| OLD | NEW |
| 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // This helper binary is only used for testing Chrome's SSL stack. | 5 // This helper binary is only used for testing Chrome's SSL stack. |
| 6 | 6 |
| 7 #include <sys/types.h> | 7 #include <sys/types.h> |
| 8 #include <sys/socket.h> | 8 #include <sys/socket.h> |
| 9 | 9 |
| 10 #include <openssl/bio.h> | 10 #include <openssl/bio.h> |
| 11 #include <openssl/ssl.h> | 11 #include <openssl/ssl.h> |
| 12 #include <openssl/err.h> | 12 #include <openssl/err.h> |
| 13 | 13 |
| 14 static const char kDefaultPEMFile[] = "net/data/ssl/certificates/ok_cert.pem"; | 14 static const char kDefaultPEMFile[] = "net/data/ssl/certificates/ok_cert.pem"; |
| 15 | 15 |
| 16 // Server Name Indication callback from OpenSSL | 16 // Server Name Indication callback from OpenSSL |
| 17 static int sni_cb(SSL *s, int *ad, void *arg) { | 17 static int sni_cb(SSL* s, int* ad, void* arg) { |
| 18 const char* servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name); | 18 const char* servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name); |
| 19 if (servername && strcmp(servername, "test.example.com") == 0) | 19 if (servername && strcmp(servername, "test.example.com") == 0) |
| 20 *reinterpret_cast<bool*>(arg) = true; | 20 *reinterpret_cast<bool*>(arg) = true; |
| 21 | 21 |
| 22 return SSL_TLSEXT_ERR_OK; | 22 return SSL_TLSEXT_ERR_OK; |
| 23 } | 23 } |
| 24 | 24 |
| 25 // Client certificate verification callback from OpenSSL | 25 // Client certificate verification callback from OpenSSL |
| 26 static int verify_cb(int preverify_ok, X509_STORE_CTX *ctx) { | 26 static int verify_cb(int preverify_ok, X509_STORE_CTX* ctx) { |
| 27 return 1; | 27 return 1; |
| 28 } | 28 } |
| 29 | 29 |
| 30 // Next Protocol Negotiation callback from OpenSSL | 30 // Next Protocol Negotiation callback from OpenSSL |
| 31 static int next_proto_cb(SSL *ssl, const unsigned char **out, | 31 static int next_proto_cb(SSL* ssl, |
| 32 unsigned int *outlen, void *arg) { | 32 const unsigned char** out, |
| 33 unsigned int* outlen, |
| 34 void* arg) { |
| 33 bool* npn_mispredict = reinterpret_cast<bool*>(arg); | 35 bool* npn_mispredict = reinterpret_cast<bool*>(arg); |
| 34 static char kProtos[] = "\003foo\003bar"; | 36 static char kProtos[] = "\003foo\003bar"; |
| 35 static char kProtos2[] = "\003baz\003boo"; | 37 static char kProtos2[] = "\003baz\003boo"; |
| 36 static unsigned count = 0; | 38 static unsigned count = 0; |
| 37 | 39 |
| 38 if (!*npn_mispredict || count == 0) { | 40 if (!*npn_mispredict || count == 0) { |
| 39 *out = (const unsigned char*) kProtos; | 41 *out = (const unsigned char*)kProtos; |
| 40 *outlen = sizeof(kProtos) - 1; | 42 *outlen = sizeof(kProtos) - 1; |
| 41 } else { | 43 } else { |
| 42 *out = (const unsigned char*) kProtos2; | 44 *out = (const unsigned char*)kProtos2; |
| 43 *outlen = sizeof(kProtos2) - 1; | 45 *outlen = sizeof(kProtos2) - 1; |
| 44 } | 46 } |
| 45 count++; | 47 count++; |
| 46 return SSL_TLSEXT_ERR_OK; | 48 return SSL_TLSEXT_ERR_OK; |
| 47 } | 49 } |
| 48 | 50 |
| 49 int | 51 int main(int argc, char** argv) { |
| 50 main(int argc, char **argv) { | |
| 51 SSL_library_init(); | 52 SSL_library_init(); |
| 52 ERR_load_crypto_strings(); | 53 ERR_load_crypto_strings(); |
| 53 OpenSSL_add_all_algorithms(); | 54 OpenSSL_add_all_algorithms(); |
| 54 SSL_load_error_strings(); | 55 SSL_load_error_strings(); |
| 55 | 56 |
| 56 bool sni = false, sni_good = false, snap_start = false; | 57 bool sni = false, sni_good = false, snap_start = false; |
| 57 bool snap_start_recovery = false, sslv3 = false, session_tickets = false; | 58 bool snap_start_recovery = false, sslv3 = false, session_tickets = false; |
| 58 bool fail_resume = false, client_cert = false, npn = false; | 59 bool fail_resume = false, client_cert = false, npn = false; |
| 59 bool npn_mispredict = false; | 60 bool npn_mispredict = false; |
| 60 | 61 |
| (...skipping 64 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 125 SSL_CTX_set_tlsext_servername_callback(ctx, sni_cb); | 126 SSL_CTX_set_tlsext_servername_callback(ctx, sni_cb); |
| 126 SSL_CTX_set_tlsext_servername_arg(ctx, &sni_good); | 127 SSL_CTX_set_tlsext_servername_arg(ctx, &sni_good); |
| 127 } | 128 } |
| 128 | 129 |
| 129 BIO* key = BIO_new(BIO_s_file()); | 130 BIO* key = BIO_new(BIO_s_file()); |
| 130 if (BIO_read_filename(key, key_file) <= 0) { | 131 if (BIO_read_filename(key, key_file) <= 0) { |
| 131 fprintf(stderr, "Failed to read %s\n", key_file); | 132 fprintf(stderr, "Failed to read %s\n", key_file); |
| 132 return 1; | 133 return 1; |
| 133 } | 134 } |
| 134 | 135 |
| 135 EVP_PKEY *pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, NULL); | 136 EVP_PKEY* pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, NULL); |
| 136 if (!pkey) { | 137 if (!pkey) { |
| 137 fprintf(stderr, "Failed to parse %s\n", key_file); | 138 fprintf(stderr, "Failed to parse %s\n", key_file); |
| 138 return 1; | 139 return 1; |
| 139 } | 140 } |
| 140 BIO_free(key); | 141 BIO_free(key); |
| 141 | 142 |
| 142 | |
| 143 BIO* cert = BIO_new(BIO_s_file()); | 143 BIO* cert = BIO_new(BIO_s_file()); |
| 144 if (BIO_read_filename(cert, cert_file) <= 0) { | 144 if (BIO_read_filename(cert, cert_file) <= 0) { |
| 145 fprintf(stderr, "Failed to read %s\n", cert_file); | 145 fprintf(stderr, "Failed to read %s\n", cert_file); |
| 146 return 1; | 146 return 1; |
| 147 } | 147 } |
| 148 | 148 |
| 149 X509 *pcert = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL); | 149 X509* pcert = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL); |
| 150 if (!pcert) { | 150 if (!pcert) { |
| 151 fprintf(stderr, "Failed to parse %s\n", cert_file); | 151 fprintf(stderr, "Failed to parse %s\n", cert_file); |
| 152 return 1; | 152 return 1; |
| 153 } | 153 } |
| 154 BIO_free(cert); | 154 BIO_free(cert); |
| 155 | 155 |
| 156 if (SSL_CTX_use_certificate(ctx, pcert) <= 0) { | 156 if (SSL_CTX_use_certificate(ctx, pcert) <= 0) { |
| 157 fprintf(stderr, "Failed to load %s\n", cert_file); | 157 fprintf(stderr, "Failed to load %s\n", cert_file); |
| 158 return 1; | 158 return 1; |
| 159 } | 159 } |
| (...skipping 30 matching lines...) Expand all Loading... |
| 190 | 190 |
| 191 for (unsigned connections = 0; connections < connection_limit; | 191 for (unsigned connections = 0; connections < connection_limit; |
| 192 connections++) { | 192 connections++) { |
| 193 const int fd = accept(3, NULL, NULL); | 193 const int fd = accept(3, NULL, NULL); |
| 194 | 194 |
| 195 SSL* server = SSL_new(ctx); | 195 SSL* server = SSL_new(ctx); |
| 196 BIO* bio = BIO_new_socket(fd, 1 /* take ownership of fd */); | 196 BIO* bio = BIO_new_socket(fd, 1 /* take ownership of fd */); |
| 197 SSL_set_bio(server, bio, bio); | 197 SSL_set_bio(server, bio, bio); |
| 198 | 198 |
| 199 if (fail_resume) { | 199 if (fail_resume) { |
| 200 SSL_set_session_id_context(server, (unsigned char*) &connections, | 200 SSL_set_session_id_context( |
| 201 sizeof(connections)); | 201 server, (unsigned char*)&connections, sizeof(connections)); |
| 202 } | 202 } |
| 203 | 203 |
| 204 int err; | 204 int err; |
| 205 for (;;) { | 205 for (;;) { |
| 206 const int ret = SSL_accept(server); | 206 const int ret = SSL_accept(server); |
| 207 if (ret == 1) | 207 if (ret == 1) |
| 208 break; | 208 break; |
| 209 | 209 |
| 210 err = SSL_get_error(server, ret); | 210 err = SSL_get_error(server, ret); |
| 211 if (err == SSL_ERROR_WANT_READ) | 211 if (err == SSL_ERROR_WANT_READ) |
| 212 continue; | 212 continue; |
| 213 if (err == SSL_ERROR_SERVER_RANDOM_VALIDATION_PENDING && snap_start) { | 213 if (err == SSL_ERROR_SERVER_RANDOM_VALIDATION_PENDING && snap_start) { |
| 214 SSL_set_suggested_server_random_validity( | 214 SSL_set_suggested_server_random_validity(server, !snap_start_recovery); |
| 215 server, !snap_start_recovery); | |
| 216 continue; | 215 continue; |
| 217 } | 216 } |
| 218 ERR_print_errors_fp(stderr); | 217 ERR_print_errors_fp(stderr); |
| 219 fprintf(stderr, "SSL_accept failed: %d\n", err); | 218 fprintf(stderr, "SSL_accept failed: %d\n", err); |
| 220 return 1; | 219 return 1; |
| 221 } | 220 } |
| 222 | 221 |
| 223 if (sni && !sni_good) { | 222 if (sni && !sni_good) { |
| 224 fprintf(stderr, "SNI failed\n"); | 223 fprintf(stderr, "SNI failed\n"); |
| 225 return 1; | 224 return 1; |
| 226 } | 225 } |
| 227 | 226 |
| 228 if (npn) { | 227 if (npn) { |
| 229 const unsigned char *data, *expected_data; | 228 const unsigned char* data, *expected_data; |
| 230 unsigned len, expected_len; | 229 unsigned len, expected_len; |
| 231 SSL_get0_next_proto_negotiated(server, &data, &len); | 230 SSL_get0_next_proto_negotiated(server, &data, &len); |
| 232 if (!npn_mispredict || connections == 0) { | 231 if (!npn_mispredict || connections == 0) { |
| 233 expected_data = (unsigned char*) "foo"; | 232 expected_data = (unsigned char*)"foo"; |
| 234 expected_len = 3; | 233 expected_len = 3; |
| 235 } else { | 234 } else { |
| 236 expected_data = (unsigned char*) "baz"; | 235 expected_data = (unsigned char*)"baz"; |
| 237 expected_len = 3; | 236 expected_len = 3; |
| 238 } | 237 } |
| 239 if (len != expected_len || memcmp(data, expected_data, len) != 0) { | 238 if (len != expected_len || memcmp(data, expected_data, len) != 0) { |
| 240 fprintf(stderr, "Bad NPN: %d\n", len); | 239 fprintf(stderr, "Bad NPN: %d\n", len); |
| 241 return 1; | 240 return 1; |
| 242 } | 241 } |
| 243 } | 242 } |
| 244 | 243 |
| 245 unsigned char buffer[6]; | 244 unsigned char buffer[6]; |
| 246 | 245 |
| 247 int ret = SSL_read(server, buffer, sizeof(buffer)); | 246 int ret = SSL_read(server, buffer, sizeof(buffer)); |
| 248 if (ret == -1) { | 247 if (ret == -1) { |
| 249 err = SSL_get_error(server, ret); | 248 err = SSL_get_error(server, ret); |
| 250 ERR_print_errors_fp(stderr); | 249 ERR_print_errors_fp(stderr); |
| 251 fprintf(stderr, "SSL_read failed: %d\n", err); | 250 fprintf(stderr, "SSL_read failed: %d\n", err); |
| 252 } | 251 } |
| 253 if (memcmp(buffer, "hello!", sizeof(buffer)) == 0) { | 252 if (memcmp(buffer, "hello!", sizeof(buffer)) == 0) { |
| 254 SSL_write(server, "goodbye!", 8); | 253 SSL_write(server, "goodbye!", 8); |
| 255 } | 254 } |
| 256 | 255 |
| 257 SSL_shutdown(server); | 256 SSL_shutdown(server); |
| 258 SSL_shutdown(server); | 257 SSL_shutdown(server); |
| 259 } | 258 } |
| 260 | 259 |
| 261 SSL_CTX_free(ctx); | 260 SSL_CTX_free(ctx); |
| 262 | 261 |
| 263 return 0; | 262 return 0; |
| 264 } | 263 } |
| OLD | NEW |