Update libraries and make it build on windows.

Still gets some warnings because compilers have changed. But should work.

vendor/CivetWeb/CMakeLists.txt

@@ -24,7 +24,7 @@ target_compile_definitions(CivetWeb PUBLIC USE_TIMERS=1 USE_WEBSOCKET=1 USE_IPV6
 # Look for SSL
 find_package(OpenSSL)
 # Check SSL status
-if (OPENSSL_FOUND)
+if(OPENSSL_FOUND)
     message(STATUS "CivetWeb: OpenSSL was found ${OPENSSL_VERSION}")
     target_link_libraries(CivetWeb PUBLIC OpenSSL::Crypto OpenSSL::SSL)
     string(REPLACE "." ";" OPENSSL_VERSION_LIST ${OPENSSL_VERSION})
@@ -32,10 +32,21 @@ if (OPENSSL_FOUND)
     list(GET OPENSSL_VERSION_LIST 1 OPENSSL_VERSION_MINOR)
     list(GET OPENSSL_VERSION_LIST 2 OPENSSL_VERSION_PATCH)
     # Tell the library what SSL version to expect
-    target_compile_definitions(CivetWeb PRIVATE "OPENSSL_API_${OPENSSL_VERSION_MAJOR}_${OPENSSL_VERSION_MINOR}")
-    message(STATUS "CivetWeb: OPENSSL_API_${OPENSSL_VERSION_MAJOR}_${OPENSSL_VERSION_MINOR}")
+    if("${OPENSSL_VERSION_MAJOR}" STREQUAL "1")
+		if("${OPENSSL_VERSION_MINOR}" STREQUAL "1")
+			target_compile_definitions(CivetWeb PRIVATE OPENSSL_API_1_0=1)
+			message(STATUS "CivetWeb: OPENSSL_API_1_0")
+		else()
+			target_compile_definitions(CivetWeb PRIVATE OPENSSL_API_1_1=1)
+			message(STATUS "CivetWeb: OPENSSL_API_1_1")
+		endif()
+    else()
+		target_compile_definitions(CivetWeb PRIVATE OPENSSL_API_3_0=1)
+			message(STATUS "CivetWeb: OPENSSL_API_3_0")
+    endif()
 else()
     target_compile_definitions(CivetWeb PUBLIC NO_SSL=1)
+    message(STATUS "CivetWeb: OpenSSL was not found!")
 endif()
 # Look for ZLib
 find_package(ZLIB)
@@ -45,3 +56,15 @@ if (ZLIB_FOUND)
     target_link_libraries(CivetWeb PUBLIC ZLIB::ZLIB)
     target_compile_definitions(CivetWeb PUBLIC USE_ZLIB=1)
 endif()
+# Need Windows sockets if available
+if(MSVC OR MSYS OR MINGW)
+    find_package(WinSock)
+    if (WINSOCK_FOUND)
+        target_link_libraries(CivetWeb PUBLIC ${WINSOCK_LIBRARIES})
+    endif()
+endif()
+# We need threading
+find_package(Threads)
+target_link_libraries(CivetWeb PUBLIC ${CMAKE_THREAD_LIBS_INIT})
+# Other configs
+target_compile_definitions(CivetWeb PUBLIC USE_STACK_SIZE=102400)

vendor/CivetWeb/LICENSE.md

@@ -66,6 +66,10 @@ http://www.lua.org/license.html
 > THE SOFTWARE.
 
 
+Additional components Copyright (C) Lua.org, PUC-Rio, with MIT license: 
+http://www.inf.puc-rio.br/~roberto/struct/
+
+
 SQLite3 License
 ------
 

vendor/CivetWeb/handle_form.inl

@@ -162,14 +162,17 @@ search_boundary(const char *buf,
                 const char *boundary,
                 size_t boundary_len)
 {
-	/* We must do a binary search here, not a string search, since the buffer
-	 * may contain '\x00' bytes, if binary data is transferred. */
-	int clen = (int)buf_len - (int)boundary_len - 4;
+	char *boundary_start = "\r\n--";
+	size_t boundary_start_len = strlen(boundary_start);
+
+	/* We must do a binary search here, not a string search, since the
+	 * buffer may contain '\x00' bytes, if binary data is transferred. */
+	int clen = (int)buf_len - (int)boundary_len - boundary_start_len;
 	int i;
 
 	for (i = 0; i <= clen; i++) {
-		if (!memcmp(buf + i, "\r\n--", 4)) {
-			if (!memcmp(buf + i + 4, boundary, boundary_len)) {
+		if (!memcmp(buf + i, boundary_start, boundary_start_len)) {
+			if (!memcmp(buf + i + boundary_start_len, boundary, boundary_len)) {
 				return buf + i;
 			}
 		}
@@ -185,7 +188,7 @@ mg_handle_form_request(struct mg_connection *conn,
 	char path[512];
 	char buf[MG_BUF_LEN]; /* Must not be smaller than ~900 */
 	int field_storage;
-	int buf_fill = 0;
+	size_t buf_fill = 0;
 	int r;
 	int field_count = 0;
 	struct mg_file fstore = STRUCT_FILE_INITIALIZER;
@@ -394,10 +397,10 @@ mg_handle_form_request(struct mg_connection *conn,
 			int end_of_key_value_pair_found = 0;
 			int get_block;
 
-			if ((size_t)buf_fill < (sizeof(buf) - 1)) {
+			if (buf_fill < (sizeof(buf) - 1)) {
 
-				size_t to_read = sizeof(buf) - 1 - (size_t)buf_fill;
-				r = mg_read(conn, buf + (size_t)buf_fill, to_read);
+				size_t to_read = sizeof(buf) - 1 - buf_fill;
+				r = mg_read(conn, buf + buf_fill, to_read);
 				if ((r < 0) || ((r == 0) && all_data_read)) {
 					/* read error */
 					return -1;
@@ -526,11 +529,11 @@ mg_handle_form_request(struct mg_connection *conn,
 					        buf + (size_t)used,
 					        sizeof(buf) - (size_t)used);
 					next = buf;
-					buf_fill -= (int)used;
-					if ((size_t)buf_fill < (sizeof(buf) - 1)) {
+					buf_fill -= used;
+					if (buf_fill < (sizeof(buf) - 1)) {
 
-						size_t to_read = sizeof(buf) - 1 - (size_t)buf_fill;
-						r = mg_read(conn, buf + (size_t)buf_fill, to_read);
+						size_t to_read = sizeof(buf) - 1 - buf_fill;
+						r = mg_read(conn, buf + buf_fill, to_read);
 						if ((r < 0) || ((r == 0) && all_data_read)) {
 #if !defined(NO_FILESYSTEMS)
 							/* read error */
@@ -589,7 +592,7 @@ mg_handle_form_request(struct mg_connection *conn,
 			/* Proceed to next entry */
 			used = next - buf;
 			memmove(buf, buf + (size_t)used, sizeof(buf) - (size_t)used);
-			buf_fill -= (int)used;
+			buf_fill -= used;
 		}
 
 		return field_count;
@@ -624,6 +627,7 @@ mg_handle_form_request(struct mg_connection *conn,
 		}
 
 		/* Copy boundary string to variable "boundary" */
+		/* fbeg is pointer to start of value of boundary */
 		fbeg = content_type + bl + 9;
 		bl = strlen(fbeg);
 		boundary = (char *)mg_malloc(bl + 1);
@@ -678,12 +682,12 @@ mg_handle_form_request(struct mg_connection *conn,
 		for (part_no = 0;; part_no++) {
 			size_t towrite, fnlen, n;
 			int get_block;
-			size_t to_read = sizeof(buf) - 1 - (size_t)buf_fill;
+			size_t to_read = sizeof(buf) - 1 - buf_fill;
 
 			/* Unused without filesystems */
 			(void)n;
 
-			r = mg_read(conn, buf + (size_t)buf_fill, to_read);
+			r = mg_read(conn, buf + buf_fill, to_read);
 			if ((r < 0) || ((r == 0) && all_data_read)) {
 				/* read error */
 				mg_free(boundary);
@@ -701,43 +705,74 @@ mg_handle_form_request(struct mg_connection *conn,
 				return -1;
 			}
 
+			/* @see https://www.rfc-editor.org/rfc/rfc2046.html#section-5.1.1
+			 *
+			 * multipart-body := [preamble CRLF]
+			 *     dash-boundary transport-padding CRLF
+			 *     body-part *encapsulation
+			 *     close-delimiter transport-padding
+			 *     [CRLF epilogue]
+			 */
+
 			if (part_no == 0) {
-				int d = 0;
-				while ((d < buf_fill) && (buf[d] != '-')) {
-					d++;
+				size_t preamble_length = 0;
+				/* skip over the preamble until we find a complete boundary
+				 * limit the preamble length to prevent abuse */
+				/* +2 for the -- preceding the boundary */
+				while (preamble_length < 1024
+				       && (preamble_length < buf_fill - bl)
+				       && strncmp(buf + preamble_length + 2, boundary, bl)) {
+					preamble_length++;
 				}
-				if ((d > 0) && (buf[d] == '-')) {
-					memmove(buf, buf + d, (unsigned)buf_fill - (unsigned)d);
-					buf_fill -= d;
+				/* reset the start of buf to remove the preamble */
+				if (0 == strncmp(buf + preamble_length + 2, boundary, bl)) {
+					memmove(buf,
+					        buf + preamble_length,
+					        (unsigned)buf_fill - (unsigned)preamble_length);
+					buf_fill -= preamble_length;
 					buf[buf_fill] = 0;
 				}
 			}
 
-			if (buf[0] != '-' || buf[1] != '-') {
+			/* either it starts with a boundary and it's fine, or it's malformed
+			 * because:
+			 * - the preamble was longer than accepted
+			 * - couldn't find a boundary at all in the body
+			 * - didn't have a terminating boundary */
+			if (buf_fill < (bl + 2) || strncmp(buf, "--", 2)
+			    || strncmp(buf + 2, boundary, bl)) {
 				/* Malformed request */
 				mg_free(boundary);
 				return -1;
 			}
-			if (0 != strncmp(buf + 2, boundary, bl)) {
-				/* Malformed request */
-				mg_free(boundary);
-				return -1;
+
+			/* skip the -- */
+			char *boundary_start = buf + 2;
+			size_t transport_padding = 0;
+			while (boundary_start[bl + transport_padding] == ' '
+			       || boundary_start[bl + transport_padding] == '\t') {
+				transport_padding++;
 			}
-			if (buf[bl + 2] != '\r' || buf[bl + 3] != '\n') {
-				/* Every part must end with \r\n, if there is another part.
-				 * The end of the request has an extra -- */
-				if (((size_t)buf_fill != (size_t)(bl + 6))
-				    || (strncmp(buf + bl + 2, "--\r\n", 4))) {
+			char *boundary_end = boundary_start + bl + transport_padding;
+
+			/* after the transport padding, if the boundary isn't
+			 * immediately followed by a \r\n then it is either... */
+			if (strncmp(boundary_end, "\r\n", 2)) {
+				/* ...the final boundary, and it is followed by --, (in which
+				 * case it's the end of the request) or it's a malformed
+				 * request */
+				if (strncmp(boundary_end, "--", 2)) {
 					/* Malformed request */
 					mg_free(boundary);
 					return -1;
 				}
-				/* End of the request */
+				/* Ingore any epilogue here */
 				break;
 			}
 
+			/* skip the \r\n */
+			hbuf = boundary_end + 2;
 			/* Next, we need to get the part header: Read until \r\n\r\n */
-			hbuf = buf + bl + 4;
 			hend = strstr(hbuf, "\r\n\r\n");
 			if (!hend) {
 				/* Malformed request */
@@ -965,12 +1000,12 @@ mg_handle_form_request(struct mg_connection *conn,
 #endif /* NO_FILESYSTEMS */
 
 				memmove(buf, hend + towrite, bl + 4);
-				buf_fill = (int)(bl + 4);
+				buf_fill = bl + 4;
 				hend = buf;
 
 				/* Read new data */
-				to_read = sizeof(buf) - 1 - (size_t)buf_fill;
-				r = mg_read(conn, buf + (size_t)buf_fill, to_read);
+				to_read = sizeof(buf) - 1 - buf_fill;
+				r = mg_read(conn, buf + buf_fill, to_read);
 				if ((r < 0) || ((r == 0) && all_data_read)) {
 #if !defined(NO_FILESYSTEMS)
 					/* read error */
@@ -989,7 +1024,7 @@ mg_handle_form_request(struct mg_connection *conn,
 				/* buf_fill is at least 8 here */
 
 				/* Find boundary */
-				next = search_boundary(buf, (size_t)buf_fill, boundary, bl);
+				next = search_boundary(buf, buf_fill, boundary, bl);
 
 				if (!next && (r == 0)) {
 					/* incomplete request */
@@ -1064,7 +1099,7 @@ mg_handle_form_request(struct mg_connection *conn,
 			if (next) {
 				used = next - buf + 2;
 				memmove(buf, buf + (size_t)used, sizeof(buf) - (size_t)used);
-				buf_fill -= (int)used;
+				buf_fill -= used;
 			} else {
 				buf_fill = 0;
 			}

vendor/CivetWeb/http2.inl

@@ -1442,7 +1442,7 @@ handle_http2(struct mg_connection *conn)
 					    hpack_decode(buf, &i, (int)bytes_read, conn->phys_ctx);
 					CHECK_LEAK_HDR_ALLOC(key);
 					if (!key) {
-						DEBUG_TRACE("HTTP2 key decoding error");
+						DEBUG_TRACE("%s", "HTTP2 key decoding error");
 						goto clean_http2;
 					}
 				} else if (/*(idx >= 15) &&*/ (idx <= 61)) {
@@ -1509,7 +1509,7 @@ handle_http2(struct mg_connection *conn)
 					                   conn->phys_ctx); /* leak? */
 					CHECK_LEAK_HDR_ALLOC(val);
 					if (!val) {
-						DEBUG_TRACE("HTTP2 value decoding error");
+						DEBUG_TRACE("%s", "HTTP2 value decoding error");
 						mg_free((void *)key);
 						goto clean_http2;
 					}

vendor/CivetWeb/include/civetweb.h

@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2021 the Civetweb developers
+/* Copyright (c) 2013-2024 the Civetweb developers
  * Copyright (c) 2004-2013 Sergey Lyubka
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -23,9 +23,9 @@
 #ifndef CIVETWEB_HEADER_INCLUDED
 #define CIVETWEB_HEADER_INCLUDED
 
-#define CIVETWEB_VERSION "1.16"
+#define CIVETWEB_VERSION "1.17"
 #define CIVETWEB_VERSION_MAJOR (1)
-#define CIVETWEB_VERSION_MINOR (16)
+#define CIVETWEB_VERSION_MINOR (17)
 #define CIVETWEB_VERSION_PATCH (0)
 
 #ifndef CIVETWEB_API
@@ -714,8 +714,8 @@ struct mg_server_port {
 	int port;        /* port number */
 	int is_ssl;      /* https port: 0 = no, 1 = yes */
 	int is_redirect; /* redirect all requests: 0 = no, 1 = yes */
-	int _reserved1;
-	int _reserved2;
+	int is_optional; /* optional: 0 = no, 1 = yes */
+	int is_bound;    /* bound: 0 = no, 1 = yes, relevant for optional ports */
 	int _reserved3;
 	int _reserved4;
 };
@@ -1208,7 +1208,7 @@ struct mg_form_data_handler {
 	 *   filename: Name of a file to upload, at the client computer.
 	 *             Only set for input fields of type "file", otherwise NULL.
 	 *   path: Output parameter: File name (incl. path) to store the file
-	 *         at the server computer. Only used if FORM_FIELD_STORAGE_STORE
+	 *         at the server computer. Only used if MG_FORM_FIELD_STORAGE_STORE
 	 *         is returned by this callback. Existing files will be
 	 *         overwritten.
 	 *   pathlen: Length of the buffer for path.
@@ -1216,7 +1216,7 @@ struct mg_form_data_handler {
 	 *
 	 * Return value:
 	 *   The callback must return the intended storage for this field
-	 *   (See FORM_FIELD_STORAGE_*).
+	 *   (See MG_FORM_FIELD_STORAGE_*).
 	 */
 	int (*field_found)(const char *key,
 	                   const char *filename,
@@ -1224,7 +1224,7 @@ struct mg_form_data_handler {
 	                   size_t pathlen,
 	                   void *user_data);
 
-	/* If the "field_found" callback returned FORM_FIELD_STORAGE_GET,
+	/* If the "field_found" callback returned MG_FORM_FIELD_STORAGE_GET,
 	 * this callback will receive the field data.
 	 *
 	 * Parameters:
@@ -1241,7 +1241,7 @@ struct mg_form_data_handler {
 	                 size_t valuelen,
 	                 void *user_data);
 
-	/* If the "field_found" callback returned FORM_FIELD_STORAGE_STORE,
+	/* If the "field_found" callback returned MG_FORM_FIELD_STORAGE_STORE,
 	 * the data will be stored into a file. If the file has been written
 	 * successfully, this callback will be called. This callback will
 	 * not be called for only partially uploaded files. The

vendor/CivetWeb/match.inl

@@ -47,8 +47,8 @@ mg_match_impl(const char *pat,
 				/* Advance as long as there are ? */
 				i_pat++;
 				i_str++;
-			} while ((pat[i_pat] == '?') && (str[i_str] != '\0')
-			         && (str[i_str] != '/') && (i_pat < pat_len));
+			} while ((i_pat < pat_len) && (pat[i_pat] == '?')
+			         && (str[i_str] != '\0') && (str[i_str] != '/'));
 
 			/* If we have a match context, add the substring we just found */
 			if (mcx) {
@@ -72,7 +72,7 @@ mg_match_impl(const char *pat,
 			ptrdiff_t ret;
 
 			i_pat++;
-			if ((pat[i_pat] == '*') && (i_pat < pat_len)) {
+			if ((i_pat < pat_len) && (pat[i_pat] == '*')) {
 				/* Pattern ** matches all */
 				i_pat++;
 				len = strlen(str + i_str);
@@ -86,7 +86,7 @@ mg_match_impl(const char *pat,
 				if (mcx) {
 					match_context_push(str + i_str, len, mcx);
 				}
-				return (i_str + len);
+				return ((ptrdiff_t)(i_str + len));
 			}
 
 			/* This loop searches for the longest possible match */
@@ -102,7 +102,7 @@ mg_match_impl(const char *pat,
 				if (mcx) {
 					match_context_push(str + i_str, len, mcx);
 				}
-				return (i_str + ret + len);
+				return ((ptrdiff_t)i_str + ret + (ptrdiff_t)len);
 			}
 
 			return -1;

vendor/CivetWeb/mod_gnutls.inl

@@ -0,0 +1,240 @@
+#if defined(USE_GNUTLS) // USE_GNUTLS used with NO_SSL
+
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+
+typedef struct {
+	gnutls_session_t sess;
+} SSL;
+typedef struct {
+	gnutls_certificate_credentials_t cred;
+	gnutls_priority_t prio;
+} SSL_CTX;
+
+
+/* public api */
+CIVETWEB_API int gtls_sslctx_init(SSL_CTX *ctx, const char *crt);
+CIVETWEB_API void gtls_sslctx_uninit(SSL_CTX *ctx);
+CIVETWEB_API void gtls_ssl_close(SSL *ssl);
+CIVETWEB_API int gtls_ssl_accept(SSL **ssl,
+                                 SSL_CTX *ssl_ctx,
+                                 int sock,
+                                 struct mg_context *phys_ctx);
+CIVETWEB_API int gtls_ssl_read(SSL *ssl, unsigned char *buf, size_t len);
+CIVETWEB_API int gtls_ssl_write(SSL *ssl, const unsigned char *buf, size_t len);
+
+
+CIVETWEB_API int
+gtls_sslctx_init(SSL_CTX *ctx, const char *crt)
+{
+	int rc;
+
+	if (ctx == NULL || crt == NULL) {
+		return -1;
+	}
+
+	DEBUG_TRACE("%s", "Initializing GnuTLS SSL");
+
+	rc = gnutls_certificate_allocate_credentials(&ctx->cred);
+	if (rc != GNUTLS_E_SUCCESS) {
+		DEBUG_TRACE("Failed to allocate credentials (%d): %s",
+		            rc,
+		            gnutls_strerror(rc));
+		goto failed;
+	}
+
+	rc = gnutls_priority_init(&ctx->prio, NULL, NULL);
+	if (rc != GNUTLS_E_SUCCESS) {
+		DEBUG_TRACE("Failed to allocate priority cache (%d): %s",
+		            rc,
+		            gnutls_strerror(rc));
+		goto failed;
+	}
+
+	rc = gnutls_certificate_set_x509_key_file2(ctx->cred,
+	                                           crt,
+	                                           crt,
+	                                           GNUTLS_X509_FMT_PEM,
+	                                           NULL,
+	                                           GNUTLS_PKCS_PLAIN
+	                                               | GNUTLS_PKCS_NULL_PASSWORD);
+	if (rc != GNUTLS_E_SUCCESS) {
+		DEBUG_TRACE("TLS parse crt/key file failed (%d): %s",
+		            rc,
+		            gnutls_strerror(rc));
+		goto failed;
+	}
+
+	return 0;
+
+failed:
+	gtls_sslctx_uninit(ctx);
+
+	return -1;
+}
+
+
+CIVETWEB_API void
+gtls_sslctx_uninit(SSL_CTX *ctx)
+{
+	if (ctx != NULL) {
+		gnutls_certificate_free_credentials(ctx->cred);
+		gnutls_priority_deinit(ctx->prio);
+		ctx->cred = NULL;
+		ctx->prio = NULL;
+	}
+}
+
+
+CIVETWEB_API int
+gtls_ssl_accept(SSL **ssl,
+                SSL_CTX *ssl_ctx,
+                int sock,
+                struct mg_context *phys_ctx)
+{
+	int rc;
+
+	if (ssl == NULL || ssl_ctx == NULL) {
+		return -1;
+	}
+
+	DEBUG_TRACE("TLS accept processing %p", ssl);
+
+	*ssl = (SSL *)mg_calloc_ctx(1, sizeof(SSL), phys_ctx);
+	if (*ssl == NULL) {
+		DEBUG_TRACE("Failed to allocate memory for session %zu", sizeof(SSL));
+		return -1;
+	}
+
+	rc = gnutls_init(&(*ssl)->sess, GNUTLS_SERVER);
+	if (rc != GNUTLS_E_SUCCESS) {
+		DEBUG_TRACE("Failed to initialize session (%d): %s",
+		            rc,
+		            gnutls_strerror(rc));
+		goto failed;
+	}
+
+	rc = gnutls_priority_set((*ssl)->sess, ssl_ctx->prio);
+	if (rc != GNUTLS_E_SUCCESS) {
+		DEBUG_TRACE("TLS set priortities failed (%d): %s",
+		            rc,
+		            gnutls_strerror(rc));
+		goto failed;
+	}
+
+	rc = gnutls_credentials_set((*ssl)->sess,
+	                            GNUTLS_CRD_CERTIFICATE,
+	                            ssl_ctx->cred);
+	if (rc != GNUTLS_E_SUCCESS) {
+		DEBUG_TRACE("TLS set credentials failed (%d): %s",
+		            rc,
+		            gnutls_strerror(rc));
+		goto failed;
+	}
+
+	gnutls_certificate_send_x509_rdn_sequence((*ssl)->sess, 1);
+	gnutls_certificate_server_set_request((*ssl)->sess, GNUTLS_CERT_IGNORE);
+	gnutls_handshake_set_timeout((*ssl)->sess,
+	                             GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
+	gnutls_transport_set_int((*ssl)->sess, sock);
+
+	while ((rc = gnutls_handshake((*ssl)->sess)) != GNUTLS_E_SUCCESS) {
+		if (gnutls_error_is_fatal(rc)) {
+			if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED) {
+				DEBUG_TRACE("TLS fatal alert received: %s",
+				            gnutls_alert_get_name(
+				                gnutls_alert_get((*ssl)->sess)));
+			} else {
+				DEBUG_TRACE("TLS handshake failed (%d): %s",
+				            rc,
+				            gnutls_strerror(rc));
+			}
+
+			goto failed;
+		}
+	}
+
+	DEBUG_TRACE("TLS connection %p accepted", *ssl);
+
+	return 0;
+
+failed:
+	gnutls_deinit((*ssl)->sess);
+	mg_free(*ssl);
+	*ssl = NULL;
+
+	return -1;
+}
+
+
+CIVETWEB_API void
+gtls_ssl_close(SSL *ssl)
+{
+	int rc;
+
+	if (ssl == NULL) {
+		return;
+	}
+
+	while ((rc = gnutls_bye(ssl->sess, GNUTLS_SHUT_RDWR)) != GNUTLS_E_SUCCESS) {
+		switch (rc) {
+		case GNUTLS_E_AGAIN: /* fall through */
+		case GNUTLS_E_INTERRUPTED:
+			continue;
+		default: /* should actually never happen */
+			break;
+		}
+	}
+
+	DEBUG_TRACE("TLS connection %p closed", ssl);
+	gnutls_deinit(ssl->sess);
+	mg_free(ssl);
+}
+
+
+CIVETWEB_API int
+gtls_ssl_read(SSL *ssl, unsigned char *buf, size_t len)
+{
+	ssize_t rc;
+
+	if (ssl == NULL) {
+		return GNUTLS_E_INVALID_SESSION;
+	}
+
+	while ((rc = gnutls_record_recv(ssl->sess, buf, len)) < 0) {
+		switch (rc) {
+		case GNUTLS_E_AGAIN: /* fall through */
+		case GNUTLS_E_INTERRUPTED:
+			continue;
+		default:
+			break;
+		}
+	}
+	/* DEBUG_TRACE("gnutls_record_recv: %d", rc); */
+	return (int)rc;
+}
+
+
+CIVETWEB_API int
+gtls_ssl_write(SSL *ssl, const unsigned char *buf, size_t len)
+{
+	ssize_t rc;
+
+	if (ssl == NULL) {
+		return GNUTLS_E_INVALID_SESSION;
+	}
+
+	while ((rc = gnutls_record_send(ssl->sess, buf, len)) < 0) {
+		switch (rc) {
+		case GNUTLS_E_AGAIN: /* fall through */
+		case GNUTLS_E_INTERRUPTED:
+			continue;
+		default:
+			break;
+		}
+	}
+	/* DEBUG_TRACE("gnutls_record_send: %d", rc); */
+	return (int)rc;
+}
+
+#endif /* USE_GNUTLS */

vendor/CivetWeb/mod_mbedtls.inl

@@ -1,11 +1,19 @@
 #if defined(USE_MBEDTLS) // USE_MBEDTLS used with NO_SSL
 
-#include "mbedtls/certs.h"
 #include "mbedtls/ctr_drbg.h"
 #include "mbedtls/debug.h"
 #include "mbedtls/entropy.h"
 #include "mbedtls/error.h"
+
+#if MBEDTLS_VERSION_NUMBER >= 0x03000000
+// The file include/mbedtls/net.h was removed in v3.0.0 because its only
+// function was to include mbedtls/net_sockets.h which now should be included
+// directly.
+#include "mbedtls/net_sockets.h"
+#else
 #include "mbedtls/net.h"
+#endif
+
 #include "mbedtls/pk.h"
 #include "mbedtls/platform.h"
 #include "mbedtls/ssl.h"
@@ -80,6 +88,19 @@ mbed_sslctx_init(SSL_CTX *ctx, const char *crt)
 	mbedtls_ctr_drbg_init(&ctx->ctr);
 	mbedtls_x509_crt_init(&ctx->cert);
 
+#ifdef MBEDTLS_PSA_CRYPTO_C
+	/* Initialize PSA crypto (mandatory with TLS 1.3)
+	 * This must be done before calling any other PSA Crypto
+	 * functions or they will fail with PSA_ERROR_BAD_STATE
+	 */
+	const psa_status_t status = psa_crypto_init();
+	if (status != PSA_SUCCESS) {
+		DEBUG_TRACE("Failed to initialize PSA crypto, returned %d\n",
+		            (int)status);
+		return -1;
+	}
+#endif
+
 	rc = mbedtls_ctr_drbg_seed(&ctx->ctr,
 	                           mbedtls_entropy_func,
 	                           &ctx->entropy,
@@ -90,7 +111,17 @@ mbed_sslctx_init(SSL_CTX *ctx, const char *crt)
 		return -1;
 	}
 
+#if MBEDTLS_VERSION_NUMBER >= 0x03000000
+	// mbedtls_pk_parse_keyfile() has changed in mbedTLS 3.0. You now need
+	// to pass a properly seeded, cryptographically secure RNG when calling
+	// these functions. It is used for blinding, a countermeasure against
+	// side-channel attacks.
+	// https://github.com/Mbed-TLS/mbedtls/blob/development/docs/3.0-migration-guide.md#some-functions-gained-an-rng-parameter
+	rc = mbedtls_pk_parse_keyfile(
+	    &ctx->pkey, crt, NULL, mbedtls_ctr_drbg_random, &ctx->ctr);
+#else
 	rc = mbedtls_pk_parse_keyfile(&ctx->pkey, crt, NULL);
+#endif
 	if (rc != 0) {
 		DEBUG_TRACE("TLS parse key file failed (%i)", rc);
 		return -1;
@@ -170,7 +201,13 @@ mbed_ssl_accept(mbedtls_ssl_context **ssl,
 		return -1;
 	}
 
+#if MBEDTLS_VERSION_NUMBER >= 0x03000000
+	DEBUG_TRACE("TLS connection %p accepted, state: %d",
+	            ssl,
+	            (*ssl)->MBEDTLS_PRIVATE(state));
+#else
 	DEBUG_TRACE("TLS connection %p accepted, state: %d", ssl, (*ssl)->state);
+#endif
 	return 0;
 }
 
@@ -196,7 +233,13 @@ mbed_ssl_handshake(mbedtls_ssl_context *ssl)
 		}
 	}
 
+#if MBEDTLS_VERSION_NUMBER >= 0x03000000
+	DEBUG_TRACE("TLS handshake rc: %d, state: %d",
+	            rc,
+	            ssl->MBEDTLS_PRIVATE(state));
+#else
 	DEBUG_TRACE("TLS handshake rc: %d, state: %d", rc, ssl->state);
+#endif
 	return rc;
 }
 

vendor/CivetWeb/sort.inl

@@ -14,32 +14,32 @@ mg_sort(void *data,
 	 */
 
 	/* We use ShellSort here with this gap sequence: https://oeis.org/A102549 */
-	int A102549[9] = {1, 4, 10, 23, 57, 132, 301, 701, 1750};
-	int Aidx, gap, i, j, k;
+	size_t A102549[9] = {1, 4, 10, 23, 57, 132, 301, 701, 1750};
+	size_t gap, i, j, k;
+	int Aidx;
 	void *tmp = alloca(elemsize);
 
 	for (Aidx = 8; Aidx >= 0; Aidx--) {
 		gap = A102549[Aidx];
-		if (gap > ((int)elemcount / 2)) {
+		if (gap > (elemcount / 2)) {
 			continue;
 		}
 		for (i = 0; i < gap; i++) {
-			for (j = i; j < (int)elemcount; j += gap) {
-				memcpy(tmp, (void *)((ptrdiff_t)data + elemsize * j), elemsize);
+			for (j = i; j < elemcount; j += gap) {
+				memcpy(tmp, (void *)((size_t)data + elemsize * j), elemsize);
 
 				for (k = j; k >= gap; k -= gap) {
-					void *cmp =
-					    (void *)((ptrdiff_t)data + elemsize * (k - gap));
+					void *cmp = (void *)((size_t)data + elemsize * (k - gap));
 					int cmpres = compfunc(cmp, tmp, userarg);
 					if (cmpres > 0) {
-						memcpy((void *)((ptrdiff_t)data + elemsize * k),
+						memcpy((void *)((size_t)data + elemsize * k),
 						       cmp,
 						       elemsize);
 					} else {
 						break;
 					}
 				}
-				memcpy((void *)((ptrdiff_t)data + elemsize * k), tmp, elemsize);
+				memcpy((void *)((size_t)data + elemsize * k), tmp, elemsize);
 			}
 		}
 	}

vendor/CivetWeb/timer.inl

@@ -39,13 +39,16 @@ TIMER_API double
 timer_getcurrenttime(struct mg_context *ctx)
 {
 #if defined(_WIN32)
+	uint64_t now_tick64 = 0;
+#if defined(_WIN64)
+	now_tick64 = GetTickCount64();
+#else
 	/* GetTickCount returns milliseconds since system start as
 	 * unsigned 32 bit value. It will wrap around every 49.7 days.
 	 * We need to use a 64 bit counter (will wrap in 500 mio. years),
 	 * by adding the 32 bit difference since the last call to a
 	 * 64 bit counter. This algorithm will only work, if this
 	 * function is called at least once every 7 weeks. */
-	uint64_t now_tick64 = 0;
 	DWORD now_tick = GetTickCount();
 
 	if (ctx->timers) {
@@ -55,6 +58,7 @@ timer_getcurrenttime(struct mg_context *ctx)
 		ctx->timers->last_tick = now_tick;
 		pthread_mutex_unlock(&ctx->timers->mutex);
 	}
+#endif
 	return (double)now_tick64 * 1.0E-3;
 #else
 	struct timespec now_ts;