nils/ebusd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prepare CA path+file options, use ssl lib defaults, fix reconnect with https

Browse Source
This commit is contained in:
John
2022-02-13 11:33:55 +01:00
parent 7d47e24c6c
commit d5f4ced49e
4 changed files with 72 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/utils/httpclient.cpp
+39 -6
View File
@@ -21,6 +21,11 @@
#include <cstdlib>
#include <sstream>
#include <csignal>
#ifdef HAVE_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000L
#include <sys/stat.h>
#endif
#endif // HAVE_SSL
#include "lib/utils/log.h"
namespace ebusd {
@@ -32,6 +37,15 @@ using std::hex;
#ifdef HAVE_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000L
// default CA path
#define DEFAULT_CAFILE "/etc/ssl/certs/ca-certificates.crt"
// default CA path
#define DEFAULT_CAPATH "/etc/ssl/certs"
#endif
// the time slice to sleep between repeated SSL reads/writes
#define SLEEP_NANOS 50000
bool checkError(const char* call) {
@@ -131,7 +145,8 @@ bool SSLSocket::isValid() {
// general switch for future insecure option
static const bool verifyPeer = true;
SSLSocket* SSLSocket::connect(const string& host, const uint16_t& port, bool https, int timeout) {
SSLSocket* SSLSocket::connect(const string& host, const uint16_t& port, bool https, int timeout, const char* caFile,
const char* caPath) {
BIO *bio = nullptr;
SSL_CTX *ctx = nullptr;
ostringstream ostr;
@@ -159,8 +174,21 @@ SSLSocket* SSLSocket::connect(const string& host, const uint16_t& port, bool htt
break;
}
SSL_CTX_set_verify(ctx, verifyPeer ? SSL_VERIFY_PEER : SSL_VERIFY_NONE, nullptr);
if (verifyPeer && isError("verify_loc", SSL_CTX_load_verify_locations(ctx, nullptr, "/etc/ssl/certs"), 1)) {
break;
if (verifyPeer) {
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
SSL_CTX_set_default_verify_paths(ctx);
#else
struct stat stat_buf = {};
if (!caFile && stat(DEFAULT_CAFILE, &stat_buf) == 0) {
caFile = DEFAULT_CAFILE; // use default CA file
}
if (!caPath && stat(DEFAULT_CAPATH, &stat_buf) == 0) {
caPath = DEFAULT_CAPATH; // use default CA path
}
#endif
if ((caFile || caPath) && isError("verify_loc", SSL_CTX_load_verify_locations(ctx, caFile, caPath), 1)) {
break;
}
}
const long flags = SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
SSL_CTX_set_options(ctx, flags);
@@ -291,7 +319,8 @@ bool HttpClient::connect(const string& host, const uint16_t port, bool https, co
const int timeout) {
disconnect();
#ifdef HAVE_SSL
m_socket = SSLSocket::connect(host, port, https, timeout);
m_socket = SSLSocket::connect(host, port, https, timeout, m_caFile, m_caPath);
m_https = https;
#else
if (https) {
return false;
@@ -313,7 +342,11 @@ bool HttpClient::reconnect() {
if (m_host.empty() || !m_port) {
return false;
}
m_socket = SocketClass::connect(m_host, m_port, m_timeout);
#ifdef HAVE_SSL
m_socket = SSLSocket::connect(m_host, m_port, m_https, m_timeout, m_caFile, m_caPath);
#else
m_socket = TCPSocket::connect(m_host, m_port, m_timeout);
#endif
if (!m_socket) {
return false;
}
@@ -458,7 +491,7 @@ bool HttpClient::request(const string& method, const string& uri, const string&
return pos == length;
}
size_t HttpClient::readUntil(const string& delim, const size_t length, string* result) {
size_t HttpClient::readUntil(const string& delim, size_t length, string* result) {
if (!m_buffer) {
m_buffer = reinterpret_cast<char*>(malloc(1024+1)); // 1 extra for final terminator
if (!m_buffer) {
src/lib/utils/httpclient.h
+25 -4
View File
@@ -67,9 +67,12 @@ class SSLSocket {
* @param port the port number.
* @param https true for HTTPS, false for HTTP.
* @param timeout the connect, send, and receive timeout in seconds, or 0 for blocking mode.
* @param caFile the CA file to use (uses defaults if neither caFile nor caPath are set).
* @param caPath the path with CA files to use (uses defaults if neither caFile nor caPath are set).
* @return the connected SSLSocket, or nullptr on error.
*/
static SSLSocket* connect(const string& server, const uint16_t& port, const bool https, int timeout = 0);
static SSLSocket* connect(const string& server, const uint16_t& port, bool https, int timeout,
const char* caFile = nullptr, const char* caPath = nullptr);
/**
* Write bytes to the socket.
@@ -119,8 +122,17 @@ class HttpClient {
public:
/**
* Constructor.
* @param caFile the CA file to use (uses defaults if neither caFile nor caPath are set).
* @param caPath the path with CA files to use (uses defaults if neither caFile nor caPath are set).
*/
HttpClient() : m_socket(nullptr), m_port(0), m_timeout(0), m_bufferSize(0), m_buffer(nullptr) {
explicit HttpClient(const char* caFile = nullptr, const char* caPath = nullptr) :
#ifdef HAVE_SSL
m_https(false),
m_caFile(caFile),
m_caPath(caPath),
#endif
m_socket(nullptr), m_port(0), m_timeout(0), m_bufferSize(0), m_buffer(nullptr)
{
initialize();
}
@@ -156,8 +168,8 @@ class HttpClient {
* @param host the host name to connect to.
* @param port the port to connect to.
* @param https true for HTTPS, false for HTTP.
* @param timeout the timeout in seconds, defaults to 5 seconds.
* @param userAgent the optional user agent to send in the request header.
* @param timeout the timeout in seconds, defaults to 5 seconds.
* @return true on success, false on connect failure.
*/
bool connect(const string& host, uint16_t port, bool https = false, const string& userAgent = "", int timeout = 5);
@@ -217,12 +229,21 @@ class HttpClient {
* @param result the string to append the read data to and in which to find the delimiter.
* @return the position of the delimiter if delimiter was set or the number of bytes received, or string::npos if not found.
*/
size_t readUntil(const string& delim, const size_t length, string* result);
size_t readUntil(const string& delim, size_t length, string* result);
private:
#ifdef HAVE_SSL
/** true once @a initialize() was called. */
static bool s_initialized;
/** true for HTTPS, false for HTTP. */
bool m_https;
/** the CA file to use. */
const char* m_caFile;
/** the path with CA files to use. */
const char* m_caPath;
#endif
/** the currently connected socket. */