sso

Author: lws-team

lib/roles/pipe/ops-pipe.c

@@ -52,7 +52,17 @@ rops_handle_POLLIN_pipe(struct lws_context_per_thread *pt, struct lws *wsi,
 	 */
 	n = (int)read(wsi->desc.sockfd, s, sizeof(s));
 	(void)n;
-	if (n <= 0)
+	/*
+	 * Only treat a real read error as a reason to close the pipe wsi.
+	 * read() returning 0 happens when the context is tearing down (the
+	 * write end is going away); closing the pipe wsi from inside its own
+	 * POLLIN handler during context destroy frees it out from under the
+	 * service loop that is still iterating on it, observed as a segfault
+	 * during lws_context_destroy() on libuv / distro-recommended builds.
+	 * The pipe is owned by the context and is explicitly closed as part
+	 * of normal pt destroy, so it does not need our help here.
+	 */
+	if (n < 0)
 		return LWS_HPI_RET_PLEASE_CLOSE_ME;
 #elif defined(WIN32)
 	char s[100];

lib/roles/quic/crypto-quic.c

@@ -946,19 +946,6 @@ lws_tls_quic_rx_crypto(struct lws *wsi, int level, const uint8_t *buf, size_t le
 
 		wsi->quic.qn->handshake_done = 1;
 
-		/*
-		 * If the client deferred its preferred_address migration until
-		 * the handshake was complete, execute it now: both sides have
-		 * APP keys so the PATH_CHALLENGE/RESPONSE will succeed.
-		 */
-		if (!wsi->quic.qn->is_server && wsi->quic.qn->prefaddr_pending) {
-			wsi->quic.qn->prefaddr_pending = 0;
-			lws_quic_client_probe_preferred_address(wsi,
-						&wsi->quic.qn->probing_sa46,
-						&wsi->quic.qn->prefaddr_rem_cid,
-						wsi->quic.qn->prefaddr_rem_token);
-		}
-
 		if (wsi->quic.qn->is_server) {
 			struct lws_quic_tx_frame *f_hd = lws_zalloc(sizeof(*f_hd), "HANDSHAKE_DONE");
 			if (f_hd) {

lib/roles/quic/ops-quic.c

@@ -149,22 +149,19 @@ lws_quic_client_probe_preferred_address(struct lws *nwsi,
 	if (qn->is_server)
 		return 1;
 
-	/* Save the migration parameters */
-	qn->prefaddr_original_sa46 = nwsi->udp->sa46;
-	qn->prefaddr_original_rem_cid = qn->rem_cid;
+	/* Save the migration parameters for later */
 	qn->probing_sa46 = *pref_sa46;
-	qn->probing_sa46_valid = 1;
 	if (pref_cid) {
 		qn->prefaddr_rem_cid = *pref_cid;
 		if (pref_token)
 			memcpy(qn->prefaddr_rem_token, pref_token, 16);
 	}
 
 	/*
-	 * Defer the actual socket swap + DCID change until the handshake is
-	 * complete: the preferred_address TP arrives during the handshake, and
-	 * swapping before both sides have APP keys strands the migration (the
-	 * server can't decrypt APP-level packets from the new source port).
+	 * Defer the actual socket swap + DCID change until the server confirms
+	 * handshake completion via HANDSHAKE_DONE.  The preferred_address TP
+	 * arrives during the handshake; swapping before both sides have APP
+	 * keys strands the migration.
 	 */
 	if (!qn->handshake_done) {
 		qn->prefaddr_pending = 1;
@@ -1272,7 +1269,9 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 
 		/* F-57: Validate short header DCID */
 		if (!(p[0] & 0x80) && nwsi && nwsi->quic.qn && nwsi->quic.qn->loc_cid.len) {
-			if (local_dcid_len > (size_t)n - 1 || memcmp(&p[1], nwsi->quic.qn->loc_cid.id, local_dcid_len)) {
+			if (local_dcid_len > (size_t)n - 1 ||
+			    (memcmp(&p[1], nwsi->quic.qn->loc_cid.id, local_dcid_len) &&
+			     memcmp(&p[1], nwsi->quic.qn->prefaddr_rem_cid.id, local_dcid_len))) {
 				lwsl_wsi_notice(wsi, "QUIC RX: Short header DCID mismatch");
 				/* Drop packet */
 				p += packet_size;
@@ -1501,19 +1500,6 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 					nwsi->quic.qn->probing_sa46 = migration_sa46;
 					nwsi->quic.qn->probing_sa46_valid = 1;
 
-					{
-						int _li;
-						for (_li = 0; _li <= LWS_QUIC_LEVEL_HANDSHAKE; _li++) {
-							lws_start_foreach_dll_safe(struct lws_dll2 *, _d, _d1,
-									nwsi->quic.qn->pending_tx[_li].head) {
-								struct lws_quic_tx_frame *_f = lws_container_of(_d,
-										struct lws_quic_tx_frame, list);
-								lws_dll2_remove(&_f->list);
-								lws_free(_f);
-							} lws_end_foreach_dll_safe(_d, _d1);
-						}
-					}
-
 					if (!nwsi->quic.qn->path_challenge_pending) {
 						struct lws_quic_tx_frame *f_pc =
 							lws_zalloc(sizeof(*f_pc) + 8,
@@ -1609,19 +1595,37 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 			}
 
 			int parse_res = lws_quic_parse_frames(nwsi, pn_space, &p[pn_offset + (size_t)pn_len], (size_t)dec_len, &sa46);
-			
+
 			/* ALPN negotiation might have migrated the network WSI! */
 			if (nwsi && !nwsi->quic.qn) {
 				nwsi = lws_get_quic_network_wsi(nwsi);
 			}
 
+			/*
+			 * After frame parsing may have generated Handshake-level
+			 * ACKs, discard any pending Initial/Handshake TX so those
+			 * ACKs don't race ahead of PATH_CHALLENGE to the new path.
+			 * The handshake is done; only APP-level frames (including
+			 * PATH_CHALLENGE) should reach the new client port.
+			 */
+			if (nwsi && nwsi->quic.qn && nwsi->quic.qn->probing_sa46_valid &&
+			    nwsi->quic.qn->handshake_done) {
+				int _li;
+				for (_li = 0; _li <= LWS_QUIC_LEVEL_HANDSHAKE; _li++) {
+					lws_start_foreach_dll_safe(struct lws_dll2 *, _d, _d1,
+							nwsi->quic.qn->pending_tx[_li].head) {
+						struct lws_quic_tx_frame *_f = lws_container_of(_d,
+								struct lws_quic_tx_frame, list);
+						lws_dll2_remove(&_f->list);
+						lws_free(_f);
+					} lws_end_foreach_dll_safe(_d, _d1);
+				}
+			}
+
 			/*
 			 * The server commits the new path ONLY on PATH_RESPONSE
 			 * validation (handled in parse-quic.c).  Do NOT commit
-			 * here on non-probing packets: doing so would make the
-			 * first server datagram to the new client port be a
-			 * regular ACK/STREAM frame instead of the PATH_CHALLENGE
-			 * that QIR connectionmigration requires.
+			 * here on non-probing packets.
 			 */
 
 			if (nwsi) {

lib/roles/quic/parse-quic.c

@@ -1104,6 +1104,17 @@ lws_quic_parse_frames(struct lws *nwsi, int level, uint8_t *payload, size_t payl
 				return -1;
 			} else {
 				lws_quic_discard_keys(nwsi, LWS_QUIC_LEVEL_HANDSHAKE);
+
+				/*
+				 * Now that the server confirmed handshake completion,
+				 * both sides have APP keys — safe to execute a deferred
+				 * preferred_address migration.
+				 */
+				if (nwsi->quic.qn && nwsi->quic.qn->prefaddr_pending)
+					lws_quic_client_probe_preferred_address(nwsi,
+						&nwsi->quic.qn->probing_sa46,
+						&nwsi->quic.qn->prefaddr_rem_cid,
+						nwsi->quic.qn->prefaddr_rem_token);
 			}
 			break;
 

lib/tls/schannel/schannel-quic.c

@@ -535,13 +535,22 @@ lws_tls_quic_advance_handshake(struct lws *wsi, int level,
 					 * hands us the symmetric algorithm and key size directly;
 					 * it does not currently negotiate ChaCha20-Poly1305, but
 					 * map it too for completeness.
+					 *
+					 * SEC_TRAFFIC_SECRETS.KeySize is the symmetric key size
+					 * in BYTES (matching msquic's QuicParseTrafficSecrets,
+					 * which switches on 16 / 32), not bits.  The field name
+					 * is fixed by the Windows SDK header; copy it into a
+					 * local whose name carries the units so the comparison
+					 * cannot be misread as bits again.
 					 */
 					if (!wcscmp(secrets->SymmetricAlgId, L"CHACHA20_POLY1305"))
 						wsi->tls.quic_aead = LWS_TLS_QUIC_AEAD_CHACHA20_POLY1305;
-					else if (!wcscmp(secrets->SymmetricAlgId, L"AES"))
-						wsi->tls.quic_aead = secrets->KeySize == 256 ?
+					else if (!wcscmp(secrets->SymmetricAlgId, L"AES")) {
+						unsigned short key_size_bytes = secrets->KeySize;
+						wsi->tls.quic_aead = key_size_bytes == 32 ?
 							LWS_TLS_QUIC_AEAD_AES_256_GCM :
 							LWS_TLS_QUIC_AEAD_AES_128_GCM;
+					}
 
 					/* SChannel outputs `1` and `2` for BOTH Handshake and Application secrets. */
 					if (type == 1 || type == 2) {

minimal-examples-lowlevel/api-tests/api-test-secure-streams/CMakeLists.txt

@@ -14,7 +14,7 @@ require_lws_config(USE_WOLFSSL 0 requirements)
 if (requirements)
 
 	add_executable(${PROJECT_NAME} main.c)
-	
+
 	if (LWS_CTEST_INTERNET_AVAILABLE)
 		add_test(NAME api-test-secure-streams COMMAND ${PROJECT_NAME})
 		set_tests_properties(api-test-secure-streams
@@ -23,6 +23,41 @@ if (requirements)
 				     TIMEOUT 90)
 	endif()
 
+	#
+	# Local-server variant: runs the same test logic against a local
+	# lws-minimal-http-server-httpbin over TLS, so it does not need any
+	# external network egress.  Suitable for IPv6-only / no-egress CI.
+	#
+
+	if (LWS_CTEST_INTERNET_AVAILABLE AND NOT WIN32 AND LWS_WITH_SERVER)
+		lws_get_free_port(PORT_ATS_SRV_TLS)
+
+		configure_file(policy-local.json.in policy-local.json @ONLY)
+
+		add_test(NAME st_ats_hbin
+			COMMAND ${CMAKE_SOURCE_DIR}/scripts/ctest-background.sh
+				ats_hbin $<TARGET_FILE:lws-minimal-http-server-httpbin>
+				-s -p ${PORT_ATS_SRV_TLS})
+		add_test(NAME ki_ats_hbin
+			COMMAND ${CMAKE_SOURCE_DIR}/scripts/ctest-background-kill.sh
+				ats_hbin $<TARGET_FILE_NAME:lws-minimal-http-server-httpbin>
+				-p ${PORT_ATS_SRV_TLS})
+		set_tests_properties(st_ats_hbin PROPERTIES
+				WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/minimal-examples-lowlevel/http-server/minimal-http-server-tls
+				FIXTURES_SETUP ats_hbin
+				TIMEOUT 800
+				ENVIRONMENT "SAI_LIST_PORT=${PORT_ATS_SRV_TLS}")
+		set_tests_properties(ki_ats_hbin PROPERTIES FIXTURES_CLEANUP ats_hbin)
+
+		add_test(NAME api-test-secure-streams-local
+			COMMAND ${PROJECT_NAME}
+				-c ${CMAKE_CURRENT_BINARY_DIR}/policy-local.json)
+		set_tests_properties(api-test-secure-streams-local PROPERTIES
+				WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/minimal-examples-lowlevel/api-tests/api-test-secure-streams
+				FIXTURES_REQUIRED "ats_hbin"
+				TIMEOUT 90)
+	endif()
+
 	if (websockets_shared)
 		target_link_libraries(${PROJECT_NAME} websockets_shared ${LIBWEBSOCKETS_DEP_LIBS})
 		add_dependencies(${PROJECT_NAME} websockets_shared)

minimal-examples-lowlevel/api-tests/api-test-secure-streams/main.c

@@ -17,6 +17,16 @@ static int interrupted, bad = 1;
 static lws_state_notify_link_t nl;
 static struct lws_context *context;
 
+enum {
+	LWS_SW_C,
+	LWS_SW_HELP,
+};
+
+static const struct lws_switches switches[] = {
+	[LWS_SW_C]	= { "-c",		"Policy JSON filepath" },
+	[LWS_SW_HELP]	= { "--help",		"Show this help information" },
+};
+
 static const char * const default_ss_policy =
 	"{"
 	  "\"release\":"			"\"01234567\","
@@ -397,8 +407,16 @@ sigint_handler(int sig)
 int main(int argc, const char **argv)
 {
 	struct lws_context_creation_info info;
+	const char *pp;
 	int n = 0;
 
+	(void)switches;
+
+	if ((argc == 1) || lws_cmdline_option(argc, argv, switches[LWS_SW_HELP].sw)) {
+		lws_switches_print_help(argv[0], switches, LWS_ARRAY_SIZE(switches));
+		return 0;
+	}
+
 	signal(SIGINT, sigint_handler);
 
 	lws_context_info_defaults(&info, NULL);lws_cmdline_option_handle_builtin(argc, argv, &info);
@@ -409,7 +427,17 @@ int main(int argc, const char **argv)
 
 	info.fd_limit_per_thread = 1 + 6 + 1;
 	info.port = CONTEXT_PORT_NO_LISTEN;
-	info.pss_policies_json = default_ss_policy;
+
+	/*
+	 * If we're given a policy JSON filepath, use it; otherwise fall back to
+	 * the built-in default policy (which reaches out to libwebsockets.org).
+	 */
+
+	if ((pp = lws_cmdline_option(argc, argv, switches[LWS_SW_C].sw)))
+		info.pss_policies_json = pp;
+	else
+		info.pss_policies_json = default_ss_policy;
+
 	info.options = LWS_SERVER_OPTION_EXPLICIT_VHOSTS |
 		       LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT |
 		       LWS_SERVER_OPTION_H2_JUST_FIX_WINDOW_UPDATE_OVERFLOW;

minimal-examples-lowlevel/api-tests/api-test-secure-streams/policy-local.json.in

@@ -0,0 +1,68 @@
+{
+  "release": "01234567",
+  "product": "myproduct",
+  "schema-version": 1,
+  "retry": [
+    {
+      "default": {
+        "backoff": [ 1000, 2000, 3000, 5000, 10000 ],
+        "conceal": 5,
+        "jitterpc": 20,
+        "svalidping": 30,
+        "svalidhup": 35
+      }
+    }
+  ],
+  "certs": [
+    {
+      "localhost_100y": "MIIF5jCCA86gAwIBAgIJANq50IuwPFKgMA0GCSqGSIb3DQEBCwUAMIGGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRXJld2hvbjETMBEGA1UEBwwKQWxsIGFyb3VuZDEbMBkGA1UECgwSbGlid2Vic29ja2V0cy10ZXN0MRIwEAYDVQQDDAlsb2NhbGhvc3QxHzAdBgkqhkiG9w0BCQEWEG5vbmVAaW52YWxpZC5vcmcwIBcNMTgwMzIwMDQxNjA3WhgPMjExODAyMjQwNDE2MDdaMIGGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRXJld2hvbjETMBEGA1UEBwwKQWxsIGFyb3VuZDEbMBkGA1UECgwSbGlid2Vic29ja2V0cy10ZXN0MRIwEAYDVQQDDAlsb2NhbGhvc3QxHzAdBgkqhkiG9w0BCQEWEG5vbmVAaW52YWxpZC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCjYtuWaICCY0tJPubxpIgIL+WWmz/fmK8IQr11Wtee6/IUyUlo5I602mq1qcLhT/kmpoR8Di3DAmHKnSWdPWtn1BtXLErLlUiHgZDrZWInmEBjKM1DZf+CvNGZ+EzPgBv5nTekLWcfI5ZZtoGuIP1Dl/IkNDw8zFz4cpiMe/BFGemyxdHhLrKHSm8Eo+nT734tItnHKT/m6DSU0xlZ13d6ehLRm7/+Nx47M3XMTRH5qKP/7TTE2s0U6+M0tsGI2zpRi+m6jzhNyMBTJ1u58qAe3ZW5/+YAiuZYAB6n5bhUp4oFuB5wYbcBywVR8ujInpF8buWQUjy5N8pSNp7szdYsnLJpvAd0sibrNPjC0FQCNrpNjgJmIK3+mKk4kXX7ZTwefoAzTK4l2pHNuC53QVc/EF++GBLAxmvCDq9ZpMIYi7OmzkkAKKC9Ue6Ef217LFQCFIBKIzv9cgi9fwPMLhrKleoVRNsecBsCP569WgJXhUnwf2lon4fEZr3+vRuc9shfqnV0nPN1IMSnzXCast7I2fiuRXdIz96KjlGQpP4XfNVA+RGL7aMnWOFIaVrKWLzAtgzoGMTvP/AuehKXncBJhYtW0ltTioVx+5yTYSAZWl+IssmXjefxJqYi2/7QWmv1QC9psNcjTMaBQLN03T1Qelbs7Y27sxdEnNUth4kI+wIDAQABo1MwUTAdBgNVHQ4EFgQU9mYU23tW2zsomkKTAXarjr2vjuswHwYDVR0jBBgwFoAU9mYU23tW2zsomkKTAXarjr2vjuswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEANjIBMrowYNCbhAJdP7dhlhT2RUFRdeRUJD0IxrH/hkvb6myHHnK8nOYezFPjUlmRKUgNEDuAxbnXZzPdCRNV9V2mShbXvCyiDY7WCQE2Bn44z26O0uWVk+7DNNLH9BnkwUtOnM9PwtmD9phWexm4q2GnTsiL6Ul6cy0QlTJWKVLEUQQ6yda582e23J1AXqtqFcpfoE34H3afEiGy882b+ZBiwkeV+oq6XVF8sFyr9zYrv9CvWTYlkpTQfLTZSsgPdEHYVcjvxQ2D+XyDR0aRLRlvxUa9dHGFHLICG34Juq5Ai6lM1EsoD8HSsJpMcmrH7MWw2cKkujC3rMdFTtte83wF1uuF4FjUC72+SmcQN7A386BC/nk2TTsJawTDzqwOu/VdZv2g1WpTHlumlClZeP+G/jkSyDwqNnTu1aodDmUa4xZodfhP1HWPwUKFcq8oQr148QYAAOlbUOJQU7QwRWd1VbnwhDtQWXC92A2w1n/xkZSR1BM/NUSDhkBSUU1WjMbWg6GgmnIZLRerQCu1Oozr87rOQqQakPkyt8BUSNK3K42j2qcfhAONdRl8Hq8Qs5pupy+s8sdCGDlwR3JNCMv6u48OK87F4mcIxhkSefFJUFII25pCGN5WtE4p5l+9cnO1GrIXe2Hl/7M0c/lbZ4FvXgARlex2rkgS0Ka06HE="
+    }
+  ],
+  "trust_stores": [
+    {
+      "name": "local_test",
+      "stack": [ "localhost_100y" ]
+    }
+  ],
+  "s": [
+    {
+      "httpbin_get": {
+        "endpoint": "@LWS_CTEST_SERVER_RESOLVE@",
+        "port": @PORT_ATS_SRV_TLS@,
+        "protocol": "h1",
+        "http_method": "GET",
+        "http_url": "/httpbin/bytes/2000",
+        "tls": true,
+        "opportunistic": true,
+        "retry": "default",
+        "tls_trust_store": "local_test"
+      }
+    },
+    {
+      "httpbin_get404": {
+        "endpoint": "@LWS_CTEST_SERVER_RESOLVE@",
+        "port": @PORT_ATS_SRV_TLS@,
+        "protocol": "h1",
+        "http_method": "GET",
+        "http_url": "/httpbin/status/403",
+        "tls": true,
+        "opportunistic": true,
+        "retry": "default",
+        "tls_trust_store": "local_test"
+      }
+    },
+    {
+      "httpbin_post": {
+        "endpoint": "@LWS_CTEST_SERVER_RESOLVE@",
+        "port": @PORT_ATS_SRV_TLS@,
+        "protocol": "h1",
+        "http_method": "POST",
+        "http_url": "/httpbin/bytes/2000",
+        "tls": true,
+        "opportunistic": true,
+        "retry": "default",
+        "tls_trust_store": "local_test"
+      }
+    }
+  ]
+}