xref: /aosp_15_r20/external/libwebsockets/lib/secure-streams/policy-common.c (revision 1c60b9aca93fdbc9b5f19b2d2194c91294b22281)
1*1c60b9acSAndroid Build Coastguard Worker /*
2*1c60b9acSAndroid Build Coastguard Worker  * libwebsockets - small server side websockets and web server implementation
3*1c60b9acSAndroid Build Coastguard Worker  *
4*1c60b9acSAndroid Build Coastguard Worker  * Copyright (C) 2019 - 2021 Andy Green <[email protected]>
5*1c60b9acSAndroid Build Coastguard Worker  *
6*1c60b9acSAndroid Build Coastguard Worker  * Permission is hereby granted, free of charge, to any person obtaining a copy
7*1c60b9acSAndroid Build Coastguard Worker  * of this software and associated documentation files (the "Software"), to
8*1c60b9acSAndroid Build Coastguard Worker  * deal in the Software without restriction, including without limitation the
9*1c60b9acSAndroid Build Coastguard Worker  * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
10*1c60b9acSAndroid Build Coastguard Worker  * sell copies of the Software, and to permit persons to whom the Software is
11*1c60b9acSAndroid Build Coastguard Worker  * furnished to do so, subject to the following conditions:
12*1c60b9acSAndroid Build Coastguard Worker  *
13*1c60b9acSAndroid Build Coastguard Worker  * The above copyright notice and this permission notice shall be included in
14*1c60b9acSAndroid Build Coastguard Worker  * all copies or substantial portions of the Software.
15*1c60b9acSAndroid Build Coastguard Worker  *
16*1c60b9acSAndroid Build Coastguard Worker  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17*1c60b9acSAndroid Build Coastguard Worker  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18*1c60b9acSAndroid Build Coastguard Worker  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19*1c60b9acSAndroid Build Coastguard Worker  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20*1c60b9acSAndroid Build Coastguard Worker  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
21*1c60b9acSAndroid Build Coastguard Worker  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
22*1c60b9acSAndroid Build Coastguard Worker  * IN THE SOFTWARE.
23*1c60b9acSAndroid Build Coastguard Worker  *
24*1c60b9acSAndroid Build Coastguard Worker  * This file contains the stuff related to secure streams policy, it's always
25*1c60b9acSAndroid Build Coastguard Worker  * built if LWS_WITH_SECURE_STREAMS enabled.
26*1c60b9acSAndroid Build Coastguard Worker  */
27*1c60b9acSAndroid Build Coastguard Worker 
28*1c60b9acSAndroid Build Coastguard Worker #include <private-lib-core.h>
29*1c60b9acSAndroid Build Coastguard Worker 
30*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SYS_SMD)
31*1c60b9acSAndroid Build Coastguard Worker const lws_ss_policy_t pol_smd = {
32*1c60b9acSAndroid Build Coastguard Worker 	.flags			= 0, /* have to set something for windows */
33*1c60b9acSAndroid Build Coastguard Worker };
34*1c60b9acSAndroid Build Coastguard Worker #endif
35*1c60b9acSAndroid Build Coastguard Worker 
36*1c60b9acSAndroid Build Coastguard Worker const lws_ss_policy_t *
lws_ss_policy_lookup(const struct lws_context * context,const char * streamtype)37*1c60b9acSAndroid Build Coastguard Worker lws_ss_policy_lookup(const struct lws_context *context, const char *streamtype)
38*1c60b9acSAndroid Build Coastguard Worker {
39*1c60b9acSAndroid Build Coastguard Worker 	const lws_ss_policy_t *p = context->pss_policies;
40*1c60b9acSAndroid Build Coastguard Worker 
41*1c60b9acSAndroid Build Coastguard Worker 	if (!streamtype)
42*1c60b9acSAndroid Build Coastguard Worker 		return NULL;
43*1c60b9acSAndroid Build Coastguard Worker 
44*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SYS_SMD)
45*1c60b9acSAndroid Build Coastguard Worker 	if (!strcmp(streamtype, LWS_SMD_STREAMTYPENAME))
46*1c60b9acSAndroid Build Coastguard Worker 		return &pol_smd;
47*1c60b9acSAndroid Build Coastguard Worker #endif
48*1c60b9acSAndroid Build Coastguard Worker 
49*1c60b9acSAndroid Build Coastguard Worker 	while (p) {
50*1c60b9acSAndroid Build Coastguard Worker 		if (!strcmp(p->streamtype, streamtype))
51*1c60b9acSAndroid Build Coastguard Worker 			return p;
52*1c60b9acSAndroid Build Coastguard Worker 		p = p->next;
53*1c60b9acSAndroid Build Coastguard Worker 	}
54*1c60b9acSAndroid Build Coastguard Worker 
55*1c60b9acSAndroid Build Coastguard Worker 	return NULL;
56*1c60b9acSAndroid Build Coastguard Worker }
57*1c60b9acSAndroid Build Coastguard Worker 
58*1c60b9acSAndroid Build Coastguard Worker int
_lws_ss_set_metadata(lws_ss_metadata_t * omd,const char * name,const void * value,size_t len)59*1c60b9acSAndroid Build Coastguard Worker _lws_ss_set_metadata(lws_ss_metadata_t *omd, const char *name,
60*1c60b9acSAndroid Build Coastguard Worker 		     const void *value, size_t len)
61*1c60b9acSAndroid Build Coastguard Worker {
62*1c60b9acSAndroid Build Coastguard Worker 	/*
63*1c60b9acSAndroid Build Coastguard Worker 	 * If there was already a heap-based value, it's about to go out of
64*1c60b9acSAndroid Build Coastguard Worker 	 * scope due to us trashing the pointer.  So free it first and clear
65*1c60b9acSAndroid Build Coastguard Worker 	 * its flag indicating it's heap-based.
66*1c60b9acSAndroid Build Coastguard Worker 	 */
67*1c60b9acSAndroid Build Coastguard Worker 
68*1c60b9acSAndroid Build Coastguard Worker 	if (omd->value_on_lws_heap) {
69*1c60b9acSAndroid Build Coastguard Worker 		lws_free_set_NULL(omd->value__may_own_heap);
70*1c60b9acSAndroid Build Coastguard Worker 		omd->value_on_lws_heap = 0;
71*1c60b9acSAndroid Build Coastguard Worker 	}
72*1c60b9acSAndroid Build Coastguard Worker 
73*1c60b9acSAndroid Build Coastguard Worker 	// lwsl_notice("%s: %s %s\n", __func__, name, (const char *)value);
74*1c60b9acSAndroid Build Coastguard Worker 
75*1c60b9acSAndroid Build Coastguard Worker 	omd->name = name;
76*1c60b9acSAndroid Build Coastguard Worker 	omd->value__may_own_heap = (void *)value;
77*1c60b9acSAndroid Build Coastguard Worker 	omd->length = len;
78*1c60b9acSAndroid Build Coastguard Worker 
79*1c60b9acSAndroid Build Coastguard Worker 	return 0;
80*1c60b9acSAndroid Build Coastguard Worker }
81*1c60b9acSAndroid Build Coastguard Worker 
82*1c60b9acSAndroid Build Coastguard Worker int
lws_ss_set_metadata(struct lws_ss_handle * h,const char * name,const void * value,size_t len)83*1c60b9acSAndroid Build Coastguard Worker lws_ss_set_metadata(struct lws_ss_handle *h, const char *name,
84*1c60b9acSAndroid Build Coastguard Worker 		    const void *value, size_t len)
85*1c60b9acSAndroid Build Coastguard Worker {
86*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_metadata_t *omd = lws_ss_get_handle_metadata(h, name);
87*1c60b9acSAndroid Build Coastguard Worker 
88*1c60b9acSAndroid Build Coastguard Worker 	lws_service_assert_loop_thread(h->context, h->tsi);
89*1c60b9acSAndroid Build Coastguard Worker 
90*1c60b9acSAndroid Build Coastguard Worker 	if (omd)
91*1c60b9acSAndroid Build Coastguard Worker 		return _lws_ss_set_metadata(omd, name, value, len);
92*1c60b9acSAndroid Build Coastguard Worker 
93*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SS_DIRECT_PROTOCOL_STR)
94*1c60b9acSAndroid Build Coastguard Worker 	if (h->policy->flags & LWSSSPOLF_DIRECT_PROTO_STR) {
95*1c60b9acSAndroid Build Coastguard Worker 		omd = lws_ss_get_handle_instant_metadata(h, name);
96*1c60b9acSAndroid Build Coastguard Worker 		if (!omd) {
97*1c60b9acSAndroid Build Coastguard Worker 			omd = lws_zalloc(sizeof(*omd), "imetadata");
98*1c60b9acSAndroid Build Coastguard Worker 			if (!omd) {
99*1c60b9acSAndroid Build Coastguard Worker 				lwsl_err("%s OOM\n", __func__);
100*1c60b9acSAndroid Build Coastguard Worker 				return 1;
101*1c60b9acSAndroid Build Coastguard Worker 			}
102*1c60b9acSAndroid Build Coastguard Worker 			omd->name = name;
103*1c60b9acSAndroid Build Coastguard Worker 			omd->next = h->instant_metadata;
104*1c60b9acSAndroid Build Coastguard Worker 			h->instant_metadata = omd;
105*1c60b9acSAndroid Build Coastguard Worker 		}
106*1c60b9acSAndroid Build Coastguard Worker 		omd->value__may_own_heap = (void *)value;
107*1c60b9acSAndroid Build Coastguard Worker 		omd->length = len;
108*1c60b9acSAndroid Build Coastguard Worker 
109*1c60b9acSAndroid Build Coastguard Worker 		return 0;
110*1c60b9acSAndroid Build Coastguard Worker 	}
111*1c60b9acSAndroid Build Coastguard Worker #endif
112*1c60b9acSAndroid Build Coastguard Worker 
113*1c60b9acSAndroid Build Coastguard Worker 	lwsl_info("%s: unknown metadata %s\n", __func__, name);
114*1c60b9acSAndroid Build Coastguard Worker 	return 1;
115*1c60b9acSAndroid Build Coastguard Worker }
116*1c60b9acSAndroid Build Coastguard Worker 
117*1c60b9acSAndroid Build Coastguard Worker int
_lws_ss_alloc_set_metadata(lws_ss_metadata_t * omd,const char * name,const void * value,size_t len)118*1c60b9acSAndroid Build Coastguard Worker _lws_ss_alloc_set_metadata(lws_ss_metadata_t *omd, const char *name,
119*1c60b9acSAndroid Build Coastguard Worker 			   const void *value, size_t len)
120*1c60b9acSAndroid Build Coastguard Worker {
121*1c60b9acSAndroid Build Coastguard Worker 	uint8_t *p;
122*1c60b9acSAndroid Build Coastguard Worker 	int n;
123*1c60b9acSAndroid Build Coastguard Worker 
124*1c60b9acSAndroid Build Coastguard Worker 	if (omd->value_on_lws_heap) {
125*1c60b9acSAndroid Build Coastguard Worker 		lws_free_set_NULL(omd->value__may_own_heap);
126*1c60b9acSAndroid Build Coastguard Worker 		omd->value_on_lws_heap = 0;
127*1c60b9acSAndroid Build Coastguard Worker 	}
128*1c60b9acSAndroid Build Coastguard Worker 
129*1c60b9acSAndroid Build Coastguard Worker 	p = lws_malloc(len, __func__);
130*1c60b9acSAndroid Build Coastguard Worker 	if (!p)
131*1c60b9acSAndroid Build Coastguard Worker 		return 1;
132*1c60b9acSAndroid Build Coastguard Worker 
133*1c60b9acSAndroid Build Coastguard Worker 	n = _lws_ss_set_metadata(omd, name, p, len);
134*1c60b9acSAndroid Build Coastguard Worker 	if (n) {
135*1c60b9acSAndroid Build Coastguard Worker 		lws_free(p);
136*1c60b9acSAndroid Build Coastguard Worker 		return n;
137*1c60b9acSAndroid Build Coastguard Worker 	}
138*1c60b9acSAndroid Build Coastguard Worker 
139*1c60b9acSAndroid Build Coastguard Worker 	memcpy(p, value, len);
140*1c60b9acSAndroid Build Coastguard Worker 
141*1c60b9acSAndroid Build Coastguard Worker 	omd->value_on_lws_heap = 1;
142*1c60b9acSAndroid Build Coastguard Worker 
143*1c60b9acSAndroid Build Coastguard Worker 	return 0;
144*1c60b9acSAndroid Build Coastguard Worker }
145*1c60b9acSAndroid Build Coastguard Worker 
146*1c60b9acSAndroid Build Coastguard Worker int
lws_ss_alloc_set_metadata(struct lws_ss_handle * h,const char * name,const void * value,size_t len)147*1c60b9acSAndroid Build Coastguard Worker lws_ss_alloc_set_metadata(struct lws_ss_handle *h, const char *name,
148*1c60b9acSAndroid Build Coastguard Worker 			  const void *value, size_t len)
149*1c60b9acSAndroid Build Coastguard Worker {
150*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_metadata_t *omd = lws_ss_get_handle_metadata(h, name);
151*1c60b9acSAndroid Build Coastguard Worker 
152*1c60b9acSAndroid Build Coastguard Worker 	lws_service_assert_loop_thread(h->context, h->tsi);
153*1c60b9acSAndroid Build Coastguard Worker 
154*1c60b9acSAndroid Build Coastguard Worker 	if (!omd) {
155*1c60b9acSAndroid Build Coastguard Worker 		lwsl_info("%s: unknown metadata %s\n", __func__, name);
156*1c60b9acSAndroid Build Coastguard Worker 		return 1;
157*1c60b9acSAndroid Build Coastguard Worker 	}
158*1c60b9acSAndroid Build Coastguard Worker 
159*1c60b9acSAndroid Build Coastguard Worker 	return _lws_ss_alloc_set_metadata(omd, name, value, len);
160*1c60b9acSAndroid Build Coastguard Worker }
161*1c60b9acSAndroid Build Coastguard Worker 
162*1c60b9acSAndroid Build Coastguard Worker int
lws_ss_get_metadata(struct lws_ss_handle * h,const char * name,const void ** value,size_t * len)163*1c60b9acSAndroid Build Coastguard Worker lws_ss_get_metadata(struct lws_ss_handle *h, const char *name,
164*1c60b9acSAndroid Build Coastguard Worker 		    const void **value, size_t *len)
165*1c60b9acSAndroid Build Coastguard Worker {
166*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_metadata_t *omd = lws_ss_get_handle_metadata(h, name);
167*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SS_DIRECT_PROTOCOL_STR)
168*1c60b9acSAndroid Build Coastguard Worker 	int n;
169*1c60b9acSAndroid Build Coastguard Worker #endif
170*1c60b9acSAndroid Build Coastguard Worker 
171*1c60b9acSAndroid Build Coastguard Worker 	lws_service_assert_loop_thread(h->context, h->tsi);
172*1c60b9acSAndroid Build Coastguard Worker 
173*1c60b9acSAndroid Build Coastguard Worker 	if (omd) {
174*1c60b9acSAndroid Build Coastguard Worker 		*value = omd->value__may_own_heap;
175*1c60b9acSAndroid Build Coastguard Worker 		*len = omd->length;
176*1c60b9acSAndroid Build Coastguard Worker 
177*1c60b9acSAndroid Build Coastguard Worker 		return 0;
178*1c60b9acSAndroid Build Coastguard Worker 	}
179*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SS_DIRECT_PROTOCOL_STR)
180*1c60b9acSAndroid Build Coastguard Worker 	if (!(h->policy->flags & LWSSSPOLF_DIRECT_PROTO_STR))
181*1c60b9acSAndroid Build Coastguard Worker 		goto bail;
182*1c60b9acSAndroid Build Coastguard Worker 
183*1c60b9acSAndroid Build Coastguard Worker 	n = lws_http_string_to_known_header(name, strlen(name));
184*1c60b9acSAndroid Build Coastguard Worker 	if (n != LWS_HTTP_NO_KNOWN_HEADER) {
185*1c60b9acSAndroid Build Coastguard Worker 		*len = (size_t)lws_hdr_total_length(h->wsi, n);
186*1c60b9acSAndroid Build Coastguard Worker 		if (!*len)
187*1c60b9acSAndroid Build Coastguard Worker 			goto bail;
188*1c60b9acSAndroid Build Coastguard Worker 		*value = lws_hdr_simple_ptr(h->wsi, n);
189*1c60b9acSAndroid Build Coastguard Worker 		if (!*value)
190*1c60b9acSAndroid Build Coastguard Worker 			goto bail;
191*1c60b9acSAndroid Build Coastguard Worker 
192*1c60b9acSAndroid Build Coastguard Worker 		return 0;
193*1c60b9acSAndroid Build Coastguard Worker 	}
194*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_CUSTOM_HEADERS)
195*1c60b9acSAndroid Build Coastguard Worker 	n = lws_hdr_custom_length(h->wsi, (const char *)name,
196*1c60b9acSAndroid Build Coastguard Worker 				  (int)strlen(name));
197*1c60b9acSAndroid Build Coastguard Worker 	if (n <= 0)
198*1c60b9acSAndroid Build Coastguard Worker 		goto bail;
199*1c60b9acSAndroid Build Coastguard Worker 	*value = lwsac_use(&h->imd_ac, (size_t)(n+1), (size_t)(n+1));
200*1c60b9acSAndroid Build Coastguard Worker 	if (!*value) {
201*1c60b9acSAndroid Build Coastguard Worker 		lwsl_err("%s ac OOM\n", __func__);
202*1c60b9acSAndroid Build Coastguard Worker 		return 1;
203*1c60b9acSAndroid Build Coastguard Worker 	}
204*1c60b9acSAndroid Build Coastguard Worker 	if (lws_hdr_custom_copy(h->wsi, (char *)(*value), n+1, name,
205*1c60b9acSAndroid Build Coastguard Worker 				(int)strlen(name))) {
206*1c60b9acSAndroid Build Coastguard Worker 		/* waste n+1 bytes until ss is destryed */
207*1c60b9acSAndroid Build Coastguard Worker 		goto bail;
208*1c60b9acSAndroid Build Coastguard Worker 	}
209*1c60b9acSAndroid Build Coastguard Worker 	*len = (size_t)n;
210*1c60b9acSAndroid Build Coastguard Worker 
211*1c60b9acSAndroid Build Coastguard Worker 	return 0;
212*1c60b9acSAndroid Build Coastguard Worker #endif
213*1c60b9acSAndroid Build Coastguard Worker 
214*1c60b9acSAndroid Build Coastguard Worker bail:
215*1c60b9acSAndroid Build Coastguard Worker #endif
216*1c60b9acSAndroid Build Coastguard Worker 	lwsl_info("%s: unknown metadata %s\n", __func__, name);
217*1c60b9acSAndroid Build Coastguard Worker 
218*1c60b9acSAndroid Build Coastguard Worker 	return 1;
219*1c60b9acSAndroid Build Coastguard Worker }
220*1c60b9acSAndroid Build Coastguard Worker 
221*1c60b9acSAndroid Build Coastguard Worker lws_ss_metadata_t *
lws_ss_get_handle_metadata(struct lws_ss_handle * h,const char * name)222*1c60b9acSAndroid Build Coastguard Worker lws_ss_get_handle_metadata(struct lws_ss_handle *h, const char *name)
223*1c60b9acSAndroid Build Coastguard Worker {
224*1c60b9acSAndroid Build Coastguard Worker 	int n;
225*1c60b9acSAndroid Build Coastguard Worker 
226*1c60b9acSAndroid Build Coastguard Worker 	lws_service_assert_loop_thread(h->context, h->tsi);
227*1c60b9acSAndroid Build Coastguard Worker 
228*1c60b9acSAndroid Build Coastguard Worker 	for (n = 0; n < h->policy->metadata_count; n++)
229*1c60b9acSAndroid Build Coastguard Worker 		if (!strcmp(name, h->metadata[n].name))
230*1c60b9acSAndroid Build Coastguard Worker 			return &h->metadata[n];
231*1c60b9acSAndroid Build Coastguard Worker 
232*1c60b9acSAndroid Build Coastguard Worker 	return NULL;
233*1c60b9acSAndroid Build Coastguard Worker }
234*1c60b9acSAndroid Build Coastguard Worker 
235*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SS_DIRECT_PROTOCOL_STR)
236*1c60b9acSAndroid Build Coastguard Worker lws_ss_metadata_t *
lws_ss_get_handle_instant_metadata(struct lws_ss_handle * h,const char * name)237*1c60b9acSAndroid Build Coastguard Worker lws_ss_get_handle_instant_metadata(struct lws_ss_handle *h, const char *name)
238*1c60b9acSAndroid Build Coastguard Worker {
239*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_metadata_t *imd = h->instant_metadata;
240*1c60b9acSAndroid Build Coastguard Worker 
241*1c60b9acSAndroid Build Coastguard Worker 	while (imd) {
242*1c60b9acSAndroid Build Coastguard Worker 		if (!strcmp(name, imd->name))
243*1c60b9acSAndroid Build Coastguard Worker 			return imd;
244*1c60b9acSAndroid Build Coastguard Worker 		imd = imd->next;
245*1c60b9acSAndroid Build Coastguard Worker 	}
246*1c60b9acSAndroid Build Coastguard Worker 
247*1c60b9acSAndroid Build Coastguard Worker 	return NULL;
248*1c60b9acSAndroid Build Coastguard Worker }
249*1c60b9acSAndroid Build Coastguard Worker 
250*1c60b9acSAndroid Build Coastguard Worker #endif
251*1c60b9acSAndroid Build Coastguard Worker 
252*1c60b9acSAndroid Build Coastguard Worker 
253*1c60b9acSAndroid Build Coastguard Worker lws_ss_metadata_t *
lws_ss_policy_metadata(const lws_ss_policy_t * p,const char * name)254*1c60b9acSAndroid Build Coastguard Worker lws_ss_policy_metadata(const lws_ss_policy_t *p, const char *name)
255*1c60b9acSAndroid Build Coastguard Worker {
256*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_metadata_t *pmd = p->metadata;
257*1c60b9acSAndroid Build Coastguard Worker 
258*1c60b9acSAndroid Build Coastguard Worker 	while (pmd) {
259*1c60b9acSAndroid Build Coastguard Worker 		if (pmd->name && !strcmp(name, pmd->name))
260*1c60b9acSAndroid Build Coastguard Worker 			return pmd;
261*1c60b9acSAndroid Build Coastguard Worker 		pmd = pmd->next;
262*1c60b9acSAndroid Build Coastguard Worker 	}
263*1c60b9acSAndroid Build Coastguard Worker 
264*1c60b9acSAndroid Build Coastguard Worker 	return NULL;
265*1c60b9acSAndroid Build Coastguard Worker }
266*1c60b9acSAndroid Build Coastguard Worker 
267*1c60b9acSAndroid Build Coastguard Worker lws_ss_metadata_t *
lws_ss_policy_metadata_index(const lws_ss_policy_t * p,size_t index)268*1c60b9acSAndroid Build Coastguard Worker lws_ss_policy_metadata_index(const lws_ss_policy_t *p, size_t index)
269*1c60b9acSAndroid Build Coastguard Worker {
270*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_metadata_t *pmd = p->metadata;
271*1c60b9acSAndroid Build Coastguard Worker 
272*1c60b9acSAndroid Build Coastguard Worker 	while (pmd) {
273*1c60b9acSAndroid Build Coastguard Worker 		if (pmd->length == index)
274*1c60b9acSAndroid Build Coastguard Worker 			return pmd;
275*1c60b9acSAndroid Build Coastguard Worker 		pmd = pmd->next;
276*1c60b9acSAndroid Build Coastguard Worker 	}
277*1c60b9acSAndroid Build Coastguard Worker 
278*1c60b9acSAndroid Build Coastguard Worker 	return NULL;
279*1c60b9acSAndroid Build Coastguard Worker }
280*1c60b9acSAndroid Build Coastguard Worker 
281*1c60b9acSAndroid Build Coastguard Worker #if !defined(LWS_WITH_SECURE_STREAMS_STATIC_POLICY_ONLY)
282*1c60b9acSAndroid Build Coastguard Worker static int
fe_lws_ss_destroy(struct lws_dll2 * d,void * user)283*1c60b9acSAndroid Build Coastguard Worker fe_lws_ss_destroy(struct lws_dll2 *d, void *user)
284*1c60b9acSAndroid Build Coastguard Worker {
285*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_handle_t *h = lws_container_of(d, lws_ss_handle_t, list);
286*1c60b9acSAndroid Build Coastguard Worker 
287*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_destroy(&h);
288*1c60b9acSAndroid Build Coastguard Worker 
289*1c60b9acSAndroid Build Coastguard Worker 	return 0;
290*1c60b9acSAndroid Build Coastguard Worker }
291*1c60b9acSAndroid Build Coastguard Worker #endif
292*1c60b9acSAndroid Build Coastguard Worker 
293*1c60b9acSAndroid Build Coastguard Worker /*
294*1c60b9acSAndroid Build Coastguard Worker  * Dynamic policy: we want to one-time create the vhost for the policy and the
295*1c60b9acSAndroid Build Coastguard Worker  * trust store behind it.
296*1c60b9acSAndroid Build Coastguard Worker  *
297*1c60b9acSAndroid Build Coastguard Worker  * Static policy: We want to make use of a trust store / vhost from the policy and add to its
298*1c60b9acSAndroid Build Coastguard Worker  * ss-refcount.
299*1c60b9acSAndroid Build Coastguard Worker  */
300*1c60b9acSAndroid Build Coastguard Worker 
301*1c60b9acSAndroid Build Coastguard Worker struct lws_vhost *
lws_ss_policy_ref_trust_store(struct lws_context * context,const lws_ss_policy_t * pol,char doref)302*1c60b9acSAndroid Build Coastguard Worker lws_ss_policy_ref_trust_store(struct lws_context *context,
303*1c60b9acSAndroid Build Coastguard Worker 			      const lws_ss_policy_t *pol, char doref)
304*1c60b9acSAndroid Build Coastguard Worker {
305*1c60b9acSAndroid Build Coastguard Worker 	struct lws_context_creation_info i;
306*1c60b9acSAndroid Build Coastguard Worker 	struct lws_vhost *v;
307*1c60b9acSAndroid Build Coastguard Worker 	int n;
308*1c60b9acSAndroid Build Coastguard Worker 
309*1c60b9acSAndroid Build Coastguard Worker 	memset(&i, 0, sizeof(i));
310*1c60b9acSAndroid Build Coastguard Worker 
311*1c60b9acSAndroid Build Coastguard Worker 	if (!pol->trust.store) {
312*1c60b9acSAndroid Build Coastguard Worker 		v = lws_get_vhost_by_name(context, "_ss_default");
313*1c60b9acSAndroid Build Coastguard Worker 		if (!v) {
314*1c60b9acSAndroid Build Coastguard Worker 			/* corner case... there's no trust store used */
315*1c60b9acSAndroid Build Coastguard Worker 			i.options = context->options;
316*1c60b9acSAndroid Build Coastguard Worker 			i.vhost_name = "_ss_default";
317*1c60b9acSAndroid Build Coastguard Worker 			i.port = CONTEXT_PORT_NO_LISTEN;
318*1c60b9acSAndroid Build Coastguard Worker 			v = lws_create_vhost(context, &i);
319*1c60b9acSAndroid Build Coastguard Worker 			if (!v) {
320*1c60b9acSAndroid Build Coastguard Worker 				lwsl_err("%s: failed to create vhost %s\n",
321*1c60b9acSAndroid Build Coastguard Worker 					 __func__, i.vhost_name);
322*1c60b9acSAndroid Build Coastguard Worker 
323*1c60b9acSAndroid Build Coastguard Worker 				return NULL;
324*1c60b9acSAndroid Build Coastguard Worker 			}
325*1c60b9acSAndroid Build Coastguard Worker 		}
326*1c60b9acSAndroid Build Coastguard Worker 
327*1c60b9acSAndroid Build Coastguard Worker 		goto accepted;
328*1c60b9acSAndroid Build Coastguard Worker 	}
329*1c60b9acSAndroid Build Coastguard Worker 	v = lws_get_vhost_by_name(context, pol->trust.store->name);
330*1c60b9acSAndroid Build Coastguard Worker 	if (v) {
331*1c60b9acSAndroid Build Coastguard Worker 		lwsl_debug("%s: vh already exists\n", __func__);
332*1c60b9acSAndroid Build Coastguard Worker 		goto accepted;
333*1c60b9acSAndroid Build Coastguard Worker 	}
334*1c60b9acSAndroid Build Coastguard Worker 
335*1c60b9acSAndroid Build Coastguard Worker 	i.options = context->options;
336*1c60b9acSAndroid Build Coastguard Worker 	i.vhost_name = pol->trust.store->name;
337*1c60b9acSAndroid Build Coastguard Worker 	lwsl_debug("%s: %s\n", __func__, i.vhost_name);
338*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_TLS) && defined(LWS_WITH_CLIENT)
339*1c60b9acSAndroid Build Coastguard Worker 	i.client_ssl_ca_mem = pol->trust.store->ssx509[0]->ca_der;
340*1c60b9acSAndroid Build Coastguard Worker 	i.client_ssl_ca_mem_len = (unsigned int)
341*1c60b9acSAndroid Build Coastguard Worker 			pol->trust.store->ssx509[0]->ca_der_len;
342*1c60b9acSAndroid Build Coastguard Worker #endif
343*1c60b9acSAndroid Build Coastguard Worker 	i.port = CONTEXT_PORT_NO_LISTEN;
344*1c60b9acSAndroid Build Coastguard Worker 	lwsl_info("%s: %s trust store initial '%s'\n", __func__,
345*1c60b9acSAndroid Build Coastguard Worker 		  i.vhost_name, pol->trust.store->ssx509[0]->vhost_name);
346*1c60b9acSAndroid Build Coastguard Worker 
347*1c60b9acSAndroid Build Coastguard Worker 	v = lws_create_vhost(context, &i);
348*1c60b9acSAndroid Build Coastguard Worker 	if (!v) {
349*1c60b9acSAndroid Build Coastguard Worker 		lwsl_err("%s: failed to create vhost %s\n",
350*1c60b9acSAndroid Build Coastguard Worker 			 __func__, i.vhost_name);
351*1c60b9acSAndroid Build Coastguard Worker 		return NULL;
352*1c60b9acSAndroid Build Coastguard Worker 	} else
353*1c60b9acSAndroid Build Coastguard Worker 		v->from_ss_policy = 1;
354*1c60b9acSAndroid Build Coastguard Worker 
355*1c60b9acSAndroid Build Coastguard Worker 	for (n = 1; v && n < pol->trust.store->count; n++) {
356*1c60b9acSAndroid Build Coastguard Worker 		lwsl_info("%s: add '%s' to trust store\n", __func__,
357*1c60b9acSAndroid Build Coastguard Worker 			  pol->trust.store->ssx509[n]->vhost_name);
358*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_TLS)
359*1c60b9acSAndroid Build Coastguard Worker 		if (lws_tls_client_vhost_extra_cert_mem(v,
360*1c60b9acSAndroid Build Coastguard Worker 				pol->trust.store->ssx509[n]->ca_der,
361*1c60b9acSAndroid Build Coastguard Worker 				pol->trust.store->ssx509[n]->ca_der_len)) {
362*1c60b9acSAndroid Build Coastguard Worker 			lwsl_err("%s: add extra cert failed\n",
363*1c60b9acSAndroid Build Coastguard Worker 					__func__);
364*1c60b9acSAndroid Build Coastguard Worker 			return NULL;
365*1c60b9acSAndroid Build Coastguard Worker 		}
366*1c60b9acSAndroid Build Coastguard Worker #endif
367*1c60b9acSAndroid Build Coastguard Worker 	}
368*1c60b9acSAndroid Build Coastguard Worker 
369*1c60b9acSAndroid Build Coastguard Worker accepted:
370*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SECURE_STREAMS_STATIC_POLICY_ONLY) || defined(LWS_WITH_SECURE_STREAMS_CPP)
371*1c60b9acSAndroid Build Coastguard Worker 	if (doref)
372*1c60b9acSAndroid Build Coastguard Worker 		v->ss_refcount++;
373*1c60b9acSAndroid Build Coastguard Worker #endif
374*1c60b9acSAndroid Build Coastguard Worker 
375*1c60b9acSAndroid Build Coastguard Worker 	return v;
376*1c60b9acSAndroid Build Coastguard Worker }
377*1c60b9acSAndroid Build Coastguard Worker 
378*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SECURE_STREAMS_STATIC_POLICY_ONLY) || defined(LWS_WITH_SECURE_STREAMS_CPP)
379*1c60b9acSAndroid Build Coastguard Worker int
lws_ss_policy_unref_trust_store(struct lws_context * context,const lws_ss_policy_t * pol)380*1c60b9acSAndroid Build Coastguard Worker lws_ss_policy_unref_trust_store(struct lws_context *context,
381*1c60b9acSAndroid Build Coastguard Worker 				const lws_ss_policy_t *pol)
382*1c60b9acSAndroid Build Coastguard Worker {
383*1c60b9acSAndroid Build Coastguard Worker 	struct lws_vhost *v;
384*1c60b9acSAndroid Build Coastguard Worker 	const char *name = "_ss_default";
385*1c60b9acSAndroid Build Coastguard Worker 
386*1c60b9acSAndroid Build Coastguard Worker 	if (pol->trust.store)
387*1c60b9acSAndroid Build Coastguard Worker 		name = pol->trust.store->name;
388*1c60b9acSAndroid Build Coastguard Worker 
389*1c60b9acSAndroid Build Coastguard Worker 	v = lws_get_vhost_by_name(context, name);
390*1c60b9acSAndroid Build Coastguard Worker 	if (!v || !v->from_ss_policy)
391*1c60b9acSAndroid Build Coastguard Worker 		return 0;
392*1c60b9acSAndroid Build Coastguard Worker 
393*1c60b9acSAndroid Build Coastguard Worker 	assert(v->ss_refcount);
394*1c60b9acSAndroid Build Coastguard Worker 
395*1c60b9acSAndroid Build Coastguard Worker 	v->ss_refcount--;
396*1c60b9acSAndroid Build Coastguard Worker 	if (!v->ss_refcount) {
397*1c60b9acSAndroid Build Coastguard Worker 		lwsl_notice("%s: destroying vh %s\n", __func__, name);
398*1c60b9acSAndroid Build Coastguard Worker 		lws_vhost_destroy(v);
399*1c60b9acSAndroid Build Coastguard Worker 	}
400*1c60b9acSAndroid Build Coastguard Worker 
401*1c60b9acSAndroid Build Coastguard Worker 	return 1;
402*1c60b9acSAndroid Build Coastguard Worker }
403*1c60b9acSAndroid Build Coastguard Worker #endif
404*1c60b9acSAndroid Build Coastguard Worker 
405*1c60b9acSAndroid Build Coastguard Worker int
lws_ss_policy_set(struct lws_context * context,const char * name)406*1c60b9acSAndroid Build Coastguard Worker lws_ss_policy_set(struct lws_context *context, const char *name)
407*1c60b9acSAndroid Build Coastguard Worker {
408*1c60b9acSAndroid Build Coastguard Worker 	int ret = 0;
409*1c60b9acSAndroid Build Coastguard Worker 
410*1c60b9acSAndroid Build Coastguard Worker #if !defined(LWS_WITH_SECURE_STREAMS_STATIC_POLICY_ONLY)
411*1c60b9acSAndroid Build Coastguard Worker 	struct policy_cb_args *args = (struct policy_cb_args *)context->pol_args;
412*1c60b9acSAndroid Build Coastguard Worker 	const lws_ss_policy_t *pol;
413*1c60b9acSAndroid Build Coastguard Worker 	struct lws_vhost *v;
414*1c60b9acSAndroid Build Coastguard Worker 	lws_ss_x509_t *x;
415*1c60b9acSAndroid Build Coastguard Worker 	char buf[16];
416*1c60b9acSAndroid Build Coastguard Worker 	int m;
417*1c60b9acSAndroid Build Coastguard Worker 
418*1c60b9acSAndroid Build Coastguard Worker 	/*
419*1c60b9acSAndroid Build Coastguard Worker 	 * Parsing seems to have succeeded, and we're going to use the new
420*1c60b9acSAndroid Build Coastguard Worker 	 * policy that's laid out in args->ac
421*1c60b9acSAndroid Build Coastguard Worker 	 */
422*1c60b9acSAndroid Build Coastguard Worker 
423*1c60b9acSAndroid Build Coastguard Worker 	if (!args)
424*1c60b9acSAndroid Build Coastguard Worker 		return 1;
425*1c60b9acSAndroid Build Coastguard Worker 
426*1c60b9acSAndroid Build Coastguard Worker 	lejp_destruct(&args->jctx);
427*1c60b9acSAndroid Build Coastguard Worker 
428*1c60b9acSAndroid Build Coastguard Worker 	if (context->ac_policy) {
429*1c60b9acSAndroid Build Coastguard Worker 		int n;
430*1c60b9acSAndroid Build Coastguard Worker 
431*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SYS_METRICS)
432*1c60b9acSAndroid Build Coastguard Worker 		lws_start_foreach_dll_safe(struct lws_dll2 *, d, d1,
433*1c60b9acSAndroid Build Coastguard Worker 					   context->owner_mtr_dynpol.head) {
434*1c60b9acSAndroid Build Coastguard Worker 			lws_metric_policy_dyn_t *dm =
435*1c60b9acSAndroid Build Coastguard Worker 				lws_container_of(d, lws_metric_policy_dyn_t, list);
436*1c60b9acSAndroid Build Coastguard Worker 
437*1c60b9acSAndroid Build Coastguard Worker 			lws_metric_policy_dyn_destroy(dm, 1); /* keep */
438*1c60b9acSAndroid Build Coastguard Worker 
439*1c60b9acSAndroid Build Coastguard Worker 		} lws_end_foreach_dll_safe(d, d1);
440*1c60b9acSAndroid Build Coastguard Worker #endif
441*1c60b9acSAndroid Build Coastguard Worker 
442*1c60b9acSAndroid Build Coastguard Worker 		/*
443*1c60b9acSAndroid Build Coastguard Worker 		 * any existing ss created with the old policy have to go away
444*1c60b9acSAndroid Build Coastguard Worker 		 * now, since they point to the shortly-to-be-destroyed old
445*1c60b9acSAndroid Build Coastguard Worker 		 * policy
446*1c60b9acSAndroid Build Coastguard Worker 		 */
447*1c60b9acSAndroid Build Coastguard Worker 
448*1c60b9acSAndroid Build Coastguard Worker 		for (n = 0; n < context->count_threads; n++) {
449*1c60b9acSAndroid Build Coastguard Worker 			struct lws_context_per_thread *pt = &context->pt[n];
450*1c60b9acSAndroid Build Coastguard Worker 
451*1c60b9acSAndroid Build Coastguard Worker 			lws_dll2_foreach_safe(&pt->ss_owner, NULL, fe_lws_ss_destroy);
452*1c60b9acSAndroid Build Coastguard Worker 		}
453*1c60b9acSAndroid Build Coastguard Worker 
454*1c60b9acSAndroid Build Coastguard Worker 		/*
455*1c60b9acSAndroid Build Coastguard Worker 		 * So this is a bit fun-filled, we already had a policy in
456*1c60b9acSAndroid Build Coastguard Worker 		 * force, perhaps it was the default policy that's just good for
457*1c60b9acSAndroid Build Coastguard Worker 		 * fetching the real policy, and we're doing that now.
458*1c60b9acSAndroid Build Coastguard Worker 		 *
459*1c60b9acSAndroid Build Coastguard Worker 		 * We can destroy all the policy-related direct allocations
460*1c60b9acSAndroid Build Coastguard Worker 		 * easily because they're cleanly in a single lwsac...
461*1c60b9acSAndroid Build Coastguard Worker 		 */
462*1c60b9acSAndroid Build Coastguard Worker 		lwsac_free(&context->ac_policy);
463*1c60b9acSAndroid Build Coastguard Worker 
464*1c60b9acSAndroid Build Coastguard Worker 		/*
465*1c60b9acSAndroid Build Coastguard Worker 		 * ...but when we did the trust stores, we created vhosts for
466*1c60b9acSAndroid Build Coastguard Worker 		 * each.  We need to destroy those now too, and recreate new
467*1c60b9acSAndroid Build Coastguard Worker 		 * ones from the new policy, perhaps with different X.509s.
468*1c60b9acSAndroid Build Coastguard Worker 		 *
469*1c60b9acSAndroid Build Coastguard Worker 		 * Vhost destruction is inherently async, it can't be destroyed
470*1c60b9acSAndroid Build Coastguard Worker 		 * until all of the wsi bound to it have closed, and, eg, libuv
471*1c60b9acSAndroid Build Coastguard Worker 		 * means their closure is deferred until a later go around the
472*1c60b9acSAndroid Build Coastguard Worker 		 * event loop.  SMP means we also have to wait for all the pts
473*1c60b9acSAndroid Build Coastguard Worker 		 * to close their wsis that are bound on the vhost too.
474*1c60b9acSAndroid Build Coastguard Worker 		 *
475*1c60b9acSAndroid Build Coastguard Worker 		 * This marks the vhost as being destroyed so new things won't
476*1c60b9acSAndroid Build Coastguard Worker 		 * use it, and starts the close of all wsi on this pt that are
477*1c60b9acSAndroid Build Coastguard Worker 		 * bound to the wsi, and deals with the listen socket if any.
478*1c60b9acSAndroid Build Coastguard Worker 		 * "being-destroyed" vhosts can't be found using get_vhost_by_
479*1c60b9acSAndroid Build Coastguard Worker 		 * name(), so if a new vhost of the same name exists that isn't
480*1c60b9acSAndroid Build Coastguard Worker 		 * being destroyed that will be the one found.
481*1c60b9acSAndroid Build Coastguard Worker 		 *
482*1c60b9acSAndroid Build Coastguard Worker 		 * When the number of wsi bound to the vhost gets to zero a
483*1c60b9acSAndroid Build Coastguard Worker 		 * short time later, the vhost is actually destroyed.
484*1c60b9acSAndroid Build Coastguard Worker 		 */
485*1c60b9acSAndroid Build Coastguard Worker 
486*1c60b9acSAndroid Build Coastguard Worker 		v = context->vhost_list;
487*1c60b9acSAndroid Build Coastguard Worker 		while (v) {
488*1c60b9acSAndroid Build Coastguard Worker 			if (v->from_ss_policy) {
489*1c60b9acSAndroid Build Coastguard Worker 				struct lws_vhost *vh = v->vhost_next;
490*1c60b9acSAndroid Build Coastguard Worker 				lwsl_debug("%s: destroying %s\n", __func__, lws_vh_tag(v));
491*1c60b9acSAndroid Build Coastguard Worker 				lws_vhost_destroy(v);
492*1c60b9acSAndroid Build Coastguard Worker 				v = vh;
493*1c60b9acSAndroid Build Coastguard Worker 				continue;
494*1c60b9acSAndroid Build Coastguard Worker 			}
495*1c60b9acSAndroid Build Coastguard Worker 			v = v->vhost_next;
496*1c60b9acSAndroid Build Coastguard Worker 		}
497*1c60b9acSAndroid Build Coastguard Worker 	}
498*1c60b9acSAndroid Build Coastguard Worker 
499*1c60b9acSAndroid Build Coastguard Worker 	context->pss_policies = args->heads[LTY_POLICY].p;
500*1c60b9acSAndroid Build Coastguard Worker 	context->ac_policy = args->ac;
501*1c60b9acSAndroid Build Coastguard Worker 
502*1c60b9acSAndroid Build Coastguard Worker 	lws_humanize(buf, sizeof(buf), lwsac_total_alloc(args->ac),
503*1c60b9acSAndroid Build Coastguard Worker 			humanize_schema_si_bytes);
504*1c60b9acSAndroid Build Coastguard Worker 	if (lwsac_total_alloc(args->ac))
505*1c60b9acSAndroid Build Coastguard Worker 		m = (int)((lwsac_total_overhead(args->ac) * 100) /
506*1c60b9acSAndroid Build Coastguard Worker 				lwsac_total_alloc(args->ac));
507*1c60b9acSAndroid Build Coastguard Worker 	else
508*1c60b9acSAndroid Build Coastguard Worker 		m = 0;
509*1c60b9acSAndroid Build Coastguard Worker 
510*1c60b9acSAndroid Build Coastguard Worker 	(void)m;
511*1c60b9acSAndroid Build Coastguard Worker 	lwsl_info("%s: %s, pad %d%c: %s\n", __func__, buf, m, '%', name);
512*1c60b9acSAndroid Build Coastguard Worker 
513*1c60b9acSAndroid Build Coastguard Worker 	/* Create vhosts for each type of trust store */
514*1c60b9acSAndroid Build Coastguard Worker 
515*1c60b9acSAndroid Build Coastguard Worker 	/*
516*1c60b9acSAndroid Build Coastguard Worker 	 * We get called from context creation... instantiates
517*1c60b9acSAndroid Build Coastguard Worker 	 * vhosts with client tls contexts set up for each unique CA.
518*1c60b9acSAndroid Build Coastguard Worker 	 *
519*1c60b9acSAndroid Build Coastguard Worker 	 * We create the vhosts by walking streamtype list and create vhosts
520*1c60b9acSAndroid Build Coastguard Worker 	 * using trust store name if it's a client connection that doesn't
521*1c60b9acSAndroid Build Coastguard Worker 	 * already exist.
522*1c60b9acSAndroid Build Coastguard Worker 	 */
523*1c60b9acSAndroid Build Coastguard Worker 
524*1c60b9acSAndroid Build Coastguard Worker 	pol = context->pss_policies;
525*1c60b9acSAndroid Build Coastguard Worker 	while (pol) {
526*1c60b9acSAndroid Build Coastguard Worker 		if (!(pol->flags & LWSSSPOLF_SERVER)) {
527*1c60b9acSAndroid Build Coastguard Worker 			v = lws_ss_policy_ref_trust_store(context, pol,
528*1c60b9acSAndroid Build Coastguard Worker 						  0 /* no refcount inc */);
529*1c60b9acSAndroid Build Coastguard Worker 			if (!v)
530*1c60b9acSAndroid Build Coastguard Worker 				ret = 1;
531*1c60b9acSAndroid Build Coastguard Worker 		}
532*1c60b9acSAndroid Build Coastguard Worker 
533*1c60b9acSAndroid Build Coastguard Worker 		pol = pol->next;
534*1c60b9acSAndroid Build Coastguard Worker 	}
535*1c60b9acSAndroid Build Coastguard Worker 
536*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SOCKS5)
537*1c60b9acSAndroid Build Coastguard Worker 
538*1c60b9acSAndroid Build Coastguard Worker 	/*
539*1c60b9acSAndroid Build Coastguard Worker 	 * ... we need to go through every vhost updating its understanding of
540*1c60b9acSAndroid Build Coastguard Worker 	 * which socks5 proxy to use...
541*1c60b9acSAndroid Build Coastguard Worker 	 */
542*1c60b9acSAndroid Build Coastguard Worker 
543*1c60b9acSAndroid Build Coastguard Worker 	v = context->vhost_list;
544*1c60b9acSAndroid Build Coastguard Worker 	while (v) {
545*1c60b9acSAndroid Build Coastguard Worker 		lws_set_socks(v, args->socks5_proxy);
546*1c60b9acSAndroid Build Coastguard Worker 		v = v->vhost_next;
547*1c60b9acSAndroid Build Coastguard Worker 	}
548*1c60b9acSAndroid Build Coastguard Worker 	if (context->vhost_system)
549*1c60b9acSAndroid Build Coastguard Worker 		lws_set_socks(context->vhost_system, args->socks5_proxy);
550*1c60b9acSAndroid Build Coastguard Worker 
551*1c60b9acSAndroid Build Coastguard Worker 	if (args->socks5_proxy)
552*1c60b9acSAndroid Build Coastguard Worker 		lwsl_notice("%s: global socks5 proxy: %s\n", __func__,
553*1c60b9acSAndroid Build Coastguard Worker 			    args->socks5_proxy);
554*1c60b9acSAndroid Build Coastguard Worker #endif
555*1c60b9acSAndroid Build Coastguard Worker 
556*1c60b9acSAndroid Build Coastguard Worker 	/*
557*1c60b9acSAndroid Build Coastguard Worker 	 * For dynamic policy case, now we processed the x.509 CAs, we can free
558*1c60b9acSAndroid Build Coastguard Worker 	 * all of our originals.  For static policy, they're in .rodata, nothing
559*1c60b9acSAndroid Build Coastguard Worker 	 * to free.
560*1c60b9acSAndroid Build Coastguard Worker 	 */
561*1c60b9acSAndroid Build Coastguard Worker 
562*1c60b9acSAndroid Build Coastguard Worker 	x = args->heads[LTY_X509].x;
563*1c60b9acSAndroid Build Coastguard Worker 	while (x) {
564*1c60b9acSAndroid Build Coastguard Worker 		/*
565*1c60b9acSAndroid Build Coastguard Worker 		 * Free all the client DER buffers now they have been parsed
566*1c60b9acSAndroid Build Coastguard Worker 		 * into tls library X.509 objects
567*1c60b9acSAndroid Build Coastguard Worker 		 */
568*1c60b9acSAndroid Build Coastguard Worker 		if (!x->keep) { /* used for server */
569*1c60b9acSAndroid Build Coastguard Worker 			lws_free((void *)x->ca_der);
570*1c60b9acSAndroid Build Coastguard Worker 			x->ca_der = NULL;
571*1c60b9acSAndroid Build Coastguard Worker 		}
572*1c60b9acSAndroid Build Coastguard Worker 
573*1c60b9acSAndroid Build Coastguard Worker 		x = x->next;
574*1c60b9acSAndroid Build Coastguard Worker 	}
575*1c60b9acSAndroid Build Coastguard Worker 
576*1c60b9acSAndroid Build Coastguard Worker 	context->last_policy = time(NULL);
577*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SYS_METRICS)
578*1c60b9acSAndroid Build Coastguard Worker 	if (context->pss_policies)
579*1c60b9acSAndroid Build Coastguard Worker 		((lws_ss_policy_t *)context->pss_policies)->metrics =
580*1c60b9acSAndroid Build Coastguard Worker 						args->heads[LTY_METRICS].m;
581*1c60b9acSAndroid Build Coastguard Worker #endif
582*1c60b9acSAndroid Build Coastguard Worker 
583*1c60b9acSAndroid Build Coastguard Worker 	/* and we can discard the parsing args object now, invalidating args */
584*1c60b9acSAndroid Build Coastguard Worker 
585*1c60b9acSAndroid Build Coastguard Worker 	lws_free_set_NULL(context->pol_args);
586*1c60b9acSAndroid Build Coastguard Worker #endif
587*1c60b9acSAndroid Build Coastguard Worker 
588*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SYS_METRICS)
589*1c60b9acSAndroid Build Coastguard Worker 	lws_metric_rebind_policies(context);
590*1c60b9acSAndroid Build Coastguard Worker #endif
591*1c60b9acSAndroid Build Coastguard Worker 
592*1c60b9acSAndroid Build Coastguard Worker #if defined(LWS_WITH_SYS_SMD)
593*1c60b9acSAndroid Build Coastguard Worker 	(void)lws_smd_msg_printf(context, LWSSMDCL_SYSTEM_STATE,
594*1c60b9acSAndroid Build Coastguard Worker 				 "{\"policy\":\"updated\",\"ts\":%lu}",
595*1c60b9acSAndroid Build Coastguard Worker 				   (long)context->last_policy);
596*1c60b9acSAndroid Build Coastguard Worker #endif
597*1c60b9acSAndroid Build Coastguard Worker 
598*1c60b9acSAndroid Build Coastguard Worker 	return ret;
599*1c60b9acSAndroid Build Coastguard Worker }
600