| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/tools/flip_server/spdy_ssl.h" | 5 #include "net/tools/flip_server/spdy_ssl.h" |
| 6 | 6 |
| 7 #include "base/logging.h" | 7 #include "base/logging.h" |
| 8 #include "openssl/err.h" | 8 #include "openssl/err.h" |
| 9 #include "openssl/ssl.h" | 9 #include "openssl/ssl.h" |
| 10 | 10 |
| 11 namespace net { | 11 namespace net { |
| 12 | 12 |
| 13 #define NEXT_PROTO_STRING "\x06spdy/2\x08http/1.1\x08http/1.0" | 13 #define NEXT_PROTO_STRING "\x06spdy/2\x08http/1.1\x08http/1.0" |
| 14 #define SSL_CIPHER_LIST "!aNULL:!ADH:!eNull:!LOW:!EXP:RC4+RSA:MEDIUM:HIGH" | 14 #define SSL_CIPHER_LIST "!aNULL:!ADH:!eNull:!LOW:!EXP:RC4+RSA:MEDIUM:HIGH" |
| 15 | 15 |
| 16 int ssl_set_npn_callback(SSL *s, | 16 int ssl_set_npn_callback(SSL* s, |
| 17 const unsigned char **data, | 17 const unsigned char** data, |
| 18 unsigned int *len, | 18 unsigned int* len, |
| 19 void *arg) { | 19 void* arg) { |
| 20 VLOG(1) << "SSL NPN callback: advertising protocols."; | 20 VLOG(1) << "SSL NPN callback: advertising protocols."; |
| 21 *data = (const unsigned char *) NEXT_PROTO_STRING; | 21 *data = (const unsigned char*)NEXT_PROTO_STRING; |
| 22 *len = strlen(NEXT_PROTO_STRING); | 22 *len = strlen(NEXT_PROTO_STRING); |
| 23 return SSL_TLSEXT_ERR_OK; | 23 return SSL_TLSEXT_ERR_OK; |
| 24 } | 24 } |
| 25 | 25 |
| 26 void InitSSL(SSLState* state, | 26 void InitSSL(SSLState* state, |
| 27 std::string ssl_cert_name, | 27 std::string ssl_cert_name, |
| 28 std::string ssl_key_name, | 28 std::string ssl_key_name, |
| 29 bool use_npn, | 29 bool use_npn, |
| 30 int session_expiration_time, | 30 int session_expiration_time, |
| 31 bool disable_ssl_compression) { | 31 bool disable_ssl_compression) { |
| (...skipping 12 matching lines...) Expand all Loading... |
| 44 LOG(FATAL) << "Unable to create SSL context"; | 44 LOG(FATAL) << "Unable to create SSL context"; |
| 45 } | 45 } |
| 46 // Disable SSLv2 support. | 46 // Disable SSLv2 support. |
| 47 SSL_CTX_set_options(state->ssl_ctx, | 47 SSL_CTX_set_options(state->ssl_ctx, |
| 48 SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE); | 48 SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE); |
| 49 if (SSL_CTX_use_certificate_chain_file(state->ssl_ctx, | 49 if (SSL_CTX_use_certificate_chain_file(state->ssl_ctx, |
| 50 ssl_cert_name.c_str()) <= 0) { | 50 ssl_cert_name.c_str()) <= 0) { |
| 51 PrintSslError(); | 51 PrintSslError(); |
| 52 LOG(FATAL) << "Unable to use cert.pem as SSL cert."; | 52 LOG(FATAL) << "Unable to use cert.pem as SSL cert."; |
| 53 } | 53 } |
| 54 if (SSL_CTX_use_PrivateKey_file(state->ssl_ctx, | 54 if (SSL_CTX_use_PrivateKey_file( |
| 55 ssl_key_name.c_str(), | 55 state->ssl_ctx, ssl_key_name.c_str(), SSL_FILETYPE_PEM) <= 0) { |
| 56 SSL_FILETYPE_PEM) <= 0) { | |
| 57 PrintSslError(); | 56 PrintSslError(); |
| 58 LOG(FATAL) << "Unable to use key.pem as SSL key."; | 57 LOG(FATAL) << "Unable to use key.pem as SSL key."; |
| 59 } | 58 } |
| 60 if (!SSL_CTX_check_private_key(state->ssl_ctx)) { | 59 if (!SSL_CTX_check_private_key(state->ssl_ctx)) { |
| 61 PrintSslError(); | 60 PrintSslError(); |
| 62 LOG(FATAL) << "The cert.pem and key.pem files don't match"; | 61 LOG(FATAL) << "The cert.pem and key.pem files don't match"; |
| 63 } | 62 } |
| 64 if (use_npn) { | 63 if (use_npn) { |
| 65 SSL_CTX_set_next_protos_advertised_cb(state->ssl_ctx, | 64 SSL_CTX_set_next_protos_advertised_cb( |
| 66 ssl_set_npn_callback, NULL); | 65 state->ssl_ctx, ssl_set_npn_callback, NULL); |
| 67 } | 66 } |
| 68 VLOG(1) << "SSL CTX default cipher list: " << SSL_CIPHER_LIST; | 67 VLOG(1) << "SSL CTX default cipher list: " << SSL_CIPHER_LIST; |
| 69 SSL_CTX_set_cipher_list(state->ssl_ctx, SSL_CIPHER_LIST); | 68 SSL_CTX_set_cipher_list(state->ssl_ctx, SSL_CIPHER_LIST); |
| 70 | 69 |
| 71 VLOG(1) << "SSL CTX session expiry: " << session_expiration_time | 70 VLOG(1) << "SSL CTX session expiry: " << session_expiration_time |
| 72 << " seconds"; | 71 << " seconds"; |
| 73 SSL_CTX_set_timeout(state->ssl_ctx, session_expiration_time); | 72 SSL_CTX_set_timeout(state->ssl_ctx, session_expiration_time); |
| 74 | 73 |
| 75 #ifdef SSL_MODE_RELEASE_BUFFERS | 74 #ifdef SSL_MODE_RELEASE_BUFFERS |
| 76 VLOG(1) << "SSL CTX: Setting Release Buffers mode."; | 75 VLOG(1) << "SSL CTX: Setting Release Buffers mode."; |
| 77 SSL_CTX_set_mode(state->ssl_ctx, SSL_MODE_RELEASE_BUFFERS); | 76 SSL_CTX_set_mode(state->ssl_ctx, SSL_MODE_RELEASE_BUFFERS); |
| 78 #endif | 77 #endif |
| 79 | 78 |
| 80 // Proper methods to disable compression don't exist until 0.9.9+. For now | 79 // Proper methods to disable compression don't exist until 0.9.9+. For now |
| 81 // we must manipulate the stack of compression methods directly. | 80 // we must manipulate the stack of compression methods directly. |
| 82 if (disable_ssl_compression) { | 81 if (disable_ssl_compression) { |
| 83 STACK_OF(SSL_COMP) *ssl_comp_methods = SSL_COMP_get_compression_methods(); | 82 STACK_OF(SSL_COMP)* ssl_comp_methods = SSL_COMP_get_compression_methods(); |
| 84 int num_methods = sk_SSL_COMP_num(ssl_comp_methods); | 83 int num_methods = sk_SSL_COMP_num(ssl_comp_methods); |
| 85 int i; | 84 int i; |
| 86 for (i = 0; i < num_methods; i++) { | 85 for (i = 0; i < num_methods; i++) { |
| 87 static_cast<void>(sk_SSL_COMP_delete(ssl_comp_methods, i)); | 86 static_cast<void>(sk_SSL_COMP_delete(ssl_comp_methods, i)); |
| 88 } | 87 } |
| 89 } | 88 } |
| 90 } | 89 } |
| 91 | 90 |
| 92 SSL* CreateSSLContext(SSL_CTX* ssl_ctx) { | 91 SSL* CreateSSLContext(SSL_CTX* ssl_ctx) { |
| 93 SSL* ssl = SSL_new(ssl_ctx); | 92 SSL* ssl = SSL_new(ssl_ctx); |
| 94 SSL_set_accept_state(ssl); | 93 SSL_set_accept_state(ssl); |
| 95 PrintSslError(); | 94 PrintSslError(); |
| 96 return ssl; | 95 return ssl; |
| 97 } | 96 } |
| 98 | 97 |
| 99 void PrintSslError() { | 98 void PrintSslError() { |
| 100 char buf[128]; // this buffer must be at least 120 chars long. | 99 char buf[128]; // this buffer must be at least 120 chars long. |
| 101 int error_num = ERR_get_error(); | 100 int error_num = ERR_get_error(); |
| 102 while (error_num != 0) { | 101 while (error_num != 0) { |
| 103 ERR_error_string_n(error_num, buf, sizeof(buf)); | 102 ERR_error_string_n(error_num, buf, sizeof(buf)); |
| 104 LOG(ERROR) << buf; | 103 LOG(ERROR) << buf; |
| 105 error_num = ERR_get_error(); | 104 error_num = ERR_get_error(); |
| 106 } | 105 } |
| 107 } | 106 } |
| 108 | 107 |
| 109 } // namespace net | 108 } // namespace net |
| 110 | |
| OLD | NEW |