#include "nilorea/n_list.h"
#include "nilorea/n_str.h"
#include "nilorea/n_log.h"
#include "nilorea/n_network.h"
#include "nilorea/n_thread_pool.h"
#include "nilorea/n_signals.h"

Include dependency graph for ex_network_ssl_hardened.c:

Data Structures
struct	NETWORK_SSL_THREAD_PARAMS
	structure of a NETWORK_SSL_THREAD_PARAMS More...

Macros
#define	CONNECTION_TIMEOUT_SECONDS 10
#define	MAX_HTTP_REQUEST_SIZE_LIMIT 1048576
#define	SECURITY_HEADERS
	Network for managing connections.

Functions
void	action_on_sig (int recvd_signal)
int	build_secure_response (N_STR *response, int status_code, const char content_type, char extra_headers, N_STR body)
void	handle_request (NETWORK netw_ptr, LIST routes_ptr)
int	main (int argc, char *argv[])
void	process_args (int argc_nb, char argv_ptr, char addr_ptr, char port_ptr, char key_ptr, char cert_ptr, char ca_file_ptr, int ssl_verify_ptr, LIST routes_ptr, int ip_version_ptr, int max_http_request_size_ptr, char **root_dir_ptr)
int	set_socket_timeout (SOCKET sock, int timeout_seconds)
	Set socket read/write timeout to prevent slow-loris attacks.
int	ssl_harden_context (NETWORK *ssl_netw)
	Harden the SSL context with modern security settings.
void *	ssl_network_thread (void *params)
void	usage (void)
int	validate_path (const char requested_path, const char root, char *resolved, size_t resolved_size)
	Validate that a resolved path stays within the document root.

Variables
int	accept_timeout = 30
char *	addr = NULL
char *	ca_file = NULL
char *	cert = NULL
volatile sig_atomic_t	done = 0
int	ip_version = 0
char *	key = NULL
	TRUE while the key is held.
volatile sig_atomic_t	killed_by_signal = 0
int	max_connections = 0
int	max_http_request_size = 16384
NETWORK *	netw = NULL
	Network for server mode, accepting incomming.
char *	port = NULL
char *	root_dir = NULL
LIST *	routes = NULL
NETWORK *	server = NULL
int	ssl_verify = 0

Data Structure Documentation

◆ NETWORK_SSL_THREAD_PARAMS

struct NETWORK_SSL_THREAD_PARAMS

structure of a NETWORK_SSL_THREAD_PARAMS

Examples: ex_network_ssl.c, and ex_network_ssl_hardened.c.

Definition at line 431 of file ex_network_ssl.c.

Collaboration diagram for NETWORK_SSL_THREAD_PARAMS:

Data Fields
NETWORK *	netw	network to use for the receiving thread
LIST *	routes	virtual routes for the server

Macro Definition Documentation

◆ CONNECTION_TIMEOUT_SECONDS

#define CONNECTION_TIMEOUT_SECONDS 10

Examples: ex_network_ssl_hardened.c.

Definition at line 57 of file ex_network_ssl_hardened.c.

Referenced by handle_request().

◆ MAX_HTTP_REQUEST_SIZE_LIMIT

#define MAX_HTTP_REQUEST_SIZE_LIMIT 1048576

Examples: ex_network_ssl_hardened.c.

Definition at line 56 of file ex_network_ssl_hardened.c.

Referenced by process_args(), and usage().

◆ SECURITY_HEADERS

#define SECURITY_HEADERS

Value:

    "Strict-Transport-Security: max-age=31536000\r\n"      \
    "X-Content-Type-Options: nosniff\r\n"                  \
    "X-Frame-Options: DENY\r\n"                            \
    "Content-Security-Policy: default-src 'self'\r\n"      \
    "Referrer-Policy: strict-origin-when-cross-origin\r\n" \
    "Permissions-Policy: geolocation=(), camera=(), microphone=()\r\n"

Network for managing connections.

security headers appended to every response

Examples: ex_network_ssl_hardened.c.

Definition at line 72 of file ex_network_ssl_hardened.c.

Referenced by build_secure_response().

Function Documentation

◆ action_on_sig()

void action_on_sig ( int recvd_signal )

Definition at line 386 of file ex_network_ssl_hardened.c.

References done, killed_by_signal, LOG_ERR, LOG_NOTICE, and n_log.

◆ build_secure_response()

int build_secure_response	(	N_STR **	response,
		int	status_code,
		const char *	content_type,
		char *	extra_headers,
		N_STR *	body )

Examples: ex_network_ssl_hardened.c.

Definition at line 441 of file ex_network_ssl_hardened.c.

References netw_build_http_response(), and SECURITY_HEADERS.

Referenced by handle_request().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ handle_request()

void handle_request	(	NETWORK *	netw_ptr,
		LIST *	routes_ptr )

Definition at line 448 of file ex_network_ssl_hardened.c.

References __n_assert, _nstr, _str, NETWORK_HTTP_INFO::body, build_secure_response(), char_to_nstr(), CONNECTION_TIMEOUT_SECONDS, N_STR::data, destroy_ht(), file_to_nstr(), Free, free_nstr, free_split_result(), HT_FOREACH, N_SOCKET::ip, NETWORK::link, list_foreach, LOG_DEBUG, LOG_ERR, LOG_INFO, Malloc, max_http_request_size, n_log, netw_extract_http_info(), netw_get_url_from_http_request(), netw_guess_http_content_type(), netw_info_destroy(), netw_parse_post_data(), new_nstr(), nstrprintf, root_dir, send_ssl_data(), set_socket_timeout(), N_SOCKET::sock, SOCKET_SIZE_FORMAT, split(), NETWORK::ssl, NETWORK_HTTP_INFO::type, validate_path(), and N_STR::written.

Here is the call graph for this function:

◆ main()

int main	(	int	argc,
		char *	argv[] )

Definition at line 671 of file ex_network_ssl_hardened.c.

References __n_assert, _str, accept_timeout, action_on_sig(), add_threaded_process(), addr, ca_file, cert, destroy_threaded_pool(), DIRECT_PROC, done, FreeNoLog, get_msec(), get_nb_cpu_cores(), ip_version, key, killed_by_signal, list_destroy(), LOG_DEBUG, LOG_ERR, LOG_INFO, LOG_NOTICE, Malloc, max_connections, max_http_request_size, MAX_LIST_ITEMS, n_log, netw, NETWORK_SSL_THREAD_PARAMS::netw, netw_accept_from_ex(), netw_close(), netw_make_listening(), netw_set_crypto(), netw_set_crypto_chain(), netw_ssl_set_verify(), new_generic_list(), new_thread_pool(), port, process_args(), root_dir, NETWORK_SSL_THREAD_PARAMS::routes, routes, server, ssl_harden_context(), ssl_network_thread(), ssl_verify, start_HiTimer(), thread_pool, u_sleep(), and wait_for_threaded_pool().

Here is the call graph for this function:

◆ process_args()

void process_args	(	int	argc_nb,
		char **	argv_ptr,
		char **	addr_ptr,
		char **	port_ptr,
		char **	key_ptr,
		char **	cert_ptr,
		char **	ca_file_ptr,
		int *	ssl_verify_ptr,
		LIST *	routes_ptr,
		int *	ip_version_ptr,
		int *	max_http_request_size_ptr,
		char **	root_dir_ptr )

Definition at line 99 of file ex_network_ssl_hardened.c.

References accept_timeout, getoptret, list_push(), LOG_DEBUG, LOG_ERR, LOG_INFO, log_level, LOG_NOTICE, LOG_NULL, max_connections, MAX_HTTP_REQUEST_SIZE_LIMIT, n_log, NETWORK_IPV4, NETWORK_IPV6, set_log_level(), and usage().

Here is the call graph for this function:

◆ set_socket_timeout()

int set_socket_timeout	(	SOCKET	sock,
		int	timeout_seconds )

Set socket read/write timeout to prevent slow-loris attacks.

Parameters

sock	the socket file descriptor
timeout_seconds	timeout in seconds

Returns: TRUE on success, FALSE on failure

Examples: ex_network_ssl_hardened.c.

Definition at line 309 of file ex_network_ssl_hardened.c.

References LOG_ERR, and n_log.

Referenced by handle_request().

Here is the caller graph for this function:

◆ ssl_harden_context()

int ssl_harden_context ( NETWORK * ssl_netw )

Harden the SSL context with modern security settings.

Applied after netw_set_crypto/netw_set_crypto_chain to tighten TLS configuration:

Enforce TLS 1.2 minimum
Restrict cipher suites to strong AEAD ciphers with forward secrecy
Disable compression (CRIME attack)
Server cipher preference
Disable session tickets for forward secrecy
Configure ECDH curves

Parameters

ssl_netw the network whose SSL_CTX to harden

Returns: TRUE on success, FALSE on failure

Examples: ex_network_ssl_hardened.c.

Definition at line 245 of file ex_network_ssl_hardened.c.

References __n_assert, NETWORK::ctx, LOG_ERR, LOG_INFO, and n_log.

Referenced by main().

Here is the caller graph for this function:

◆ ssl_network_thread()

void * ssl_network_thread ( void * params )

Definition at line 662 of file ex_network_ssl_hardened.c.

References __n_assert, Free, handle_request(), NETWORK_SSL_THREAD_PARAMS::netw, netw_close(), and NETWORK_SSL_THREAD_PARAMS::routes.

Here is the call graph for this function:

◆ usage()

void usage ( void )

Definition at line 80 of file ex_network_ssl_hardened.c.

References max_http_request_size, and MAX_HTTP_REQUEST_SIZE_LIMIT.

◆ validate_path()

int validate_path	(	const char *	requested_path,
		const char *	root,
		char *	resolved,
		size_t	resolved_size )

Validate that a resolved path stays within the document root.

Resolves the requested path using realpath() and checks that it starts with the resolved root directory, preventing path traversal attacks (e.g., GET /../../etc/passwd).

Parameters

requested_path	the filesystem path constructed from the URL
root	the document root directory
resolved	output buffer for the validated absolute path
resolved_size	size of the output buffer

Returns: TRUE if the path is safe, FALSE if it escapes the root

Examples: ex_network_ssl_hardened.c.

Definition at line 349 of file ex_network_ssl_hardened.c.

References LOG_ERR, and n_log.

Referenced by handle_request().

Here is the caller graph for this function:

Variable Documentation

◆ accept_timeout

int accept_timeout = 30

Definition at line 63 of file ex_network_ssl_hardened.c.

◆ addr

char* addr = NULL

Definition at line 48 of file ex_network_ssl_hardened.c.

◆ ca_file

char* ca_file = NULL

Definition at line 51 of file ex_network_ssl_hardened.c.

◆ cert

char* cert = NULL

Definition at line 50 of file ex_network_ssl_hardened.c.

◆ done

volatile sig_atomic_t done = 0

Definition at line 64 of file ex_network_ssl_hardened.c.

◆ ip_version

int ip_version = 0

Definition at line 54 of file ex_network_ssl_hardened.c.

◆ killed_by_signal

volatile sig_atomic_t killed_by_signal = 0

Definition at line 66 of file ex_network_ssl_hardened.c.

◆ max_connections

int max_connections = 0

Definition at line 59 of file ex_network_ssl_hardened.c.

◆ max_http_request_size

int max_http_request_size = 16384

Definition at line 55 of file ex_network_ssl_hardened.c.

◆ netw

NETWORK * netw = NULL

Network for server mode, accepting incomming.

Definition at line 69 of file ex_network_ssl_hardened.c.

◆ port

char* port = NULL

Definition at line 47 of file ex_network_ssl_hardened.c.

◆ root_dir

char* root_dir = NULL

Definition at line 52 of file ex_network_ssl_hardened.c.

◆ routes

LIST* routes = NULL

Definition at line 53 of file ex_network_ssl_hardened.c.

◆ server

NETWORK* server = NULL

Definition at line 68 of file ex_network_ssl_hardened.c.

◆ ssl_verify

int ssl_verify = 0

Definition at line 58 of file ex_network_ssl_hardened.c.

Data Structures

Macros

Functions

Variables

Data Structure Documentation

◆ NETWORK_SSL_THREAD_PARAMS

Macro Definition Documentation

◆ CONNECTION_TIMEOUT_SECONDS

◆ MAX_HTTP_REQUEST_SIZE_LIMIT

◆ SECURITY_HEADERS

Function Documentation

◆ action_on_sig()

◆ build_secure_response()

◆ handle_request()

◆ main()

◆ process_args()

◆ set_socket_timeout()

◆ ssl_harden_context()

◆ ssl_network_thread()

◆ usage()

◆ validate_path()

Variable Documentation

◆ accept_timeout

◆ addr

◆ ca_file

◆ cert

◆ done

◆ ip_version

◆ killed_by_signal

◆ max_connections

◆ max_http_request_size

◆ netw

◆ port

◆ root_dir

◆ routes

◆ server

◆ ssl_verify