| /* |
| * SSL/TLS stress testing program |
| * |
| * Copyright (C) 2006-2007 Christophe Devine |
| * |
| * This program is free software; you can redistribute it and/or modify |
| * it under the terms of the GNU General Public License as published by |
| * the Free Software Foundation; either version 2 of the License, or |
| * (at your option) any later version. |
| * |
| * This program is distributed in the hope that it will be useful, |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| * GNU General Public License for more details. |
| * |
| * You should have received a copy of the GNU General Public License along |
| * with this program; if not, write to the Free Software Foundation, Inc., |
| * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| */ |
| |
| #ifndef _CRT_SECURE_NO_DEPRECATE |
| #define _CRT_SECURE_NO_DEPRECATE 1 |
| #endif |
| |
| #include <string.h> |
| #include <stdlib.h> |
| #include <stdio.h> |
| |
| #include "xyssl/net.h" |
| #include "xyssl/ssl.h" |
| #include "xyssl/havege.h" |
| #include "xyssl/timing.h" |
| #include "xyssl/certs.h" |
| |
| #define OPMODE_NONE 0 |
| #define OPMODE_CLIENT 1 |
| #define OPMODE_SERVER 2 |
| |
| #define IOMODE_BLOCK 0 |
| #define IOMODE_NONBLOCK 1 |
| |
| #define COMMAND_READ 1 |
| #define COMMAND_WRITE 2 |
| #define COMMAND_BOTH 3 |
| |
| #define DFL_OPMODE OPMODE_NONE |
| #define DFL_IOMODE IOMODE_BLOCK |
| #define DFL_SERVER_NAME "localhost" |
| #define DFL_SERVER_PORT 4433 |
| #define DFL_COMMAND COMMAND_READ |
| #define DFL_BUFFER_SIZE 1024 |
| #define DFL_MAX_BYTES 0 |
| #define DFL_DEBUG_LEVEL 0 |
| #define DFL_CONN_TIMEOUT 0 |
| #define DFL_MAX_CONNECTIONS 0 |
| #define DFL_SESSION_REUSE 1 |
| #define DFL_SESSION_LIFETIME 86400 |
| #define DFL_FORCE_CIPHER 0 |
| |
| /* |
| * server-specific data |
| */ |
| char *dhm_G = "4"; |
| char *dhm_P = |
| "E4004C1F94182000103D883A448B3F802CE4B44A83301270002C20D0321CFD00" \ |
| "11CCEF784C26A400F43DFB901BCA7538F2C6B176001CF5A0FD16D2C48B1D0C1C" \ |
| "F6AC8E1DA6BCC3B4E1F96B0564965300FFA1D0B601EB2800F489AA512C4B248C" \ |
| "01F76949A60BB7F00A40B1EAB64BDD48E8A700D60B7F1200FA8E77B0A979DABF"; |
| |
| int server_fd = -1; |
| |
| /* |
| * global options |
| */ |
| struct options |
| { |
| int opmode; /* operation mode (client or server) */ |
| int iomode; /* I/O mode (blocking or non-blocking) */ |
| char *server_name; /* hostname of the server (client only) */ |
| int server_port; /* port on which the ssl service runs */ |
| int command; /* what to do: read or write operation */ |
| int buffer_size; /* size of the send/receive buffer */ |
| int max_bytes; /* max. # of bytes before a reconnect */ |
| int debug_level; /* level of debugging */ |
| int conn_timeout; /* max. delay before a reconnect */ |
| int max_connections; /* max. number of reconnections */ |
| int session_reuse; /* flag to reuse the keying material */ |
| int session_lifetime; /* if reached, session data is expired */ |
| int force_cipher[2]; /* protocol/cipher to use, or all */ |
| }; |
| |
| /* |
| * Although this PRNG has good statistical properties (eg. passes |
| * DIEHARD), it is not cryptographically secure. |
| */ |
| unsigned long int lcppm5( unsigned long int *state ) |
| { |
| unsigned long int u, v; |
| |
| u = v = state[4] ^ 1; |
| state[u & 3] ^= u; |
| u ^= (v << 12) ^ (v >> 12); |
| u ^= v * state[0]; v >>= 8; |
| u ^= v * state[1]; v >>= 8; |
| u ^= v * state[2]; v >>= 8; |
| u ^= v * state[3]; |
| u &= 0xFFFFFFFF; |
| state[4] = u; |
| |
| return( u ); |
| } |
| |
| void my_debug( void *ctx, int level, char *str ) |
| { |
| if( level < ((struct options *) ctx)->debug_level ) |
| fprintf( stderr, "%s", str ); |
| } |
| |
| /* |
| * perform a single SSL connection |
| */ |
| static int ssl_test( struct options *opt ) |
| { |
| int ret, i; |
| int client_fd; |
| int bytes_to_read; |
| int bytes_to_write; |
| int offset_to_read; |
| int offset_to_write; |
| |
| long int nb_read; |
| long int nb_written; |
| |
| unsigned long read_state[5]; |
| unsigned long write_state[5]; |
| |
| unsigned char *read_buf; |
| unsigned char *write_buf; |
| |
| struct hr_time t; |
| havege_state hs; |
| ssl_context ssl; |
| ssl_session ssn; |
| x509_cert srvcert; |
| rsa_context rsa; |
| |
| ret = 1; |
| |
| havege_init( &hs ); |
| get_timer( &t, 1 ); |
| |
| memset( read_state, 0, sizeof( read_state ) ); |
| memset( write_state, 0, sizeof( write_state ) ); |
| |
| memset( &srvcert, 0, sizeof( x509_cert ) ); |
| memset( &rsa, 0, sizeof( rsa_context ) ); |
| |
| if( opt->opmode == OPMODE_CLIENT ) |
| { |
| if( ( ret = net_connect( &client_fd, opt->server_name, |
| opt->server_port ) ) != 0 ) |
| { |
| printf( " ! net_connect returned %d\n\n", ret ); |
| return( ret ); |
| } |
| |
| if( ( ret = ssl_init( &ssl ) ) != 0 ) |
| { |
| printf( " ! ssl_init returned %d\n\n", ret ); |
| return( ret ); |
| } |
| |
| ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); |
| } |
| |
| if( opt->opmode == OPMODE_SERVER ) |
| { |
| ret = x509parse_crt( &srvcert, (unsigned char *) test_srv_crt, |
| strlen( test_srv_crt ) ); |
| if( ret != 0 ) |
| { |
| printf( " ! x509parse_crt returned %d\n\n", ret ); |
| goto exit; |
| } |
| |
| ret = x509parse_crt( &srvcert, (unsigned char *) test_ca_crt, |
| strlen( test_ca_crt ) ); |
| if( ret != 0 ) |
| { |
| printf( " ! x509parse_crt returned %d\n\n", ret ); |
| goto exit; |
| } |
| |
| ret = x509parse_key( &rsa, (unsigned char *) test_srv_key, |
| strlen( test_srv_key ), NULL, 0 ); |
| if( ret != 0 ) |
| { |
| printf( " ! x509parse_key returned %d\n\n", ret ); |
| goto exit; |
| } |
| |
| if( server_fd < 0 ) |
| { |
| if( ( ret = net_bind( &server_fd, NULL, |
| opt->server_port ) ) != 0 ) |
| { |
| printf( " ! net_bind returned %d\n\n", ret ); |
| return( ret ); |
| } |
| } |
| |
| if( ( ret = net_accept( server_fd, &client_fd, NULL ) ) != 0 ) |
| { |
| printf( " ! net_accept returned %d\n\n", ret ); |
| return( ret ); |
| } |
| |
| if( ( ret = ssl_init( &ssl ) ) != 0 ) |
| { |
| printf( " ! ssl_init returned %d\n\n", ret ); |
| return( ret ); |
| } |
| |
| ssl_set_endpoint( &ssl, SSL_IS_SERVER ); |
| ssl_set_dh_param( &ssl, dhm_P, dhm_G ); |
| ssl_set_ca_chain( &ssl, srvcert.next, NULL ); |
| ssl_set_own_cert( &ssl, &srvcert, &rsa ); |
| } |
| |
| ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); |
| |
| ssl_set_rng( &ssl, havege_rand, &hs ); |
| ssl_set_dbg( &ssl, my_debug, opt ); |
| ssl_set_bio( &ssl, net_recv, &client_fd, |
| net_send, &client_fd ); |
| |
| ssl_set_session( &ssl, opt->session_reuse, |
| opt->session_lifetime, &ssn ); |
| |
| if( opt->force_cipher[0] == DFL_FORCE_CIPHER ) |
| ssl_set_ciphers( &ssl, ssl_default_ciphers ); |
| else ssl_set_ciphers( &ssl, opt->force_cipher ); |
| |
| if( opt->iomode == IOMODE_NONBLOCK ) |
| net_set_nonblock( client_fd ); |
| |
| read_buf = (unsigned char *) malloc( opt->buffer_size ); |
| write_buf = (unsigned char *) malloc( opt->buffer_size ); |
| |
| if( read_buf == NULL || write_buf == NULL ) |
| { |
| printf( " ! malloc(%d bytes) failed\n\n", opt->buffer_size ); |
| goto exit; |
| } |
| |
| nb_read = bytes_to_read = 0; |
| nb_written = bytes_to_write = 0; |
| |
| while( 1 ) |
| { |
| if( opt->command & COMMAND_WRITE ) |
| { |
| if( bytes_to_write == 0 ) |
| { |
| while( bytes_to_write == 0 ) |
| bytes_to_write = rand() % opt->buffer_size; |
| |
| for( i = 0; i < bytes_to_write; i++ ) |
| write_buf[i] = (unsigned char) lcppm5( write_state ); |
| |
| offset_to_write = 0; |
| } |
| |
| ret = ssl_write( &ssl, write_buf + offset_to_write, |
| bytes_to_write ); |
| |
| if( ret >= 0 ) |
| { |
| nb_written += ret; |
| bytes_to_write -= ret; |
| offset_to_write += ret; |
| } |
| |
| if( ret == XYSSL_ERR_SSL_PEER_CLOSE_NOTIFY || |
| ret == XYSSL_ERR_NET_CONN_RESET ) |
| { |
| ret = 0; |
| goto exit; |
| } |
| |
| if( ret < 0 && ret != XYSSL_ERR_NET_TRY_AGAIN ) |
| { |
| printf( " ! ssl_write returned %d\n\n", ret ); |
| break; |
| } |
| } |
| |
| if( opt->command & COMMAND_READ ) |
| { |
| if( bytes_to_read == 0 ) |
| { |
| bytes_to_read = rand() % opt->buffer_size; |
| offset_to_read = 0; |
| } |
| |
| ret = ssl_read( &ssl, read_buf + offset_to_read, |
| bytes_to_read ); |
| |
| if( ret >= 0 ) |
| { |
| for( i = 0; i < ret; i++ ) |
| { |
| if( read_buf[offset_to_read + i] != |
| (unsigned char) lcppm5( read_state ) ) |
| { |
| ret = 1; |
| printf( " ! plaintext mismatch\n\n" ); |
| goto exit; |
| } |
| } |
| |
| nb_read += ret; |
| bytes_to_read -= ret; |
| offset_to_read += ret; |
| } |
| |
| if( ret == XYSSL_ERR_SSL_PEER_CLOSE_NOTIFY || |
| ret == XYSSL_ERR_NET_CONN_RESET ) |
| { |
| ret = 0; |
| goto exit; |
| } |
| |
| if( ret < 0 && ret != XYSSL_ERR_NET_TRY_AGAIN ) |
| { |
| printf( " ! ssl_read returned %d\n\n", ret ); |
| break; |
| } |
| } |
| |
| ret = 0; |
| |
| if( opt->max_bytes != 0 && |
| ( opt->max_bytes <= nb_read || |
| opt->max_bytes <= nb_written ) ) |
| break; |
| |
| if( opt->conn_timeout != 0 && |
| opt->conn_timeout <= (int) get_timer( &t, 0 ) ) |
| break; |
| } |
| |
| exit: |
| |
| fflush( stdout ); |
| |
| if( read_buf != NULL ) |
| free( read_buf ); |
| |
| if( write_buf != NULL ) |
| free( write_buf ); |
| |
| ssl_close_notify( &ssl ); |
| x509_free( &srvcert ); |
| rsa_free( &rsa ); |
| ssl_free( &ssl ); |
| net_close( client_fd ); |
| |
| return( ret ); |
| } |
| |
| #define USAGE \ |
| "\n usage: ssl_test opmode=<> command=<>...\n" \ |
| "\n acceptable parameters:\n" \ |
| " opmode=client/server default: <none>\n" \ |
| " iomode=block/nonblock default: block\n" \ |
| " server_name=%%s default: localhost\n" \ |
| " server_port=%%d default: 4433\n" \ |
| " command=read/write/both default: read\n" \ |
| " buffer_size=%%d (bytes) default: 1024\n" \ |
| " max_bytes=%%d (bytes) default: 0 (no limit)\n" \ |
| " debug_level=%%d default: 0 (disabled)\n" \ |
| " conn_timeout=%%d (ms) default: 0 (no timeout)\n" \ |
| " max_connections=%%d default: 0 (no limit)\n" \ |
| " session_reuse=on/off default: on (enabled)\n" \ |
| " session_lifetime=%%d (s) default: 86400\n" \ |
| " force_cipher=<name> default: all enabled\n" \ |
| " acceptable cipher names:\n" \ |
| " SSL_RSA_RC4_128_MD5 SSL_RSA_RC4_128_SHA\n" \ |
| " SSL_RSA_DES_168_SHA SSL_EDH_RSA_DES_168_SHA\n" \ |
| " SSL_RSA_AES_128_SHA SSL_EDH_RSA_AES_256_SHA\n" \ |
| " SSL_RSA_AES_256_SHA\n\n" |
| |
| int main( int argc, char *argv[] ) |
| { |
| int i, j, n; |
| int ret = 1; |
| int nb_conn; |
| char *p, *q; |
| struct options opt; |
| |
| if( argc == 1 ) |
| { |
| usage: |
| printf( USAGE ); |
| goto exit; |
| } |
| |
| opt.opmode = DFL_OPMODE; |
| opt.iomode = DFL_IOMODE; |
| opt.server_name = DFL_SERVER_NAME; |
| opt.server_port = DFL_SERVER_PORT; |
| opt.command = DFL_COMMAND; |
| opt.buffer_size = DFL_BUFFER_SIZE; |
| opt.max_bytes = DFL_MAX_BYTES; |
| opt.debug_level = DFL_DEBUG_LEVEL; |
| opt.conn_timeout = DFL_CONN_TIMEOUT; |
| opt.max_connections = DFL_MAX_CONNECTIONS; |
| opt.session_reuse = DFL_SESSION_REUSE; |
| opt.session_lifetime = DFL_SESSION_LIFETIME; |
| opt.force_cipher[0] = DFL_FORCE_CIPHER; |
| |
| for( i = 1; i < argc; i++ ) |
| { |
| n = strlen( argv[i] ); |
| |
| for( j = 0; j < n; j++ ) |
| { |
| if( argv[i][j] >= 'A' && argv[i][j] <= 'Z' ) |
| argv[i][j] |= 0x20; |
| } |
| |
| p = argv[i]; |
| if( ( q = strchr( p, '=' ) ) == NULL ) |
| continue; |
| *q++ = '\0'; |
| |
| if( strcmp( p, "opmode" ) == 0 ) |
| { |
| if( strcmp( q, "client" ) == 0 ) |
| opt.opmode = OPMODE_CLIENT; |
| else |
| if( strcmp( q, "server" ) == 0 ) |
| opt.opmode = OPMODE_SERVER; |
| else goto usage; |
| } |
| |
| if( strcmp( p, "iomode" ) == 0 ) |
| { |
| if( strcmp( q, "block" ) == 0 ) |
| opt.iomode = IOMODE_BLOCK; |
| else |
| if( strcmp( q, "nonblock" ) == 0 ) |
| opt.iomode = IOMODE_NONBLOCK; |
| else goto usage; |
| } |
| |
| if( strcmp( p, "server_name" ) == 0 ) |
| opt.server_name = q; |
| |
| if( strcmp( p, "server_port" ) == 0 ) |
| { |
| opt.server_port = atoi( q ); |
| if( opt.server_port < 1 || opt.server_port > 65535 ) |
| goto usage; |
| } |
| |
| if( strcmp( p, "command" ) == 0 ) |
| { |
| if( strcmp( q, "read" ) == 0 ) |
| opt.command = COMMAND_READ; |
| else |
| if( strcmp( q, "write" ) == 0 ) |
| opt.command = COMMAND_WRITE; |
| else |
| if( strcmp( q, "both" ) == 0 ) |
| { |
| opt.iomode = IOMODE_NONBLOCK; |
| opt.command = COMMAND_BOTH; |
| } |
| else goto usage; |
| } |
| |
| if( strcmp( p, "buffer_size" ) == 0 ) |
| { |
| opt.buffer_size = atoi( q ); |
| if( opt.buffer_size < 1 || opt.buffer_size > 1048576 ) |
| goto usage; |
| } |
| |
| if( strcmp( p, "max_bytes" ) == 0 ) |
| opt.max_bytes = atoi( q ); |
| |
| if( strcmp( p, "debug_level" ) == 0 ) |
| opt.debug_level = atoi( q ); |
| |
| if( strcmp( p, "conn_timeout" ) == 0 ) |
| opt.conn_timeout = atoi( q ); |
| |
| if( strcmp( p, "max_connections" ) == 0 ) |
| opt.max_connections = atoi( q ); |
| |
| if( strcmp( p, "session_reuse" ) == 0 ) |
| { |
| if( strcmp( q, "on" ) == 0 ) |
| opt.session_reuse = 1; |
| else |
| if( strcmp( q, "off" ) == 0 ) |
| opt.session_reuse = 0; |
| else |
| goto usage; |
| } |
| |
| if( strcmp( p, "session_lifetime" ) == 0 ) |
| opt.session_lifetime = atoi( q ); |
| |
| if( strcmp( p, "force_cipher" ) == 0 ) |
| { |
| opt.force_cipher[0] = -1; |
| |
| if( strcmp( q, "ssl_rsa_rc4_128_md5" ) == 0 ) |
| opt.force_cipher[0] = SSL_RSA_RC4_128_MD5; |
| |
| if( strcmp( q, "ssl_rsa_rc4_128_sha" ) == 0 ) |
| opt.force_cipher[0] = SSL_RSA_RC4_128_SHA; |
| |
| if( strcmp( q, "ssl_rsa_des_168_sha" ) == 0 ) |
| opt.force_cipher[0] = SSL_RSA_DES_168_SHA; |
| |
| if( strcmp( q, "ssl_edh_rsa_des_168_sha" ) == 0 ) |
| opt.force_cipher[0] = SSL_EDH_RSA_DES_168_SHA; |
| |
| if( strcmp( q, "ssl_rsa_aes_128_sha" ) == 0 ) |
| opt.force_cipher[0] = SSL_RSA_AES_128_SHA; |
| |
| if( strcmp( q, "ssl_rsa_aes_256_sha" ) == 0 ) |
| opt.force_cipher[0] = SSL_RSA_AES_256_SHA; |
| |
| if( strcmp( q, "ssl_edh_rsa_aes_256_sha" ) == 0 ) |
| opt.force_cipher[0] = SSL_EDH_RSA_AES_256_SHA; |
| |
| if( opt.force_cipher[0] < 0 ) |
| goto usage; |
| |
| opt.force_cipher[1] = 0; |
| } |
| } |
| |
| switch( opt.opmode ) |
| { |
| case OPMODE_CLIENT: |
| break; |
| |
| case OPMODE_SERVER: |
| break; |
| |
| default: |
| goto usage; |
| } |
| |
| nb_conn = 0; |
| |
| do { |
| nb_conn++; |
| ret = ssl_test( &opt ); |
| if( opt.max_connections != 0 && |
| opt.max_connections <= nb_conn ) |
| break; |
| } |
| while( ret == 0 ); |
| |
| exit: |
| |
| #ifdef WIN32 |
| printf( " Press Enter to exit this program.\n" ); |
| fflush( stdout ); getchar(); |
| #endif |
| |
| return( ret ); |
| } |
