| OLD | NEW | 
|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be | 
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. | 
| 4 | 4 | 
| 5 #include "net/tools/flip_server/spdy_ssl.h" | 5 #include "net/tools/flip_server/spdy_ssl.h" | 
| 6 | 6 | 
| 7 #include "base/logging.h" | 7 #include "base/logging.h" | 
| 8 #include "openssl/err.h" | 8 #include "openssl/err.h" | 
| 9 #include "openssl/ssl.h" | 9 #include "openssl/ssl.h" | 
| 10 | 10 | 
| 11 namespace net { | 11 namespace net { | 
| 12 | 12 | 
| 13 #define NEXT_PROTO_STRING "\x06spdy/2\x08http/1.1\x08http/1.0" | 13 #define NEXT_PROTO_STRING "\x06spdy/2\x08http/1.1\x08http/1.0" | 
| 14 #define SSL_CIPHER_LIST "!aNULL:!ADH:!eNull:!LOW:!EXP:RC4+RSA:MEDIUM:HIGH" | 14 #define SSL_CIPHER_LIST "!aNULL:!ADH:!eNull:!LOW:!EXP:RC4+RSA:MEDIUM:HIGH" | 
| 15 | 15 | 
| 16 int ssl_set_npn_callback(SSL *s, | 16 int ssl_set_npn_callback(SSL* s, | 
| 17                          const unsigned char **data, | 17                          const unsigned char** data, | 
| 18                          unsigned int *len, | 18                          unsigned int* len, | 
| 19                          void *arg) { | 19                          void* arg) { | 
| 20   VLOG(1) <<  "SSL NPN callback: advertising protocols."; | 20   VLOG(1) << "SSL NPN callback: advertising protocols."; | 
| 21   *data = (const unsigned char *) NEXT_PROTO_STRING; | 21   *data = (const unsigned char*)NEXT_PROTO_STRING; | 
| 22   *len = strlen(NEXT_PROTO_STRING); | 22   *len = strlen(NEXT_PROTO_STRING); | 
| 23   return SSL_TLSEXT_ERR_OK; | 23   return SSL_TLSEXT_ERR_OK; | 
| 24 } | 24 } | 
| 25 | 25 | 
| 26 void InitSSL(SSLState* state, | 26 void InitSSL(SSLState* state, | 
| 27              std::string ssl_cert_name, | 27              std::string ssl_cert_name, | 
| 28              std::string ssl_key_name, | 28              std::string ssl_key_name, | 
| 29              bool use_npn, | 29              bool use_npn, | 
| 30              int session_expiration_time, | 30              int session_expiration_time, | 
| 31              bool disable_ssl_compression) { | 31              bool disable_ssl_compression) { | 
| (...skipping 12 matching lines...) Expand all  Loading... | 
| 44     LOG(FATAL) << "Unable to create SSL context"; | 44     LOG(FATAL) << "Unable to create SSL context"; | 
| 45   } | 45   } | 
| 46   // Disable SSLv2 support. | 46   // Disable SSLv2 support. | 
| 47   SSL_CTX_set_options(state->ssl_ctx, | 47   SSL_CTX_set_options(state->ssl_ctx, | 
| 48                       SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE); | 48                       SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE); | 
| 49   if (SSL_CTX_use_certificate_chain_file(state->ssl_ctx, | 49   if (SSL_CTX_use_certificate_chain_file(state->ssl_ctx, | 
| 50                                          ssl_cert_name.c_str()) <= 0) { | 50                                          ssl_cert_name.c_str()) <= 0) { | 
| 51     PrintSslError(); | 51     PrintSslError(); | 
| 52     LOG(FATAL) << "Unable to use cert.pem as SSL cert."; | 52     LOG(FATAL) << "Unable to use cert.pem as SSL cert."; | 
| 53   } | 53   } | 
| 54   if (SSL_CTX_use_PrivateKey_file(state->ssl_ctx, | 54   if (SSL_CTX_use_PrivateKey_file( | 
| 55                                   ssl_key_name.c_str(), | 55           state->ssl_ctx, ssl_key_name.c_str(), SSL_FILETYPE_PEM) <= 0) { | 
| 56                                   SSL_FILETYPE_PEM) <= 0) { |  | 
| 57     PrintSslError(); | 56     PrintSslError(); | 
| 58     LOG(FATAL) << "Unable to use key.pem as SSL key."; | 57     LOG(FATAL) << "Unable to use key.pem as SSL key."; | 
| 59   } | 58   } | 
| 60   if (!SSL_CTX_check_private_key(state->ssl_ctx)) { | 59   if (!SSL_CTX_check_private_key(state->ssl_ctx)) { | 
| 61     PrintSslError(); | 60     PrintSslError(); | 
| 62     LOG(FATAL) << "The cert.pem and key.pem files don't match"; | 61     LOG(FATAL) << "The cert.pem and key.pem files don't match"; | 
| 63   } | 62   } | 
| 64   if (use_npn) { | 63   if (use_npn) { | 
| 65     SSL_CTX_set_next_protos_advertised_cb(state->ssl_ctx, | 64     SSL_CTX_set_next_protos_advertised_cb( | 
| 66                                           ssl_set_npn_callback, NULL); | 65         state->ssl_ctx, ssl_set_npn_callback, NULL); | 
| 67   } | 66   } | 
| 68   VLOG(1) << "SSL CTX default cipher list: " << SSL_CIPHER_LIST; | 67   VLOG(1) << "SSL CTX default cipher list: " << SSL_CIPHER_LIST; | 
| 69   SSL_CTX_set_cipher_list(state->ssl_ctx, SSL_CIPHER_LIST); | 68   SSL_CTX_set_cipher_list(state->ssl_ctx, SSL_CIPHER_LIST); | 
| 70 | 69 | 
| 71   VLOG(1) << "SSL CTX session expiry: " << session_expiration_time | 70   VLOG(1) << "SSL CTX session expiry: " << session_expiration_time | 
| 72           << " seconds"; | 71           << " seconds"; | 
| 73   SSL_CTX_set_timeout(state->ssl_ctx, session_expiration_time); | 72   SSL_CTX_set_timeout(state->ssl_ctx, session_expiration_time); | 
| 74 | 73 | 
| 75 #ifdef SSL_MODE_RELEASE_BUFFERS | 74 #ifdef SSL_MODE_RELEASE_BUFFERS | 
| 76   VLOG(1) << "SSL CTX: Setting Release Buffers mode."; | 75   VLOG(1) << "SSL CTX: Setting Release Buffers mode."; | 
| 77   SSL_CTX_set_mode(state->ssl_ctx, SSL_MODE_RELEASE_BUFFERS); | 76   SSL_CTX_set_mode(state->ssl_ctx, SSL_MODE_RELEASE_BUFFERS); | 
| 78 #endif | 77 #endif | 
| 79 | 78 | 
| 80   // Proper methods to disable compression don't exist until 0.9.9+. For now | 79   // Proper methods to disable compression don't exist until 0.9.9+. For now | 
| 81   // we must manipulate the stack of compression methods directly. | 80   // we must manipulate the stack of compression methods directly. | 
| 82   if (disable_ssl_compression) { | 81   if (disable_ssl_compression) { | 
| 83     STACK_OF(SSL_COMP) *ssl_comp_methods = SSL_COMP_get_compression_methods(); | 82     STACK_OF(SSL_COMP)* ssl_comp_methods = SSL_COMP_get_compression_methods(); | 
| 84     int num_methods = sk_SSL_COMP_num(ssl_comp_methods); | 83     int num_methods = sk_SSL_COMP_num(ssl_comp_methods); | 
| 85     int i; | 84     int i; | 
| 86     for (i = 0; i < num_methods; i++) { | 85     for (i = 0; i < num_methods; i++) { | 
| 87       static_cast<void>(sk_SSL_COMP_delete(ssl_comp_methods, i)); | 86       static_cast<void>(sk_SSL_COMP_delete(ssl_comp_methods, i)); | 
| 88     } | 87     } | 
| 89   } | 88   } | 
| 90 } | 89 } | 
| 91 | 90 | 
| 92 SSL* CreateSSLContext(SSL_CTX* ssl_ctx) { | 91 SSL* CreateSSLContext(SSL_CTX* ssl_ctx) { | 
| 93   SSL* ssl = SSL_new(ssl_ctx); | 92   SSL* ssl = SSL_new(ssl_ctx); | 
| 94   SSL_set_accept_state(ssl); | 93   SSL_set_accept_state(ssl); | 
| 95   PrintSslError(); | 94   PrintSslError(); | 
| 96   return ssl; | 95   return ssl; | 
| 97 } | 96 } | 
| 98 | 97 | 
| 99 void PrintSslError() { | 98 void PrintSslError() { | 
| 100   char buf[128];  // this buffer must be at least 120 chars long. | 99   char buf[128];  // this buffer must be at least 120 chars long. | 
| 101   int error_num = ERR_get_error(); | 100   int error_num = ERR_get_error(); | 
| 102   while (error_num != 0) { | 101   while (error_num != 0) { | 
| 103     ERR_error_string_n(error_num, buf, sizeof(buf)); | 102     ERR_error_string_n(error_num, buf, sizeof(buf)); | 
| 104     LOG(ERROR) << buf; | 103     LOG(ERROR) << buf; | 
| 105     error_num = ERR_get_error(); | 104     error_num = ERR_get_error(); | 
| 106   } | 105   } | 
| 107 } | 106 } | 
| 108 | 107 | 
| 109 }  // namespace net | 108 }  // namespace net | 
| 110 |  | 
| OLD | NEW | 
|---|