multi-cert-standardization

Author: lws-team

include/libwebsockets/lws-context-vhost.h

@@ -607,7 +607,9 @@ struct lws_context_creation_info {
 	/**< VHOST: Client SSL context init: CA certificate filepath or NULL */
 	const void *client_ssl_ca_mem;
 	/**< VHOST: Client SSL context init: CA certificate memory buffer or
-	 * NULL... use this to load CA cert from memory instead of file */
+	 * NULL... use this to load CA cert(s) from memory instead of file.
+	 * Supports a single certificate (PEM or DER) or multiple concatenated
+	 * PEM certificates across all TLS backends. */
 
 	const char *client_ssl_cipher_list;
 	/**< VHOST: Client SSL context init: List of valid ciphers to use (eg,

lib/misc/base64-decode.c

@@ -124,7 +124,7 @@ lws_b64_decode_stateful(struct lws_b64state *s, const char *in, size_t *in_len,
 			while (in < end_in && *in && !v) {
 				v = (unsigned char)*in++;
 
-				if (v == '\x0a' || v == '\x0d') {
+				if (v == '\x0a' || v == '\x0d' || v == ' ' || v == '\t') {
 					v = 0;
 					continue;
 				}
@@ -194,6 +194,11 @@ lws_b64_decode_stateful(struct lws_b64state *s, const char *in, size_t *in_len,
 
 		s->done += s->len - 1;
 		s->len = 0;
+
+		if (equals) {
+			while (in < end_in && (*in == '\x0a' || *in == '\x0d' || *in == ' ' || *in == '\t'))
+				in++;
+		}
 	}
 
 	if (out < end_out)

lib/tls/gnutls/gnutls-tls.c

@@ -247,22 +247,10 @@ lws_tls_client_create_vhost_context(struct lws_vhost *vh,
 		gnutls_certificate_set_x509_trust_file(vh->tls.ssl_client_ctx->creds,
 						      ca_filepath, GNUTLS_X509_FMT_PEM);
 	} else if (ca_mem && ca_mem_len) {
-		lws_filepos_t amount = 0;
-		uint8_t *up1;
-
-		if (lws_tls_alloc_pem_to_der_file(vh->context, NULL, ca_mem,
-						  ca_mem_len, &up1, &amount)) {
-			lwsl_err("%s: Unable to decode x.509 mem\n", __func__);
+		if (lws_tls_client_vhost_ca_mem_parse(vh, ca_mem, ca_mem_len)) {
+			lwsl_err("%s: Unable to load x.509 ca_mem\n", __func__);
 			return 1;
 		}
-
-		if (lws_tls_client_vhost_extra_cert_mem(vh, up1, (size_t)amount)) {
-			lwsl_err("%s: add extra cert failed\n", __func__);
-			lws_free(up1);
-			return 1;
-		}
-
-		lws_free(up1);
 	} else {
 		gnutls_certificate_set_x509_system_trust(vh->tls.ssl_client_ctx->creds);
 	}

lib/tls/openhitls/openhitls-client.c

@@ -896,21 +896,10 @@ int lws_tls_client_create_vhost_context(
 	} else {
 		lwsl_notice("%s: loading CA from memory (%u bytes)\n", __func__,
 			    ca_mem_len);
-		if (lws_tls_alloc_pem_to_der_file(vh->context, NULL, ca_mem,
-						  ca_mem_len, &der_buf,
-						  &flen)) {
-			lwsl_err("%s: Unable to decode x.509 mem\n", __func__);
+		if (lws_tls_client_vhost_ca_mem_parse(vh, ca_mem, ca_mem_len)) {
+			lwsl_err("%s: Unable to load x.509 ca_mem\n", __func__);
 			goto bail_cfg;
 		}
-		ret = HITLS_CFG_LoadVerifyBuffer(
-		    config, der_buf, (uint32_t)flen, TLS_PARSE_FORMAT_ASN1);
-		lws_free_set_NULL(der_buf);
-		if (ret != HITLS_SUCCESS) {
-			lwsl_err(
-			    "Unable to load SSL Client certs from "
-			    "ssl_ca_mem -- client ssl isn't going to work\n");
-		} else
-			lwsl_info("loaded ssl_ca_mem\n");
 	}
 
 	/* Load client certificate if provided (OpenSSL order: filepath first).

lib/tls/openssl/openssl-client.c

@@ -674,9 +674,13 @@ lws_tls_client_vhost_extra_cert_mem(struct lws_vhost *vh,
 
 	st = SSL_CTX_get_cert_store(vh->tls.ssl_client_ctx);
 	if (!st) {
-		lwsl_err("%s: failed to get cert store\n", __func__);
-		X509_free(x);
-		return 1;
+		st = X509_STORE_new();
+		if (!st) {
+			lwsl_err("%s: failed to create cert store\n", __func__);
+			X509_free(x);
+			return 1;
+		}
+		SSL_CTX_set_cert_store(vh->tls.ssl_client_ctx, st);
 	}
 
 	n = X509_STORE_add_cert(st, x);
@@ -968,46 +972,10 @@ lws_tls_client_create_vhost_context(struct lws_vhost *vh,
 			lwsl_info("loaded ssl_ca_filepath\n");
 	} else {
 
-		lws_filepos_t amount = 0;
-		const uint8_t *up;
-		uint8_t *up1;
-
-		if (lws_tls_alloc_pem_to_der_file(vh->context, NULL, ca_mem,
-						  ca_mem_len, &up1, &amount)) {
-			lwsl_err("%s: Unable to decode x.509 mem\n", __func__);
-			lwsl_hexdump_notice(ca_mem, ca_mem_len);
+		if (lws_tls_client_vhost_ca_mem_parse(vh, ca_mem, ca_mem_len)) {
+			lwsl_err("%s: Unable to load x.509 ca_mem\n", __func__);
 			return 1;
 		}
-
-		up = up1;
-#if defined(USE_WOLFSSL)
-		client_CA = d2i_X509(NULL, &up, (int)amount);
-#else
-		client_CA = d2i_X509(NULL, &up, (long)amount);
-#endif
-		if (!client_CA) {
-			lwsl_err("%s: d2i_X509 failed\n", __func__);
-			lwsl_hexdump_notice(up1, (size_t)amount);
-			lws_tls_err_describe_clear();
-		} else {
-			x509_store = X509_STORE_new();
-			if (!X509_STORE_add_cert(x509_store, client_CA)) {
-				X509_STORE_free(x509_store);
-				lwsl_err("Unable to load SSL Client certs from "
-					 "ssl_ca_mem -- client ssl isn't going to "
-					 "work\n");
-				lws_tls_err_describe_clear();
-			} else {
-				/* it doesn't increment x509_store ref counter */
-				SSL_CTX_set_cert_store(vh->tls.ssl_client_ctx,
-						       x509_store);
-				lwsl_info("loaded ssl_ca_mem\n");
-			}
-		}
-		if (client_CA)
-			X509_free(client_CA);
-		lws_free(up1);
-	//	lws_tls_client_vhost_extra_cert_mem(vh, ca_mem, ca_mem_len);
 	}
 
 	/*

lib/tls/private-lib-tls.h

@@ -249,6 +249,13 @@ lws_tls_check_all_cert_lifetimes(struct lws_context *context);
 LWS_VISIBLE int
 lws_tls_cert_get_x509_remaining(struct lws_context *context, const char *filepath, int *days_left, int *total_days);
 
+int
+lws_tls_client_vhost_extra_cert_mem(struct lws_vhost *vh, const uint8_t *der, size_t len);
+
+int
+lws_tls_client_vhost_ca_mem_parse(struct lws_vhost *vh, const void *ca_mem,
+				  unsigned int ca_mem_len);
+
 int
 lws_tls_alloc_pem_to_der_file(struct lws_context *context, const char *filename,
 			      const char *inbuf, lws_filepos_t inlen,

lib/tls/tls.c

@@ -597,6 +597,68 @@ lws_tls_alloc_pem_to_der_file(struct lws_context *context, const char *filename,
 	return 4;
 }
 
+int
+lws_tls_client_vhost_ca_mem_parse(struct lws_vhost *vh, const void *ca_mem,
+				  unsigned int ca_mem_len)
+{
+	const char *p = (const char *)ca_mem;
+	const char *end = p + ca_mem_len;
+	const char *b, *e;
+	uint8_t *der;
+	lws_filepos_t der_len;
+	int count = 0;
+
+	if (!ca_mem || !ca_mem_len)
+		return 0;
+
+	/* If it doesn't start with or contain PEM header, assume raw DER */
+	b = strstr(p, "-----BEGIN");
+	if (!b || b >= end) {
+		return lws_tls_client_vhost_extra_cert_mem(vh, (const uint8_t *)ca_mem,
+							   (size_t)ca_mem_len);
+	}
+
+	/* It's PEM - loop over all certificate blocks in the buffer */
+	while (p < end) {
+		b = strstr(p, "-----BEGIN");
+		if (!b || b >= end)
+			break;
+
+		e = strstr(b, "-----END");
+		if (!e || e >= end)
+			break;
+
+		/* Advance past "-----END ... -----\n" line */
+		e += 8;
+		while (e < end && *e != '\n' && *e != '\0')
+			e++;
+		if (e < end && *e == '\n')
+			e++;
+
+		der = NULL;
+		der_len = 0;
+		if (!lws_tls_alloc_pem_to_der_file(vh->context, NULL, b,
+						   (lws_filepos_t)lws_ptr_diff_size_t(e, b),
+						   &der, &der_len)) {
+			if (der && der_len) {
+				if (!lws_tls_client_vhost_extra_cert_mem(vh, der,
+									(size_t)der_len))
+					count++;
+				lws_free(der);
+			}
+		}
+
+		p = e;
+	}
+
+	if (!count) {
+		lwsl_err("%s: Unable to parse any CA certs from ca_mem\n", __func__);
+		return 1;
+	}
+
+	lwsl_info("%s: loaded %d CA cert(s) from ca_mem\n", __func__, count);
+	return 0;
+}
 
 #endif
 

minimal-examples-lowlevel/api-tests/api-test-x509/main.c

@@ -84,6 +84,29 @@ int main(int argc, const char **argv)
 		goto bail;
 	}
 
+#if defined(LWS_WITH_CLIENT)
+	{
+		char multi_cert[4096];
+		struct lws_vhost *vh;
+		struct lws_context_creation_info vinfo;
+
+		lws_snprintf(multi_cert, sizeof(multi_cert), "%s%s", test_cert, test_cert);
+
+		memset(&vinfo, 0, sizeof(vinfo));
+		vinfo.vhost_name = "test_multi_ca_mem";
+		vinfo.client_ssl_ca_mem = multi_cert;
+		vinfo.client_ssl_ca_mem_len = (unsigned int)strlen(multi_cert);
+
+		vh = lws_create_vhost(context, &vinfo);
+		if (!vh) {
+			lwsl_err("lws_create_vhost failed for multi-cert ca_mem\n");
+			ret = 1;
+			goto bail;
+		}
+		lwsl_user("Multi-cert ca_mem vhost creation success\n");
+	}
+#endif
+
 	lwsl_user("Success\n");
 
 bail:

plugins/protocol_lws_login/protocol_lws_login.c

@@ -1304,27 +1304,35 @@ callback_lws_login(struct lws *wsi, enum lws_callback_reasons reason,
 				const char *token = lws_spa_get_string(pss->spa, EPN_TOKEN);
 				const char *target = lws_spa_get_string(pss->spa, EPN_TARGET);
 
-				char origin[128];
-				if (token && vhd && vhd->auth_server_url && lws_hdr_copy(wsi, origin, sizeof(origin), WSI_TOKEN_ORIGIN) > 0) {
-					size_t olen = strlen(origin);
-					if (olen == 4 && !strcmp(origin, "null")) {
-						char referer[256];
-						if (lws_hdr_copy(wsi, referer, sizeof(referer), WSI_TOKEN_HTTP_REFERER) > 0) {
-							if (strncmp(referer, vhd->auth_server_url, strlen(vhd->auth_server_url))) {
-								lwsl_err("%s: blocking SSO CSRF due to bad Referer %s\n", __func__, referer);
-								token = NULL;
-							} else {
-								lwsl_notice("%s: allowing null origin due to valid Referer\n", __func__);
-							}
-						} else {
-							lwsl_err("%s: blocking SSO CSRF due to null origin with missing Referer\n", __func__);
+				char origin[128], referer[256];
+				const char *chk_url = NULL;
+				int has_origin = lws_hdr_copy(wsi, origin, sizeof(origin), WSI_TOKEN_ORIGIN) > 0;
+				int has_referer = lws_hdr_copy(wsi, referer, sizeof(referer), WSI_TOKEN_HTTP_REFERER) > 0;
+
+				if (has_origin && strcmp(origin, "null")) {
+					chk_url = origin;
+				} else if (has_referer) {
+					chk_url = referer;
+				}
+
+				if (token && vhd && vhd->auth_server_url && chk_url) {
+					lws_parse_uri_t *puri_auth = lws_parse_uri_create(vhd->auth_server_url);
+					lws_parse_uri_t *puri_chk = lws_parse_uri_create(chk_url);
+
+					if (puri_auth && puri_chk) {
+						if (strcmp(puri_auth->scheme, puri_chk->scheme) ||
+						    strcasecmp(puri_auth->host, puri_chk->host) ||
+						    puri_auth->port != puri_chk->port) {
+							lwsl_err("%s: blocking SSO CSRF from origin/referer %s (expected %s)\n",
+								 __func__, chk_url, vhd->auth_server_url);
 							token = NULL;
+						} else {
+							lwsl_notice("%s: allowing SSO request matching auth server origin %s\n",
+								    __func__, chk_url);
 						}
-					} else if (strncmp(origin, vhd->auth_server_url, olen) ||
-					    (vhd->auth_server_url[olen] != '\0' && vhd->auth_server_url[olen] != '/')) {
-						lwsl_err("%s: blocking SSO CSRF from origin %s\n", __func__, origin);
-						token = NULL; /* Nullify to force failure */
 					}
+					if (puri_auth) lws_parse_uri_destroy(&puri_auth);
+					if (puri_chk) lws_parse_uri_destroy(&puri_chk);
 				}
 
 				if (token && target && vhd) {
@@ -1342,11 +1350,31 @@ callback_lws_login(struct lws *wsi, enum lws_callback_reasons reason,
 				if (target && target[0]) {
 					if (target[0] == '/' && target[1] != '/') {
 						final_target = target;
-					} else if (vhd->db) {
-						if (auth_verify_redirect_uri(vhd, target)) {
-							final_target = target;
-						} else {
-							lwsl_err("%s: untrusted absolute target %s\n", __func__, target);
+					} else {
+						lws_parse_uri_t *puri_tgt = lws_parse_uri_create(target);
+						if (puri_tgt) {
+							char host[128] = "";
+							const char *h = NULL;
+							if (lws_hdr_copy(wsi, host, sizeof(host), WSI_TOKEN_HOST) > 0)
+								h = host;
+#if defined(LWS_ROLE_H2)
+							else if (lws_hdr_copy(wsi, host, sizeof(host), WSI_TOKEN_HTTP_COLON_AUTHORITY) > 0)
+								h = host;
+#endif
+							if (!h) {
+								struct lws_vhost *vh = lws_get_vhost(wsi);
+								if (vh) h = lws_get_vhost_name(vh);
+							}
+							if (h && !strcasecmp(puri_tgt->host, h)) {
+								final_target = target;
+							} else if (vhd->db) {
+								if (auth_verify_redirect_uri(vhd, target)) {
+									final_target = target;
+								} else {
+									lwsl_err("%s: untrusted absolute target %s\n", __func__, target);
+								}
+							}
+							lws_parse_uri_destroy(&puri_tgt);
 						}
 					}
 				}