kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

FS-10150: [freeswitch-core] Reduce writes to closed ssl sockets #resolve

This commit is contained in:
Anthony Minessale 2017-03-17 13:47:35 -05:00
parent 4a56cc6401
commit cd5182c27c
4 changed files with 117 additions and 101 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
libs/libks/src/kws.c
View File

@ -236,11 +236,15 @@ static int ws_client_handshake(kws_t *kws)
bytes = kws_raw_read(kws, kws->buffer + kws->datalen, kws->buflen - kws->datalen, WS_BLOCK); bytes = kws_raw_read(kws, kws->buffer + kws->datalen, kws->buflen - kws->datalen, WS_BLOCK);
} while (bytes > 0 && !strstr((char *)kws->buffer, "\r\n\r\n")); } while (bytes > 0 && !strstr((char *)kws->buffer, "\r\n\r\n"));
char accept[128] = ""; if (bytes > 0) {
char accept[128] = "";
cheezy_get_var(kws->buffer, "Sec-WebSocket-Accept", accept, sizeof(accept)); cheezy_get_var(kws->buffer, "Sec-WebSocket-Accept", accept, sizeof(accept));
if (zstr_buf(accept) || !verify_accept(kws, enonce, (char *)accept)) { if (zstr_buf(accept) || !verify_accept(kws, enonce, (char *)accept)) {
return -1;
}
} else {
return -1; return -1;
} }
@ -273,7 +277,7 @@ static int ws_server_handshake(kws_t *kws)
} }
} }
if (bytes > kws->buflen -1) { if (bytes < 0 || bytes > kws->buflen -1) {
goto err; goto err;
} }
@ -332,11 +336,13 @@ static int ws_server_handshake(kws_t *kws)
if (!kws->stay_open) { if (!kws->stay_open) {
snprintf(respond, sizeof(respond), "HTTP/1.1 400 Bad Request\r\n" if (bytes > 0) {
"Sec-WebSocket-Version: 13\r\n\r\n"); snprintf(respond, sizeof(respond), "HTTP/1.1 400 Bad Request\r\n"
respond[511] = 0; "Sec-WebSocket-Version: 13\r\n\r\n");
respond[511] = 0;
kws_raw_write(kws, respond, strlen(respond)); kws_raw_write(kws, respond, strlen(respond));
}
kws_close(kws, WS_NONE); kws_close(kws, WS_NONE);
} }
@ -880,20 +886,22 @@ KS_DECLARE(ks_ssize_t) kws_read_frame(kws_t *kws, kws_opcode_t *oc, uint8_t **da
} }
if (!kws->handshake) { if (!kws->handshake) {
return kws_close(kws, WS_PROTO_ERR); return kws_close(kws, WS_NONE);
} }
if ((kws->datalen = kws_raw_read(kws, kws->buffer, 9, kws->block)) < 0) { if ((kws->datalen = kws_raw_read(kws, kws->buffer, 9, kws->block)) < 0) {
if (kws->datalen == -2) { if (kws->datalen == -2) {
return -2; return -2;
} }
return kws_close(kws, WS_PROTO_ERR); return kws_close(kws, WS_NONE);
} }
if (kws->datalen < need) { if (kws->datalen < need) {
if ((kws->datalen += kws_raw_read(kws, kws->buffer + kws->datalen, 9 - kws->datalen, WS_BLOCK)) < need) { ssize_t bytes = kws_raw_read(kws, kws->buffer + kws->datalen, 9 - kws->datalen, WS_BLOCK);
if (bytes < 0 || (kws->datalen += bytes) < need) {
/* too small - protocol err */ /* too small - protocol err */
return kws_close(kws, WS_PROTO_ERR); return kws_close(kws, WS_NONE);
} }
} }
@ -929,7 +937,7 @@ KS_DECLARE(ks_ssize_t) kws_read_frame(kws_t *kws, kws_opcode_t *oc, uint8_t **da
if (need > kws->datalen) { if (need > kws->datalen) {
/* too small - protocol err */ /* too small - protocol err */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return kws_close(kws, WS_PROTO_ERR); return kws_close(kws, WS_NONE);
} }
} }
@ -949,9 +957,9 @@ KS_DECLARE(ks_ssize_t) kws_read_frame(kws_t *kws, kws_opcode_t *oc, uint8_t **da
more = kws_raw_read(kws, kws->buffer + kws->datalen, need - kws->datalen, WS_BLOCK); more = kws_raw_read(kws, kws->buffer + kws->datalen, need - kws->datalen, WS_BLOCK);
if (more < need - kws->datalen) { if (more < 0 || more < need - kws->datalen) {
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return kws_close(kws, WS_PROTO_ERR); return kws_close(kws, WS_NONE);
} else { } else {
kws->datalen += more; kws->datalen += more;
} }
@ -970,7 +978,7 @@ KS_DECLARE(ks_ssize_t) kws_read_frame(kws_t *kws, kws_opcode_t *oc, uint8_t **da
if (need > kws->datalen) { if (need > kws->datalen) {
/* too small - protocol err */ /* too small - protocol err */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return kws_close(kws, WS_PROTO_ERR); return kws_close(kws, WS_NONE);
} }
u16 = (uint16_t *) kws->payload; u16 = (uint16_t *) kws->payload;
@ -988,7 +996,7 @@ KS_DECLARE(ks_ssize_t) kws_read_frame(kws_t *kws, kws_opcode_t *oc, uint8_t **da
if (need < 0) { if (need < 0) {
/* invalid read - protocol err .. */ /* invalid read - protocol err .. */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return kws_close(kws, WS_PROTO_ERR); return kws_close(kws, WS_NONE);
} }
blen = kws->body - kws->bbuffer; blen = kws->body - kws->bbuffer;
@ -1019,7 +1027,7 @@ KS_DECLARE(ks_ssize_t) kws_read_frame(kws_t *kws, kws_opcode_t *oc, uint8_t **da
if (r < 1) { if (r < 1) {
/* invalid read - protocol err .. */ /* invalid read - protocol err .. */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return kws_close(kws, WS_PROTO_ERR); return kws_close(kws, WS_NONE);
} }
kws->datalen += r; kws->datalen += r;

2
libs/sofia-sip/.update
View File

@ -1 +1 @@
Tue Feb 14 14:26:14 CST 2017 Fri Mar 17 13:47:30 CDT 2017

42
libs/sofia-sip/libsofia-sip-ua/tport/ws.c
View File

@ -110,13 +110,13 @@ void init_ssl(void) {
assert(ws_globals.ssl_ctx); assert(ws_globals.ssl_ctx);
/* Disable SSLv2 */ /* Disable SSLv2 */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_SSLv2); SSL_CTX_set_options(ws_globals.ssl_ctx, SSL_OP_NO_SSLv2);
/* Disable SSLv3 */ /* Disable SSLv3 */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_SSLv3); SSL_CTX_set_options(ws_globals.ssl_ctx, SSL_OP_NO_SSLv3);
/* Disable TLSv1 */ /* Disable TLSv1 */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_TLSv1); SSL_CTX_set_options(ws_globals.ssl_ctx, SSL_OP_NO_TLSv1);
/* Disable Compression CRIME (Compression Ratio Info-leak Made Easy) */ /* Disable Compression CRIME (Compression Ratio Info-leak Made Easy) */
SSL_CTX_set_options(globals.ssl_ctx, SSL_OP_NO_COMPRESSION); SSL_CTX_set_options(ws_globals.ssl_ctx, SSL_OP_NO_COMPRESSION);
/* set the local certificate from CertFile */ /* set the local certificate from CertFile */
SSL_CTX_use_certificate_file(ws_globals.ssl_ctx, ws_globals.cert, SSL_FILETYPE_PEM); SSL_CTX_use_certificate_file(ws_globals.ssl_ctx, ws_globals.cert, SSL_FILETYPE_PEM);
/* set the private key from KeyFile */ /* set the private key from KeyFile */
@ -272,7 +272,7 @@ int ws_handshake(wsh_t *wsh)
} }
} }
if (bytes > wsh->buflen -1) { if (bytes < 0 || bytes > wsh->buflen -1) {
goto err; goto err;
} }
@ -331,11 +331,13 @@ int ws_handshake(wsh_t *wsh)
if (!wsh->stay_open) { if (!wsh->stay_open) {
snprintf(respond, sizeof(respond), "HTTP/1.1 400 Bad Request\r\n" if (bytes > 0) {
"Sec-WebSocket-Version: 13\r\n\r\n"); snprintf(respond, sizeof(respond), "HTTP/1.1 400 Bad Request\r\n"
respond[511] = 0; "Sec-WebSocket-Version: 13\r\n\r\n");
respond[511] = 0;
ws_raw_write(wsh, respond, strlen(respond)); ws_raw_write(wsh, respond, strlen(respond));
}
ws_close(wsh, WS_NONE); ws_close(wsh, WS_NONE);
} }
@ -769,20 +771,22 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
} }
if (!wsh->handshake) { if (!wsh->handshake) {
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
if ((wsh->datalen = ws_raw_read(wsh, wsh->buffer, 9, wsh->block)) < 0) { if ((wsh->datalen = ws_raw_read(wsh, wsh->buffer, 9, wsh->block)) < 0) {
if (wsh->datalen == -2) { if (wsh->datalen == -2) {
return -2; return -2;
} }
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
if (wsh->datalen < need) { if (wsh->datalen < need) {
if ((wsh->datalen += ws_raw_read(wsh, wsh->buffer + wsh->datalen, 9 - wsh->datalen, WS_BLOCK)) < need) { ssize_t bytes = ws_raw_read(wsh, wsh->buffer + wsh->datalen, 9 - wsh->datalen, WS_BLOCK);
if (bytes < 0 || (wsh->datalen += bytes) < need) {
/* too small - protocol err */ /* too small - protocol err */
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
} }
@ -818,7 +822,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
if (need > wsh->datalen) { if (need > wsh->datalen) {
/* too small - protocol err */ /* too small - protocol err */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
} }
@ -838,9 +842,9 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
more = ws_raw_read(wsh, wsh->buffer + wsh->datalen, need - wsh->datalen, WS_BLOCK); more = ws_raw_read(wsh, wsh->buffer + wsh->datalen, need - wsh->datalen, WS_BLOCK);
if (more < need - wsh->datalen) { if (more < 0 || more < need - wsh->datalen) {
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} else { } else {
wsh->datalen += more; wsh->datalen += more;
} }
@ -859,7 +863,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
if (need > wsh->datalen) { if (need > wsh->datalen) {
/* too small - protocol err */ /* too small - protocol err */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
u16 = (uint16_t *) wsh->payload; u16 = (uint16_t *) wsh->payload;
@ -877,7 +881,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
if (need < 0) { if (need < 0) {
/* invalid read - protocol err .. */ /* invalid read - protocol err .. */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
blen = wsh->body - wsh->bbuffer; blen = wsh->body - wsh->bbuffer;
@ -908,7 +912,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
if (r < 1) { if (r < 1) {
/* invalid read - protocol err .. */ /* invalid read - protocol err .. */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
wsh->datalen += r; wsh->datalen += r;

34
src/mod/endpoints/mod_verto/ws.c
View File

@ -272,7 +272,7 @@ int ws_handshake(wsh_t *wsh)
} }
} }
if (bytes > wsh->buflen -1) { if (bytes < 0 || bytes > wsh->buflen -1) {
goto err; goto err;
} }
@ -331,11 +331,13 @@ int ws_handshake(wsh_t *wsh)
if (!wsh->stay_open) { if (!wsh->stay_open) {
snprintf(respond, sizeof(respond), "HTTP/1.1 400 Bad Request\r\n" if (bytes > 0) {
"Sec-WebSocket-Version: 13\r\n\r\n"); snprintf(respond, sizeof(respond), "HTTP/1.1 400 Bad Request\r\n"
respond[511] = 0; "Sec-WebSocket-Version: 13\r\n\r\n");
respond[511] = 0;
ws_raw_write(wsh, respond, strlen(respond)); ws_raw_write(wsh, respond, strlen(respond));
}
ws_close(wsh, WS_NONE); ws_close(wsh, WS_NONE);
} }
@ -769,20 +771,22 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
} }
if (!wsh->handshake) { if (!wsh->handshake) {
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
if ((wsh->datalen = ws_raw_read(wsh, wsh->buffer, 9, wsh->block)) < 0) { if ((wsh->datalen = ws_raw_read(wsh, wsh->buffer, 9, wsh->block)) < 0) {
if (wsh->datalen == -2) { if (wsh->datalen == -2) {
return -2; return -2;
} }
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
if (wsh->datalen < need) { if (wsh->datalen < need) {
if ((wsh->datalen += ws_raw_read(wsh, wsh->buffer + wsh->datalen, 9 - wsh->datalen, WS_BLOCK)) < need) { ssize_t bytes = ws_raw_read(wsh, wsh->buffer + wsh->datalen, 9 - wsh->datalen, WS_BLOCK);
if (bytes < 0 || (wsh->datalen += bytes) < need) {
/* too small - protocol err */ /* too small - protocol err */
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
} }
@ -818,7 +822,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
if (need > wsh->datalen) { if (need > wsh->datalen) {
/* too small - protocol err */ /* too small - protocol err */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
} }
@ -838,9 +842,9 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
more = ws_raw_read(wsh, wsh->buffer + wsh->datalen, need - wsh->datalen, WS_BLOCK); more = ws_raw_read(wsh, wsh->buffer + wsh->datalen, need - wsh->datalen, WS_BLOCK);
if (more < need - wsh->datalen) { if (more < 0 || more < need - wsh->datalen) {
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} else { } else {
wsh->datalen += more; wsh->datalen += more;
} }
@ -859,7 +863,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
if (need > wsh->datalen) { if (need > wsh->datalen) {
/* too small - protocol err */ /* too small - protocol err */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
u16 = (uint16_t *) wsh->payload; u16 = (uint16_t *) wsh->payload;
@ -877,7 +881,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
if (need < 0) { if (need < 0) {
/* invalid read - protocol err .. */ /* invalid read - protocol err .. */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
blen = wsh->body - wsh->bbuffer; blen = wsh->body - wsh->bbuffer;
@ -908,7 +912,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
if (r < 1) { if (r < 1) {
/* invalid read - protocol err .. */ /* invalid read - protocol err .. */
*oc = WSOC_CLOSE; *oc = WSOC_CLOSE;
return ws_close(wsh, WS_PROTO_ERR); return ws_close(wsh, WS_NONE);
} }
wsh->datalen += r; wsh->datalen += r;