(wsi->tls.ssl, lws_ssl_info_callback);

#endif

#if defined(LWS_HAVE_X509_VERIFY_PARAM_set1_host)

  if (!(wsi->tls.use_ssl & LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK)) {

#if !defined(USE_WOLFSSL)

    X509_VERIFY_PARAM *param = SSL_get0_param(wsi->tls.ssl);

    /* Enable automatic hostname checks */

    X509_VERIFY_PARAM_set_hostflags(param,

          X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);

    /*

     * Handle the case where the hostname is an IP address.

     *

     * This is the only peer name check there is... nothing

     * downstream re-checks it, lws_tls_client_confirm_peer_cert()

     * only reads SSL_get_verify_result().  So if setting the name

     * we want checked did not work, we must not continue: with no

     * name in the verify param, openssl validates the chain alone

     * and reports X509_V_OK for a cert naming anything at all

     */

    if (!X509_VERIFY_PARAM_set1_ip_asc(param, hostname) &&

        !X509_VERIFY_PARAM_set1_host(param, hostname,

          strnlen(hostname, sizeof(hostname)))) {

      lwsl_err("%s: unable to bind peer cert check to '%s'\n",

         __func__, hostname);

      return -1;

    }

#endif

  }

#else

  if (!(wsi->tls.use_ssl & LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK)) {

    lwsl_err("%s: your tls lib is too old to have "

       "X509_VERIFY_PARAM_set1_host, failing all client tls\n",

       __func__);

    return -1;

  }

#endif

#if !defined(USE_WOLFSSL)

#ifndef USE_OLD_CYASSL

  /* OpenSSL_client_verify_callback will be called @ SSL_connect() */

  SSL_set_verify(wsi->tls.ssl, SSL_VERIFY_PEER,

           OpenSSL_client_verify_callback);

#endif

#endif

#if !defined(USE_WOLFSSL)

  SSL_set_mode(wsi->tls.ssl,  SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);

#endif

  /*

   * use server name indication (SNI), if supported,

   * when establishing connection... but RFC 6066 3 says literal IPv4

   * and IPv6 addresses are not permitted in there

   */

  if (!lws_tls_client_host_is_literal(hostname)) {

#ifdef USE_WOLFSSL

#ifdef USE_OLD_CYASSL

#ifdef CYASSL_SNI_HOST_NAME

  CyaSSL_UseSNI(wsi->tls.ssl, CYASSL_SNI_HOST_NAME, hostname,

          strlen(hostname));

#endif

#else

#if defined(WOLFSSL_SNI_HOST_NAME) || defined(HAVE_SNI)

  wolfSSL_UseSNI(wsi->tls.ssl, WOLFSSL_SNI_HOST_NAME, hostname,

           (unsigned short)strlen(hostname));

#endif

#endif

#else

#if defined(SSL_CTRL_SET_TLSEXT_HOSTNAME) || defined(LWS_HAVE_SSL_set_tlsext_host_name)

  SSL_set_tlsext_host_name(wsi->tls.ssl, hostname);

#endif

#endif

  }

#ifdef USE_WOLFSSL

  /*

   * wolfSSL has no X509_VERIFY_PARAM_set1_host(): its equivalent is

   * wolfSSL_check_domain_name(), which has to be armed before the

   * handshake.  Without it nothing on this backend ever compared the

   * peer certificate against the name we asked for, ie, any certificate

   * from any trusted CA was accepted for any host... the same hazard

   * C-337 fixed on gnutls and C-408 on openssl.

   */

  if (!(wsi->tls.use_ssl & LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK)) {

#ifdef USE_OLD_CYASSL

    if (CyaSSL_check_domain_name(wsi->tls.ssl, hostname) !=

                SSL_SUCCESS)

#else

    if (wolfSSL_check_domain_name(wsi->tls.ssl, hostname) !=

                SSL_SUCCESS)

#endif

    {

      lwsl_err("%s: unable to bind peer cert check to '%s'\n",

         __func__, hostname);

      return -1;

    }

  }

  /*

   * wolfSSL/CyaSSL does certificate verification differently

   * from OpenSSL.

   * If we should ignore the certificate, we need to set

   * this before SSL_new and SSL_connect is called.

   * Otherwise the connect will simply fail with error code -155

   */

#ifdef USE_OLD_CYASSL

  if (wsi->tls.use_ssl & LCCSCF_ALLOW_SELFSIGNED)

    CyaSSL_set_verify(wsi->tls.ssl, SSL_VERIFY_NONE, NULL);

#else

  if (wsi->tls.use_ssl & LCCSCF_ALLOW_SELFSIGNED)

    wolfSSL_set_verify(wsi->tls.ssl, SSL_VERIFY_NONE, NULL);

#endif

#endif /* USE_WOLFSSL */

  wsi->tls.client_bio = BIO_new_socket((int)(lws_intptr_t)wsi->desc.sockfd,

               BIO_NOCLOSE);

  SSL_set_bio(wsi->tls.ssl, wsi->tls.client_bio, wsi->tls.client_bio);

#ifdef USE_WOLFSSL

#ifdef USE_OLD_CYASSL

  CyaSSL_set_using_nonblock(wsi->tls.ssl, 1);

#else

  wolfSSL_set_using_nonblock(wsi->tls.ssl, 1);

#endif

#else

  BIO_set_nbio(wsi->tls.client_bio, 1); /* nonblocking */

#endif

#if (defined(LWS_HAVE_SSL_set_alpn_protos) || defined(OPENSSL_IS_AWSLC)) && \

    (defined(LWS_HAVE_SSL_get0_alpn_selected) || defined(OPENSSL_IS_AWSLC))

  if (wsi->a.vhost->tls.alpn)

    alpn_comma = wsi->a.vhost->tls.alpn;

  if (wsi->role_ops && !strcmp(wsi->role_ops->name, "quic")) {

    /*

     * QUIC only carries QUIC-mapped ALPNs (h3 family).  The

     * stash / vhost lists are the TCP ALPNs (eg, "h2,http/1.1"):

     * offering those on QUIC can get "h2" negotiated on top of

     * the UDP transport, where the h2 role can never make

     * progress.  For the alt-svc QUIC race, connect2 puts the

     * h3-only list in wsi->alpn (the TCP fallback restores the

     * original from there); native h3 streams also carry their

     * ALPN in wsi->alpn.

     */

    alpn_comma = wsi->alpn[0] ? wsi->alpn : "h3";

  } else

  if (wsi->stash) {

    alpn_comma = wsi->stash->cis[CIS_ALPN];

#if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)

  } else {

    if (lws_hdr_copy(wsi, hostname, sizeof(hostname),

         _WSI_TOKEN_CLIENT_ALPN) > 0)

      alpn_comma = hostname;

#endif

  }

  lwsl_info("%s client conn using alpn list '%s'\n", wsi->role_ops->name, alpn_comma);

  n = lws_alpn_comma_to_openssl(alpn_comma, openssl_alpn,

              sizeof(openssl_alpn) - 1);

  SSL_set_alpn_protos(wsi->tls.ssl, openssl_alpn, (unsigned int)n);

#endif

  SSL_set_ex_data(wsi->tls.ssl, openssl_websocket_private_data_index,

      wsi);

  if (wsi->sys_tls_client_cert) {

    lws_system_blob_t *b = lws_system_get_blob(wsi->a.context,

          LWS_SYSBLOB_TYPE_CLIENT_CERT_DER,

          wsi->sys_tls_client_cert - 1);

    const uint8_t *data;

    size_t size;

    if (!b)

      goto no_client_cert;

    /*

     * Set up the per-connection client cert

     */

    size = lws_system_blob_get_size(b);

    if (!size)

      goto no_client_cert;

    if (lws_system_blob_get_single_ptr(b, &data))

      goto no_client_cert;

    if (SSL_use_certificate_ASN1(wsi->tls.ssl, SSL_DATA_CAST(data),

      SSL_SIZE_T_CAST(size)) != 1) {

      lwsl_err("%s: use_certificate failed\n", __func__);

      lws_tls_err_describe_clear();

      goto no_client_cert;

    }

    b = lws_system_get_blob(wsi->a.context,

          LWS_SYSBLOB_TYPE_CLIENT_KEY_DER,

          wsi->sys_tls_client_cert - 1);

    if (!b)

      goto no_client_cert;

    size = lws_system_blob_get_size(b);

    if (!size)

      goto no_client_cert;

    if (lws_system_blob_get_single_ptr(b, &data))

      goto no_client_cert;

    if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, wsi->tls.ssl, SSL_DATA_CAST(data),

      SSL_SIZE_T_CAST(size)) != 1 &&

        SSL_use_PrivateKey_ASN1(EVP_PKEY_EC, wsi->tls.ssl, SSL_DATA_CAST(data),

      SSL_SIZE_T_CAST(size)) != 1) {

      lwsl_err("%s: use_privkey failed\n", __func__);

      lws_tls_err_describe_clear();

      goto no_client_cert;

    }

    if (SSL_check_private_key(wsi->tls.ssl) != 1) {

      lwsl_err("Private SSL key doesn't match cert\n");

      lws_tls_err_describe_clear();

      return 1;

    }

    lwsl_notice("%s: set system client cert %u\n", __func__,

        wsi->sys_tls_client_cert - 1);

  }

  return 0;

no_client_cert:

  lwsl_err("%s: unable to set up system client cert %d\n", __func__,

      wsi->sys_tls_client_cert - 1);

  return 1;

}

#if defined(LWS_WITH_TCP_TLS)

enum lws_ssl_capable_status

lws_tls_client_connect(struct lws *wsi, char *errbuf, size_t elen)

{

  int m, n, en;

  unsigned long l;

#if defined(LWS_WITH_TLS_SESSIONS) && defined(LWS_HAVE_SSL_SESSION_set_time)

  SSL_SESSION *sess;

#endif

  errno = 0;

  ERR_clear_error();

  wsi->tls.err_helper[0] = '\0';

  n = SSL_connect(wsi->tls.ssl);

  en = errno;

  m = lws_ssl_get_error(wsi, n);

  /*

   * SSL_ERROR_SYSCALL means the transport failed under us, ie, the

   * handshake did not complete.  On windows the socket error appears in

   * WSAGetLastError() (which LWS_ERRNO reflects) and the CRT errno is

   * typically 0, so gating the bail on errno used to let a truncated

   * handshake fall through to the "connect OK" test below and be

   * reported upstairs as an established, cert-verified connection

   */

  if (m == SSL_ERROR_SYSCALL) {

    if (!en)

      en = LWS_ERRNO;

#if defined(WIN32) || (_LWS_ENABLED_LOGS & LLL_INFO)

    lwsl_info("%s: n %d, m %d, errno %d\n", __func__, n, m, en);

#endif

    lws_snprintf(errbuf, elen, "connect SYSCALL %d", en);

    return LWS_SSL_CAPABLE_ERROR;

  }

  if (m == SSL_ERROR_SSL) {

    l = ERR_get_error();

    n = lws_snprintf(errbuf, elen, "tls: %s", wsi->tls.err_helper);

    if (!wsi->tls.err_helper[0])

      ERR_error_string_n(LWS_TLS_ERR_CAST(l), errbuf + n, (elen - (unsigned int)n));

    return LWS_SSL_CAPABLE_ERROR;

  }

#if defined(LWS_WITH_TLS_SESSIONS)

  if (SSL_session_reused(wsi->tls.ssl)) {

#if defined(LWS_HAVE_SSL_SESSION_set_time)

    sess = SSL_get_session(wsi->tls.ssl);

    if (sess) /* should always be true */

#if defined(OPENSSL_IS_BORINGSSL) || defined(LWS_WITH_AWSLC)

      SSL_SESSION_set_time(sess, (uint64_t)time(NULL)); /* extend session lifetime */

#else

      SSL_SESSION_set_time(sess, (long)time(NULL)); /* extend session lifetime */

#endif

#endif

  }

#endif

  if (m == SSL_ERROR_WANT_READ || SSL_want_read(wsi->tls.ssl))

    return LWS_SSL_CAPABLE_MORE_SERVICE_READ;

  if (m == SSL_ERROR_WANT_WRITE || SSL_want_write(wsi->tls.ssl))

    return LWS_SSL_CAPABLE_MORE_SERVICE_WRITE;

  if (n == 1) {

    /*

     * Handle the negotiated ALPN the same way at handshake

     * completion as the gnutls backend does: this also records

     * the negotiated ALPN in the client alpn cache, so later

     * connections to the same origin can take the stored

     * knowledge into account

     */

    lws_tls_server_conn_alpn(wsi);

#if defined(LWS_TLS_SYNTHESIZE_CB)

    lws_sul_schedule(wsi->a.context, wsi->tsi,

         &wsi->tls.sul_cb_synth,

         lws_sess_cache_synth_cb, 500 * LWS_US_PER_MS);

#endif

    lwsl_info("client connect OK\n");

    lws_openssl_describe_cipher(wsi);

    return LWS_SSL_CAPABLE_DONE;

  }

  if (!n) /* we don't know what he wants, but he says to retry */

    return LWS_SSL_CAPABLE_MORE_SERVICE_READ;

  lws_snprintf(errbuf, elen, "connect unk %d", m);

  return LWS_SSL_CAPABLE_ERROR;

}

int

lws_tls_client_confirm_peer_cert(struct lws *wsi, char *ebuf, size_t ebuf_len)

{

#if !defined(USE_WOLFSSL)

  char buf[256];

  const char *es, *type = "";

  unsigned int avoid = 0;

  long n;

  errno = 0;

  ERR_clear_error();

  n = SSL_get_verify_result(wsi->tls.ssl);

  switch (n) {

  case X509_V_OK:

    return 0;

  case X509_V_ERR_HOSTNAME_MISMATCH:

    type = "tls=hostname";

    avoid = LCCSCF_SKIP_SERVER_CERT_HOSTNAME_CHECK;

    break;

  case X509_V_ERR_INVALID_CA:

  case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:

  case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:

    type = "tls=invalidca";

    avoid = LCCSCF_ALLOW_SELFSIGNED;

    break;

  case X509_V_ERR_CERT_NOT_YET_VALID:

    type = "tls=notyetvalid";

    avoid = LCCSCF_ALLOW_EXPIRED;

    break;

  case X509_V_ERR_CERT_HAS_EXPIRED:

    type = "tls=expired";

    avoid = LCCSCF_ALLOW_EXPIRED;

    break;

  }

  lwsl_info("%s: cert problem: %s\n", __func__, type);

#if defined(LWS_WITH_SYS_METRICS)

  lws_metrics_hist_bump_describe_wsi(wsi,

      lws_metrics_priv_to_pub(wsi->a.context->mth_conn_failures), type);

#endif

  if (wsi->tls.use_ssl & avoid) {

    lwsl_info("%s: allowing anyway\n", __func__);

    return 0;

  }

  es = ERR_error_string(LWS_TLS_ERR_CAST(n), buf);

  lws_snprintf(ebuf, ebuf_len,

    "server's cert didn't look good, %s X509_V_ERR = %ld: %s\n",

     type, n, es);

  lwsl_info("%s\n", ebuf);

  lws_tls_err_describe_clear();

  return -1;

#else /* USE_WOLFSSL */

  /*

   * This used to return 0 unconditionally, ie, a wolfSSL-built client

   * accepted any server certificate at all: the chain result was never

   * looked at on the one path that is supposed to look at it.

   *

   * wolfSSL's compat layer does not carry the whole X509_V_ERR_ set the

   * openssl arm above maps onto individual LCCSCF_ relaxations, and the

   * ones it does carry do not have stable values across versions, so we

   * cannot say which relaxation would cover a particular failure here.

   * What we can do is fail closed on anything that is not X509_V_OK, and

   * honour the blanket relaxation.  LCCSCF_ALLOW_SELFSIGNED is already

   * handled on this backend by the wolfSSL_set_verify(SSL_VERIFY_NONE)

   * in lws_ssl_client_bio_create(), which leaves the result X509_V_OK.

   */

  long n = SSL_get_verify_result(wsi->tls.ssl);

  if (n == X509_V_OK)

    return 0;

  if (wsi->tls.use_ssl & LCCSCF_ALLOW_INSECURE) {

    lwsl_info("%s: allowing anyway (LCCSCF_ALLOW_INSECURE)\n",

        __func__);

    return 0;

  }

  lws_snprintf(ebuf, ebuf_len, "server's cert didn't look good, "

         "X509_V_ERR = %ld", n);

  lwsl_info("%s\n", ebuf);

  return -1;

#endif

}

#endif

int

lws_tls_client_vhost_extra_cert_mem(struct lws_vhost *vh,

                const uint8_t *der, size_t der_len)

{

  X509_STORE *st;

#if defined(USE_WOLFSSL)

  X509 *x  = d2i_X509(NULL, &der, (int)der_len);

#else

  X509 *x  = d2i_X509(NULL, &der, (long)der_len);

#endif

  int n;

  if (!x) {

    lwsl_err("%s: Failed to load DER\n", __func__);

    lws_tls_err_describe_clear();

    return 1;

  }

  st = SSL_CTX_get_cert_store(vh->tls.ssl_client_ctx);

  if (!st) {

    st = X509_STORE_new();

    if (!st) {

      lwsl_err("%s: failed to create cert store\n", __func__);

      X509_free(x);

      return 1;

    }

    SSL_CTX_set_cert_store(vh->tls.ssl_client_ctx, st);

  }

  n = X509_STORE_add_cert(st, x);

  if (n != 1)

    lwsl_err("%s: failed to add cert\n", __func__);

  X509_free(x);

  return n != 1;

}

int

lws_tls_client_create_vhost_context(struct lws_vhost *vh,

            const struct lws_context_creation_info *info,

            const char *cipher_list,

            const char *ca_filepath,

            const void *ca_mem,

            unsigned int ca_mem_len,

            const char *cert_filepath,

            const void *cert_mem,

            unsigned int cert_mem_len,

            const char *private_key_filepath,

          const void *key_mem,

            unsigned int key_mem_len

          )

{

#if defined(LWS_HAVE_SSL_CTX_set1_groups_list)

  /*

   * the client-specific group list if given, else the generic

   * .ecdh_curve one

   */

  const char *group_list = vh->tls.cfg_client_ecdh_curve ?

         vh->tls.cfg_client_ecdh_curve :

         vh->tls.cfg_ecdh_curve;

#endif

  struct lws_tls_client_reuse *tcr;

  unsigned long error;

  SSL_METHOD *method;

  EVP_MD_CTX *mdctx;

  unsigned int len;

  uint8_t hash[32];

  char c;

  int n;

  /* basic openssl init already happened in context init */

  /* choose the most recent spin of the api */

#if defined(LWS_HAVE_TLS_CLIENT_METHOD)

  method = (SSL_METHOD *)TLS_client_method();

#elif defined(LWS_HAVE_TLSV1_2_CLIENT_METHOD)

  method = (SSL_METHOD *)TLSv1_2_client_method();

#else

  method = (SSL_METHOD *)SSLv23_client_method();

#endif

  if (!method) {

    const char *es;

    char buf[256];

    error = ERR_peek_error();

    es = ERR_error_string(LWS_TLS_ERR_CAST(ERR_get_error()), buf);

    lwsl_err("problem creating ssl method %lu: %s\n",

      error, es);

    return 1;

  }

  /*

   * OpenSSL client contexts are quite expensive, because they bring in

   * the system certificate bundle for each one.  So if you have multiple

   * vhosts, each with a client context, it can add up to several

   * megabytes of heap.  In the case the client contexts are configured

   * identically, they could perfectly well have shared just the one.

   *

   * For that reason, use a hash to fingerprint the context configuration

   * and prefer to reuse an existing one with the same fingerprint if

   * possible.

   */

   mdctx = EVP_MD_CTX_create();

   if (!mdctx)

     return 1;

  if (EVP_DigestInit_ex(mdctx, EVP_sha256(), NULL) != 1) {

    EVP_MD_CTX_destroy(mdctx);

    return 1;

  }

  if (info->ssl_client_options_set)

    EVP_DigestUpdate(mdctx, &info->ssl_client_options_set,

         sizeof(info->ssl_client_options_set));

#if (OPENSSL_VERSION_NUMBER >= 0x009080df) && !defined(USE_WOLFSSL)

  if (info->ssl_client_options_clear)

    EVP_DigestUpdate(mdctx, &info->ssl_client_options_clear,

         sizeof(info->ssl_client_options_clear));

#endif

  if (info->client_tls_ciphers_iana)

    EVP_DigestUpdate(mdctx, info->client_tls_ciphers_iana,

         strlen(info->client_tls_ciphers_iana));

  else {

    if (cipher_list)

      EVP_DigestUpdate(mdctx, cipher_list, strlen(cipher_list));

#if defined(LWS_HAVE_SSL_CTX_set_ciphersuites)

    if (info->client_tls_1_3_plus_cipher_list)

      EVP_DigestUpdate(mdctx, info->client_tls_1_3_plus_cipher_list,

           strlen(info->client_tls_1_3_plus_cipher_list));

#endif

  }

#if defined(LWS_HAVE_SSL_CTX_set1_groups_list)

  /* the group list also affects the identity of the client context */

  if (group_list)

    EVP_DigestUpdate(mdctx, group_list, strlen(group_list));

#endif

  if (!lws_check_opt(vh->options, LWS_SERVER_OPTION_DISABLE_OS_CA_CERTS)) {

    c = 1;

    EVP_DigestUpdate(mdctx, &c, 1);

  }

  /*

   * protocols[0] is part of the context's identity, because it is what

   * receives LWS_CALLBACK_OPENSSL_LOAD_EXTRA_CLIENT_VERIFY_CERTS, and

   * whatever it adds there lands in the ctx's X509_STORE.  If two vhosts

   * with different protocols[0] shared a ctx, a private CA one of them

   * pins would silently become trusted by the other, which may have been

   * given nothing but the OS trust store on purpose.  The digest cannot

   * see inside the callback, but it can at least keep vhosts with

   * different handlers apart.

   */

  if (vh->protocols)

    EVP_DigestUpdate(mdctx, &vh->protocols[0].callback,

         sizeof(vh->protocols[0].callback));

  if (ca_filepath)

    EVP_DigestUpdate(mdctx, ca_filepath, strlen(ca_filepath));

  if (cert_filepath)

    EVP_DigestUpdate(mdctx, cert_filepath, strlen(cert_filepath));

  if (private_key_filepath)

    EVP_DigestUpdate(mdctx, private_key_filepath,

         strlen(private_key_filepath));

  if (ca_mem && ca_mem_len)

    EVP_DigestUpdate(mdctx, ca_mem, ca_mem_len);

  if (cert_mem && cert_mem_len)

    EVP_DigestUpdate(mdctx, cert_mem, cert_mem_len);

  /*

   * The in-memory client key is part of the identity the context will

   * present: without it in the fingerprint, two vhosts with the same

   * client cert but different keys share one SSL_CTX, and the second

   * silently gets the first one's key

   */

  if (key_mem && key_mem_len)

    EVP_DigestUpdate(mdctx, key_mem, key_mem_len);

  if (info->client_ssl_private_key_password)

    EVP_DigestUpdate(mdctx, info->client_ssl_private_key_password,

         strlen(info->client_ssl_private_key_password));

  len = sizeof(hash);

  EVP_DigestFinal_ex(mdctx, hash, &len);