| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/tools/flip_server/spdy_ssl.h" | 5 #include "net/tools/flip_server/spdy_ssl.h" |
| 6 | 6 |
| 7 #include "base/logging.h" | 7 #include "base/logging.h" |
| 8 #include "openssl/err.h" | 8 #include "openssl/err.h" |
| 9 #include "openssl/ssl.h" | 9 #include "openssl/ssl.h" |
| 10 | 10 |
| 11 namespace net { | 11 namespace net { |
| 12 | 12 |
| 13 // Each element consists of <the length of the string><string> . | 13 // Each element consists of <the length of the string><string> . |
| 14 #define NEXT_PROTO_STRING \ | 14 #define NEXT_PROTO_STRING \ |
| 15 "\x08spdy/4a2" \ | 15 "\x08spdy/4a2" \ |
| 16 "\x06spdy/3" \ | 16 "\x06spdy/3" \ |
| 17 "\x06spdy/2" \ | 17 "\x06spdy/2" \ |
| 18 "\x08http/1.1" \ | 18 "\x08http/1.1" \ |
| 19 "\x08http/1.0" | 19 "\x08http/1.0" |
| 20 #define SSL_CIPHER_LIST "!aNULL:!ADH:!eNull:!LOW:!EXP:RC4+RSA:MEDIUM:HIGH" | 20 #define SSL_CIPHER_LIST "!aNULL:!ADH:!eNull:!LOW:!EXP:RC4+RSA:MEDIUM:HIGH" |
| 21 | 21 |
| 22 int ssl_set_npn_callback(SSL *s, | 22 int ssl_set_npn_callback(SSL* s, |
| 23 const unsigned char **data, | 23 const unsigned char** data, |
| 24 unsigned int *len, | 24 unsigned int* len, |
| 25 void *arg) { | 25 void* arg) { |
| 26 VLOG(1) << "SSL NPN callback: advertising protocols."; | 26 VLOG(1) << "SSL NPN callback: advertising protocols."; |
| 27 *data = (const unsigned char *) NEXT_PROTO_STRING; | 27 *data = (const unsigned char*)NEXT_PROTO_STRING; |
| 28 *len = strlen(NEXT_PROTO_STRING); | 28 *len = strlen(NEXT_PROTO_STRING); |
| 29 return SSL_TLSEXT_ERR_OK; | 29 return SSL_TLSEXT_ERR_OK; |
| 30 } | 30 } |
| 31 | 31 |
| 32 void InitSSL(SSLState* state, | 32 void InitSSL(SSLState* state, |
| 33 std::string ssl_cert_name, | 33 std::string ssl_cert_name, |
| 34 std::string ssl_key_name, | 34 std::string ssl_key_name, |
| 35 bool use_npn, | 35 bool use_npn, |
| 36 int session_expiration_time, | 36 int session_expiration_time, |
| 37 bool disable_ssl_compression) { | 37 bool disable_ssl_compression) { |
| (...skipping 12 matching lines...) Expand all Loading... |
| 50 LOG(FATAL) << "Unable to create SSL context"; | 50 LOG(FATAL) << "Unable to create SSL context"; |
| 51 } | 51 } |
| 52 // Disable SSLv2 support. | 52 // Disable SSLv2 support. |
| 53 SSL_CTX_set_options(state->ssl_ctx, | 53 SSL_CTX_set_options(state->ssl_ctx, |
| 54 SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE); | 54 SSL_OP_NO_SSLv2 | SSL_OP_CIPHER_SERVER_PREFERENCE); |
| 55 if (SSL_CTX_use_certificate_chain_file(state->ssl_ctx, | 55 if (SSL_CTX_use_certificate_chain_file(state->ssl_ctx, |
| 56 ssl_cert_name.c_str()) <= 0) { | 56 ssl_cert_name.c_str()) <= 0) { |
| 57 PrintSslError(); | 57 PrintSslError(); |
| 58 LOG(FATAL) << "Unable to use cert.pem as SSL cert."; | 58 LOG(FATAL) << "Unable to use cert.pem as SSL cert."; |
| 59 } | 59 } |
| 60 if (SSL_CTX_use_PrivateKey_file(state->ssl_ctx, | 60 if (SSL_CTX_use_PrivateKey_file( |
| 61 ssl_key_name.c_str(), | 61 state->ssl_ctx, ssl_key_name.c_str(), SSL_FILETYPE_PEM) <= 0) { |
| 62 SSL_FILETYPE_PEM) <= 0) { | |
| 63 PrintSslError(); | 62 PrintSslError(); |
| 64 LOG(FATAL) << "Unable to use key.pem as SSL key."; | 63 LOG(FATAL) << "Unable to use key.pem as SSL key."; |
| 65 } | 64 } |
| 66 if (!SSL_CTX_check_private_key(state->ssl_ctx)) { | 65 if (!SSL_CTX_check_private_key(state->ssl_ctx)) { |
| 67 PrintSslError(); | 66 PrintSslError(); |
| 68 LOG(FATAL) << "The cert.pem and key.pem files don't match"; | 67 LOG(FATAL) << "The cert.pem and key.pem files don't match"; |
| 69 } | 68 } |
| 70 if (use_npn) { | 69 if (use_npn) { |
| 71 SSL_CTX_set_next_protos_advertised_cb(state->ssl_ctx, | 70 SSL_CTX_set_next_protos_advertised_cb( |
| 72 ssl_set_npn_callback, NULL); | 71 state->ssl_ctx, ssl_set_npn_callback, NULL); |
| 73 } | 72 } |
| 74 VLOG(1) << "SSL CTX default cipher list: " << SSL_CIPHER_LIST; | 73 VLOG(1) << "SSL CTX default cipher list: " << SSL_CIPHER_LIST; |
| 75 SSL_CTX_set_cipher_list(state->ssl_ctx, SSL_CIPHER_LIST); | 74 SSL_CTX_set_cipher_list(state->ssl_ctx, SSL_CIPHER_LIST); |
| 76 | 75 |
| 77 VLOG(1) << "SSL CTX session expiry: " << session_expiration_time | 76 VLOG(1) << "SSL CTX session expiry: " << session_expiration_time |
| 78 << " seconds"; | 77 << " seconds"; |
| 79 SSL_CTX_set_timeout(state->ssl_ctx, session_expiration_time); | 78 SSL_CTX_set_timeout(state->ssl_ctx, session_expiration_time); |
| 80 | 79 |
| 81 #ifdef SSL_MODE_RELEASE_BUFFERS | 80 #ifdef SSL_MODE_RELEASE_BUFFERS |
| 82 VLOG(1) << "SSL CTX: Setting Release Buffers mode."; | 81 VLOG(1) << "SSL CTX: Setting Release Buffers mode."; |
| 83 SSL_CTX_set_mode(state->ssl_ctx, SSL_MODE_RELEASE_BUFFERS); | 82 SSL_CTX_set_mode(state->ssl_ctx, SSL_MODE_RELEASE_BUFFERS); |
| 84 #endif | 83 #endif |
| 85 | 84 |
| 86 // Proper methods to disable compression don't exist until 0.9.9+. For now | 85 // Proper methods to disable compression don't exist until 0.9.9+. For now |
| 87 // we must manipulate the stack of compression methods directly. | 86 // we must manipulate the stack of compression methods directly. |
| 88 if (disable_ssl_compression) { | 87 if (disable_ssl_compression) { |
| 89 STACK_OF(SSL_COMP) *ssl_comp_methods = SSL_COMP_get_compression_methods(); | 88 STACK_OF(SSL_COMP)* ssl_comp_methods = SSL_COMP_get_compression_methods(); |
| 90 int num_methods = sk_SSL_COMP_num(ssl_comp_methods); | 89 int num_methods = sk_SSL_COMP_num(ssl_comp_methods); |
| 91 int i; | 90 int i; |
| 92 for (i = 0; i < num_methods; i++) { | 91 for (i = 0; i < num_methods; i++) { |
| 93 static_cast<void>(sk_SSL_COMP_delete(ssl_comp_methods, i)); | 92 static_cast<void>(sk_SSL_COMP_delete(ssl_comp_methods, i)); |
| 94 } | 93 } |
| 95 } | 94 } |
| 96 } | 95 } |
| 97 | 96 |
| 98 SSL* CreateSSLContext(SSL_CTX* ssl_ctx) { | 97 SSL* CreateSSLContext(SSL_CTX* ssl_ctx) { |
| 99 SSL* ssl = SSL_new(ssl_ctx); | 98 SSL* ssl = SSL_new(ssl_ctx); |
| 100 SSL_set_accept_state(ssl); | 99 SSL_set_accept_state(ssl); |
| 101 PrintSslError(); | 100 PrintSslError(); |
| 102 return ssl; | 101 return ssl; |
| 103 } | 102 } |
| 104 | 103 |
| 105 void PrintSslError() { | 104 void PrintSslError() { |
| 106 char buf[128]; // this buffer must be at least 120 chars long. | 105 char buf[128]; // this buffer must be at least 120 chars long. |
| 107 int error_num = ERR_get_error(); | 106 int error_num = ERR_get_error(); |
| 108 while (error_num != 0) { | 107 while (error_num != 0) { |
| 109 ERR_error_string_n(error_num, buf, sizeof(buf)); | 108 ERR_error_string_n(error_num, buf, sizeof(buf)); |
| 110 LOG(ERROR) << buf; | 109 LOG(ERROR) << buf; |
| 111 error_num = ERR_get_error(); | 110 error_num = ERR_get_error(); |
| 112 } | 111 } |
| 113 } | 112 } |
| 114 | 113 |
| 115 } // namespace net | 114 } // namespace net |
| OLD | NEW |