struct duo_ctx *
duo_open(const char *host, const char *ikey, const char *skey,
const char *progname, const char *cafile)
{
struct duo_ctx *ctx;
char *useragent;
if ((ctx = calloc(1, sizeof(*ctx))) == NULL ||
(ctx->host = strdup(host)) == NULL) {
return (duo_close(ctx));
}
if (asprintf(&useragent, "%s (%s) libduo/%s",
progname, CANONICAL_HOST, PACKAGE_VERSION) == -1) {
return (duo_close(ctx));
}
if (https_init(ikey, skey, useragent, cafile) != HTTPS_OK) {
ctx = duo_close(ctx);
} else {
ctx->conv_prompt = __prompt_fn;
ctx->conv_status = __status_fn;
}
free(useragent);
return (ctx);
}
int
https_connect(struct url *url, struct url *proxy)
{
static struct tls_config *tls_config = NULL;
int s;
/* One time initialization */
if (tls_config == NULL)
tls_config = https_init();
if ((ctx = tls_client()) == NULL) {
warnx("failed to create tls client");
return -1;
}
if (tls_configure(ctx, tls_config) != 0) {
warnx("%s: %s", __func__, tls_error(ctx));
return -1;
}
if (url->port[0] == '\0')
(void)strlcpy(url->port, "443", sizeof(url->port));
if ((s = http_connect(url, proxy)) == -1)
return -1;
if (tls_connect_socket(ctx, s, url->host) != 0) {
warnx("%s: %s", __func__, tls_error(ctx));
return -1;
}
return s;
}
static void https_handler(struct http_client_ctx *ctx,
struct k_sem *startup_sync)
{
struct tx_fifo_block *tx_data;
struct http_client_request req;
size_t len;
int ret;
/* First mbedtls specific initialization */
ret = https_init(ctx);
k_sem_give(startup_sync);
if (ret < 0) {
return;
}
reset:
http_parser_init(&ctx->parser, HTTP_RESPONSE);
ctx->rsp.data_len = 0;
/* Wait that the sender sends the data, and the peer to respond to.
*/
tx_data = k_fifo_get(&ctx->https.mbedtls.ssl_ctx.tx_fifo, K_FOREVER);
if (tx_data) {
/* Because the req pointer might disappear as it is controlled
* by application, copy the data here.
*/
memcpy(&req, tx_data->req, sizeof(req));
} else {
NET_ASSERT(tx_data);
goto reset;
}
print_info(ctx, ctx->req.method);
/* If the connection is not active, then re-connect */
ret = tcp_connect(ctx);
if (ret < 0 && ret != -EALREADY) {
k_sem_give(&ctx->req.wait);
goto reset;
}
mbedtls_ssl_session_reset(&ctx->https.mbedtls.ssl);
mbedtls_ssl_set_bio(&ctx->https.mbedtls.ssl, ctx, ssl_tx,
ssl_rx, NULL);
/* SSL handshake. The ssl_rx() function will be called next by
* mbedtls library. The ssl_rx() will block and wait that data is
* received by ssl_received() and passed to it via fifo. After
* receiving the data, this function will then proceed with secure
* connection establishment.
*/
/* Waiting SSL handshake */
do {
ret = mbedtls_ssl_handshake(&ctx->https.mbedtls.ssl);
if (ret != MBEDTLS_ERR_SSL_WANT_READ &&
ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
if (ret == MBEDTLS_ERR_SSL_CONN_EOF) {
goto close;
}
if (ret < 0) {
print_error("mbedtls_ssl_handshake returned "
"-0x%x", ret);
goto close;
}
}
} while (ret != 0);
ret = http_request(ctx, &req, BUF_ALLOC_TIMEOUT);
k_mem_pool_free(&tx_data->block);
if (ret < 0) {
NET_DBG("Send error (%d)", ret);
goto close;
}
NET_DBG("Read HTTPS response");
do {
len = ctx->rsp.response_buf_len - 1;
memset(ctx->rsp.response_buf, 0, ctx->rsp.response_buf_len);
ret = mbedtls_ssl_read(&ctx->https.mbedtls.ssl,
ctx->rsp.response_buf, len);
if (ret == 0) {
goto close;
}
if (ret == MBEDTLS_ERR_SSL_WANT_READ ||
ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
continue;
}
if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
NET_DBG("Connection was closed gracefully");
goto close;
}
if (ret == MBEDTLS_ERR_NET_CONN_RESET) {
NET_DBG("Connection was reset by peer");
goto close;
}
if (ret == -EIO) {
NET_DBG("Response received, waiting another ctx %p",
ctx);
goto next;
}
if (ret < 0) {
print_error("mbedtls_ssl_read returned -0x%x", ret);
goto close;
}
/* The data_len will count how many bytes we have read,
* this value is passed to user supplied response callback
* by on_body() and on_message_complete() functions.
*/
ctx->rsp.data_len += ret;
ret = http_parser_execute(&ctx->parser,
&ctx->settings,
ctx->rsp.response_buf,
ret);
if (!ret) {
goto close;
}
ctx->rsp.data_len = 0;
if (ret > 0) {
/* Get more data */
ret = MBEDTLS_ERR_SSL_WANT_READ;
}
} while (ret < 0);
close:
/* If there is any pending data that have not been processed yet,
* we need to free it here.
*/
if (ctx->https.mbedtls.ssl_ctx.rx_pkt) {
net_pkt_unref(ctx->https.mbedtls.ssl_ctx.rx_pkt);
ctx->https.mbedtls.ssl_ctx.rx_pkt = NULL;
ctx->https.mbedtls.ssl_ctx.frag = NULL;
}
NET_DBG("Resetting HTTPS connection %p", ctx);
tcp_disconnect(ctx);
next:
mbedtls_ssl_close_notify(&ctx->https.mbedtls.ssl);
goto reset;
}
