Add TLS-PSK authentication support via callback mechanism#348
Merged
Conversation
This adds support for TLS Pre-Shared Key (PSK) authentication, allowing secure connections without certificates using a shared secret key. Changes: - Add psk_cred_handler() builder method to create_webserver - Add psk_cred_handler_callback typedef for PSK credential lookup - Implement psk_cred_handler_func() static callback using GnuTLS - Add MHD_OPTION_GNUTLS_PSK_CRED_HANDLER option when PSK is configured - Add AM_CONDITIONAL for HAVE_GNUTLS in configure.ac - Remove deprecated AC_HEADER_STDC macro - Add minimal_https_psk example demonstrating PSK usage - Add conditional GnuTLS linking in test/Makefile.am - Update README.md with PSK documentation and example The callback receives a username and returns the hex-encoded PSK, or an empty string for unknown users.
The library now uses GnuTLS functions (gnutls_malloc, gnutls_free, gnutls_hex2bin) for PSK support, so all examples need to link against gnutls when HAVE_GNUTLS is defined, not just the PSK example.
- Update sanitizer builds (asan, lsan, tsan, ubsan) from clang-13 to clang-18 - Move clang-11, clang-12, clang-13 tests to ubuntu-22.04 - Add new clang-14 through clang-17 tests on ubuntu-latest - Add gcc-11 through gcc-14 tests - Remove obsolete ubuntu-20.04 jobs (gcc-7, gcc-8, clang-6 through clang-10) - Update IWYU job to use clang-18 on ubuntu-latest - Fix cpplint errors: add missing includes and fix namespace indentation Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove valgrind-dbg package (debug symbols now included in main package) - Update valgrind job to use GCC 14 instead of GCC 10 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
GCC 14 with -Werror catches a latent warning in littletest.hpp test framework that older compilers don't flag. Use GCC 13 for now. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requirements for Adding, Changing, or Removing a Feature
Issue or RFC Endorsed by Maintainers
Supersedes #333 - reimplementation with merge conflicts resolved.
Description of the Change
This PR adds TLS-PSK (Pre-Shared Key) authentication support to libhttpserver via a callback mechanism. PSK allows secure TLS connections without certificates by using a shared secret key.
Key changes:
psk_cred_handler_callbacktypedef:std::function<std::string(const std::string&)>psk_cred_handler()builder method tocreate_webserverpsk_cred_handler_func()static callback that integrates with GnuTLSMHD_OPTION_GNUTLS_PSK_CRED_HANDLERoption when PSK is configuredAM_CONDITIONAL([HAVE_GNUTLS],...)for conditional compilation in MakefilesAC_HEADER_STDCmacro from configure.acUsage:
Alternate Designs
The callback could return binary data instead of hex-encoded strings, but hex encoding was chosen for simplicity and to match the common PSK representation format used by tools like gnutls-cli.
Possible Drawbacks
HAVE_GNUTLS)Verification Process
./bootstrap && mkdir build && cd build && ../configure && makemake checkminimal_https_pskexample demonstrating the featureRelease Notes
Added TLS-PSK (Pre-Shared Key) authentication support via the new
psk_cred_handler()builder method, allowing secure connections without certificates.