1 /* Copyright (c) 2014, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/base.h>
16
17 #include <openssl/err.h>
18 #include <openssl/ssl.h>
19
20 #include "internal.h"
21 #include "transport_common.h"
22
23
24 static const struct argument kArguments[] = {
25 {
26 "-accept", kRequiredArgument,
27 "The port of the server to bind on; eg 45102",
28 },
29 {
30 "-cipher", kOptionalArgument,
31 "An OpenSSL-style cipher suite string that configures the offered ciphers",
32 },
33 {
34 "-key", kOptionalArgument,
35 "Private-key file to use (default is server.pem)",
36 },
37 {
38 "-ocsp-response", kOptionalArgument,
39 "OCSP response file to send",
40 },
41 {
42 "", kOptionalArgument, "",
43 },
44 };
45
LoadOCSPResponse(SSL_CTX * ctx,const char * filename)46 static bool LoadOCSPResponse(SSL_CTX *ctx, const char *filename) {
47 void *data = NULL;
48 bool ret = false;
49 size_t bytes_read;
50 long length;
51
52 FILE *f = fopen(filename, "rb");
53
54 if (f == NULL ||
55 fseek(f, 0, SEEK_END) != 0) {
56 goto out;
57 }
58
59 length = ftell(f);
60 if (length < 0) {
61 goto out;
62 }
63
64 data = malloc(length);
65 if (data == NULL) {
66 goto out;
67 }
68 rewind(f);
69
70 bytes_read = fread(data, 1, length, f);
71 if (ferror(f) != 0 ||
72 bytes_read != (size_t)length ||
73 !SSL_CTX_set_ocsp_response(ctx, (uint8_t*)data, bytes_read)) {
74 goto out;
75 }
76
77 ret = true;
78 out:
79 if (f != NULL) {
80 fclose(f);
81 }
82 free(data);
83 return ret;
84 }
85
Server(const std::vector<std::string> & args)86 bool Server(const std::vector<std::string> &args) {
87 if (!InitSocketLibrary()) {
88 return false;
89 }
90
91 std::map<std::string, std::string> args_map;
92
93 if (!ParseKeyValueArguments(&args_map, args, kArguments)) {
94 PrintUsage(kArguments);
95 return false;
96 }
97
98 SSL_CTX *ctx = SSL_CTX_new(SSLv23_server_method());
99 SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3);
100
101 // Server authentication is required.
102 std::string key_file = "server.pem";
103 if (args_map.count("-key") != 0) {
104 key_file = args_map["-key"];
105 }
106 if (!SSL_CTX_use_PrivateKey_file(ctx, key_file.c_str(), SSL_FILETYPE_PEM)) {
107 fprintf(stderr, "Failed to load private key: %s\n", key_file.c_str());
108 return false;
109 }
110 if (!SSL_CTX_use_certificate_chain_file(ctx, key_file.c_str())) {
111 fprintf(stderr, "Failed to load cert chain: %s\n", key_file.c_str());
112 return false;
113 }
114
115 if (args_map.count("-cipher") != 0 &&
116 !SSL_CTX_set_cipher_list(ctx, args_map["-cipher"].c_str())) {
117 fprintf(stderr, "Failed setting cipher list\n");
118 return false;
119 }
120
121 if (args_map.count("-ocsp-response") != 0 &&
122 !LoadOCSPResponse(ctx, args_map["-ocsp-response"].c_str())) {
123 fprintf(stderr, "Failed to load OCSP response: %s\n", args_map["-ocsp-response"].c_str());
124 return false;
125 }
126
127 int sock = -1;
128 if (!Accept(&sock, args_map["-accept"])) {
129 return false;
130 }
131
132 BIO *bio = BIO_new_socket(sock, BIO_CLOSE);
133 SSL *ssl = SSL_new(ctx);
134 SSL_set_bio(ssl, bio, bio);
135
136 int ret = SSL_accept(ssl);
137 if (ret != 1) {
138 int ssl_err = SSL_get_error(ssl, ret);
139 fprintf(stderr, "Error while connecting: %d\n", ssl_err);
140 ERR_print_errors_cb(PrintErrorCallback, stderr);
141 return false;
142 }
143
144 fprintf(stderr, "Connected.\n");
145 PrintConnectionInfo(ssl);
146
147 bool ok = TransferData(ssl, sock);
148
149 SSL_free(ssl);
150 SSL_CTX_free(ctx);
151 return ok;
152 }
153