1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // This helper binary is only used for testing Chrome's SSL stack. 6 7 #include <sys/types.h> 8 #include <sys/socket.h> 9 10 #include <openssl/bio.h> 11 #include <openssl/ssl.h> 12 #include <openssl/err.h> 13 14 static const char kDefaultPEMFile[] = "net/data/ssl/certificates/ok_cert.pem"; 15 16 // Server Name Indication callback from OpenSSL 17 static int sni_cb(SSL *s, int *ad, void *arg) { 18 const char* servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name); 19 if (servername && strcmp(servername, "test.example.com") == 0) 20 *reinterpret_cast<bool*>(arg) = true; 21 22 return SSL_TLSEXT_ERR_OK; 23 } 24 25 // Client certificate verification callback from OpenSSL 26 static int verify_cb(int preverify_ok, X509_STORE_CTX *ctx) { 27 return 1; 28 } 29 30 // Next Protocol Negotiation callback from OpenSSL 31 static int next_proto_cb(SSL *ssl, const unsigned char **out, 32 unsigned int *outlen, void *arg) { 33 bool* npn_mispredict = reinterpret_cast<bool*>(arg); 34 static char kProtos[] = "\003foo\003bar"; 35 static char kProtos2[] = "\003baz\003boo"; 36 static unsigned count = 0; 37 38 if (!*npn_mispredict || count == 0) { 39 *out = (const unsigned char*) kProtos; 40 *outlen = sizeof(kProtos) - 1; 41 } else { 42 *out = (const unsigned char*) kProtos2; 43 *outlen = sizeof(kProtos2) - 1; 44 } 45 count++; 46 return SSL_TLSEXT_ERR_OK; 47 } 48 49 int 50 main(int argc, char **argv) { 51 SSL_library_init(); 52 ERR_load_crypto_strings(); 53 OpenSSL_add_all_algorithms(); 54 SSL_load_error_strings(); 55 56 bool sni = false, sni_good = false, snap_start = false; 57 bool snap_start_recovery = false, sslv3 = false, session_tickets = false; 58 bool fail_resume = false, client_cert = false, npn = false; 59 bool npn_mispredict = false; 60 61 const char* key_file = kDefaultPEMFile; 62 const char* cert_file = kDefaultPEMFile; 63 64 for (int i = 1; i < argc; i++) { 65 if (strcmp(argv[i], "sni") == 0) { 66 // Require SNI 67 sni = true; 68 } else if (strcmp(argv[i], "snap-start") == 0) { 69 // Support Snap Start 70 snap_start = true; 71 } else if (strcmp(argv[i], "snap-start-recovery") == 0) { 72 // Support Snap Start, but always trigger a recovery 73 snap_start = true; 74 snap_start_recovery = true; 75 } else if (strcmp(argv[i], "sslv3") == 0) { 76 // Use SSLv3 77 sslv3 = true; 78 } else if (strcmp(argv[i], "session-tickets") == 0) { 79 // Enable Session Tickets 80 session_tickets = true; 81 } else if (strcmp(argv[i], "fail-resume") == 0) { 82 // Always fail to resume sessions 83 fail_resume = true; 84 } else if (strcmp(argv[i], "client-cert") == 0) { 85 // Request a client certificate 86 client_cert = true; 87 } else if (strcmp(argv[i], "npn") == 0) { 88 // Advertise NPN 89 npn = true; 90 } else if (strcmp(argv[i], "npn-mispredict") == 0) { 91 // Advertise NPN 92 npn = true; 93 npn_mispredict = true; 94 } else if (strcmp(argv[i], "--key-file") == 0) { 95 // Use alternative key file 96 i++; 97 if (i == argc) { 98 fprintf(stderr, "Missing argument to --key-file\n"); 99 return 1; 100 } 101 key_file = argv[i]; 102 } else if (strcmp(argv[i], "--cert-file") == 0) { 103 // Use alternative certificate file 104 i++; 105 if (i == argc) { 106 fprintf(stderr, "Missing argument to --cert-file\n"); 107 return 1; 108 } 109 cert_file = argv[i]; 110 } else { 111 fprintf(stderr, "Unknown argument: %s\n", argv[i]); 112 return 1; 113 } 114 } 115 116 SSL_CTX* ctx; 117 118 if (sslv3) { 119 ctx = SSL_CTX_new(SSLv3_server_method()); 120 } else { 121 ctx = SSL_CTX_new(TLSv1_server_method()); 122 } 123 124 if (sni) { 125 SSL_CTX_set_tlsext_servername_callback(ctx, sni_cb); 126 SSL_CTX_set_tlsext_servername_arg(ctx, &sni_good); 127 } 128 129 BIO* key = BIO_new(BIO_s_file()); 130 if (BIO_read_filename(key, key_file) <= 0) { 131 fprintf(stderr, "Failed to read %s\n", key_file); 132 return 1; 133 } 134 135 EVP_PKEY *pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, NULL); 136 if (!pkey) { 137 fprintf(stderr, "Failed to parse %s\n", key_file); 138 return 1; 139 } 140 BIO_free(key); 141 142 143 BIO* cert = BIO_new(BIO_s_file()); 144 if (BIO_read_filename(cert, cert_file) <= 0) { 145 fprintf(stderr, "Failed to read %s\n", cert_file); 146 return 1; 147 } 148 149 X509 *pcert = PEM_read_bio_X509_AUX(cert, NULL, NULL, NULL); 150 if (!pcert) { 151 fprintf(stderr, "Failed to parse %s\n", cert_file); 152 return 1; 153 } 154 BIO_free(cert); 155 156 if (SSL_CTX_use_certificate(ctx, pcert) <= 0) { 157 fprintf(stderr, "Failed to load %s\n", cert_file); 158 return 1; 159 } 160 161 if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) { 162 fprintf(stderr, "Failed to load %s\n", key_file); 163 return 1; 164 } 165 166 if (!SSL_CTX_check_private_key(ctx)) { 167 fprintf(stderr, "Public and private keys don't match\n"); 168 return 1; 169 } 170 171 if (client_cert) 172 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_cb); 173 174 if (session_tickets) 175 SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_BOTH); 176 177 if (snap_start) { 178 static const unsigned char orbit[8] = {1, 2, 3, 4, 5, 6, 7, 8}; 179 SSL_CTX_set_snap_start_orbit(ctx, orbit); 180 } 181 182 if (npn) 183 SSL_CTX_set_next_protos_advertised_cb(ctx, next_proto_cb, &npn_mispredict); 184 185 unsigned connection_limit = 1; 186 if (snap_start || session_tickets) 187 connection_limit = 2; 188 if (npn_mispredict) 189 connection_limit = 3; 190 191 for (unsigned connections = 0; connections < connection_limit; 192 connections++) { 193 const int fd = accept(3, NULL, NULL); 194 195 SSL* server = SSL_new(ctx); 196 BIO* bio = BIO_new_socket(fd, 1 /* take ownership of fd */); 197 SSL_set_bio(server, bio, bio); 198 199 if (fail_resume) { 200 SSL_set_session_id_context(server, (unsigned char*) &connections, 201 sizeof(connections)); 202 } 203 204 int err; 205 for (;;) { 206 const int ret = SSL_accept(server); 207 if (ret == 1) 208 break; 209 210 err = SSL_get_error(server, ret); 211 if (err == SSL_ERROR_WANT_READ) 212 continue; 213 if (err == SSL_ERROR_SERVER_RANDOM_VALIDATION_PENDING && snap_start) { 214 SSL_set_suggested_server_random_validity( 215 server, !snap_start_recovery); 216 continue; 217 } 218 ERR_print_errors_fp(stderr); 219 fprintf(stderr, "SSL_accept failed: %d\n", err); 220 return 1; 221 } 222 223 if (sni && !sni_good) { 224 fprintf(stderr, "SNI failed\n"); 225 return 1; 226 } 227 228 if (npn) { 229 const unsigned char *data, *expected_data; 230 unsigned len, expected_len; 231 SSL_get0_next_proto_negotiated(server, &data, &len); 232 if (!npn_mispredict || connections == 0) { 233 expected_data = (unsigned char*) "foo"; 234 expected_len = 3; 235 } else { 236 expected_data = (unsigned char*) "baz"; 237 expected_len = 3; 238 } 239 if (len != expected_len || memcmp(data, expected_data, len) != 0) { 240 fprintf(stderr, "Bad NPN: %d\n", len); 241 return 1; 242 } 243 } 244 245 unsigned char buffer[6]; 246 247 int ret = SSL_read(server, buffer, sizeof(buffer)); 248 if (ret == -1) { 249 err = SSL_get_error(server, ret); 250 ERR_print_errors_fp(stderr); 251 fprintf(stderr, "SSL_read failed: %d\n", err); 252 } 253 if (memcmp(buffer, "hello!", sizeof(buffer)) == 0) { 254 SSL_write(server, "goodbye!", 8); 255 } 256 257 SSL_shutdown(server); 258 SSL_shutdown(server); 259 } 260 261 SSL_CTX_free(ctx); 262 263 return 0; 264 } 265
