1 /*
2 * nghttp2 - HTTP/2 C Library
3 *
4 * Copyright (c) 2015 Tatsuhiro Tsujikawa
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining
7 * a copy of this software and associated documentation files (the
8 * "Software"), to deal in the Software without restriction, including
9 * without limitation the rights to use, copy, modify, merge, publish,
10 * distribute, sublicense, and/or sell copies of the Software, and to
11 * permit persons to whom the Software is furnished to do so, subject to
12 * the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be
15 * included in all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
18 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
19 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
20 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
21 * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
22 * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
23 * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
24 */
25 #include "asio_server_tls_context.h"
26
27 #include <openssl/ssl.h>
28
29 #include <boost/asio/ssl.hpp>
30
31 #include "tls.h"
32 #include "util.h"
33
34 namespace nghttp2 {
35 namespace asio_http2 {
36 namespace server {
37
38 #ifndef OPENSSL_NO_NEXTPROTONEG
39 namespace {
get_alpn_token()40 std::vector<unsigned char> &get_alpn_token() {
41 static auto alpn_token = util::get_default_alpn();
42 return alpn_token;
43 }
44 } // namespace
45 #endif // !OPENSSL_NO_NEXTPROTONEG
46
47 #if OPENSSL_VERSION_NUMBER >= 0x10002000L
48 namespace {
alpn_select_proto_cb(SSL * ssl,const unsigned char ** out,unsigned char * outlen,const unsigned char * in,unsigned int inlen,void * arg)49 int alpn_select_proto_cb(SSL *ssl, const unsigned char **out,
50 unsigned char *outlen, const unsigned char *in,
51 unsigned int inlen, void *arg) {
52 if (!util::select_h2(out, outlen, in, inlen)) {
53 return SSL_TLSEXT_ERR_NOACK;
54 }
55 return SSL_TLSEXT_ERR_OK;
56 }
57 } // namespace
58 #endif // OPENSSL_VERSION_NUMBER >= 0x10002000L
59
60 boost::system::error_code
configure_tls_context_easy(boost::system::error_code & ec,boost::asio::ssl::context & tls_context)61 configure_tls_context_easy(boost::system::error_code &ec,
62 boost::asio::ssl::context &tls_context) {
63 ec.clear();
64
65 auto ctx = tls_context.native_handle();
66
67 auto ssl_opts = (SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) |
68 SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION |
69 SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION |
70 SSL_OP_SINGLE_ECDH_USE | SSL_OP_NO_TICKET |
71 SSL_OP_CIPHER_SERVER_PREFERENCE;
72
73 SSL_CTX_set_options(ctx, ssl_opts);
74 SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
75 SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS);
76
77 SSL_CTX_set_cipher_list(ctx, tls::DEFAULT_CIPHER_LIST);
78
79 #ifndef OPENSSL_NO_EC
80 auto ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
81 if (ecdh) {
82 SSL_CTX_set_tmp_ecdh(ctx, ecdh);
83 EC_KEY_free(ecdh);
84 }
85 #endif /* OPENSSL_NO_EC */
86
87 #ifndef OPENSSL_NO_NEXTPROTONEG
88 SSL_CTX_set_next_protos_advertised_cb(
89 ctx,
90 [](SSL *s, const unsigned char **data, unsigned int *len, void *arg) {
91 auto &token = get_alpn_token();
92
93 *data = token.data();
94 *len = token.size();
95
96 return SSL_TLSEXT_ERR_OK;
97 },
98 nullptr);
99 #endif // !OPENSSL_NO_NEXTPROTONEG
100
101 #if OPENSSL_VERSION_NUMBER >= 0x10002000L
102 // ALPN selection callback
103 SSL_CTX_set_alpn_select_cb(ctx, alpn_select_proto_cb, nullptr);
104 #endif // OPENSSL_VERSION_NUMBER >= 0x10002000L
105
106 return ec;
107 }
108
109 } // namespace server
110 } // namespace asio_http2
111 } // namespace nghttp2
112