1 //
2 //
3 // Copyright 2016 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18
19 #include <netinet/in.h>
20 #include <stdint.h>
21 #include <stdio.h>
22
23 #include <openssl/crypto.h>
24 #include <openssl/evp.h>
25
26 #include "absl/base/thread_annotations.h"
27 #include "gtest/gtest.h"
28
29 #include <grpc/impl/channel_arg_names.h>
30 #include <grpc/slice.h>
31 #include <grpc/support/time.h>
32
33 #include "src/core/lib/iomgr/error.h"
34 #include "src/core/lib/iomgr/port.h"
35 #include "test/core/util/test_config.h"
36
37 // IWYU pragma: no_include <arpa/inet.h>
38
39 // This test won't work except with posix sockets enabled
40 #ifdef GRPC_POSIX_SOCKET_TCP
41
42 #include <stdlib.h>
43 #include <string.h>
44 #include <sys/socket.h>
45 #include <unistd.h>
46
47 #include <string>
48
49 #include <openssl/err.h>
50 #include <openssl/ssl.h>
51
52 #include "absl/strings/str_cat.h"
53
54 #include <grpc/grpc.h>
55 #include <grpc/grpc_security.h>
56 #include <grpc/support/log.h>
57
58 #include "src/core/lib/debug/trace.h"
59 #include "src/core/lib/gprpp/crash.h"
60 #include "src/core/lib/gprpp/sync.h"
61 #include "src/core/lib/gprpp/thd.h"
62 #include "test/core/util/tls_utils.h"
63
64 #define SSL_CERT_PATH "src/core/tsi/test_creds/server1.pem"
65 #define SSL_KEY_PATH "src/core/tsi/test_creds/server1.key"
66 #define SSL_CA_PATH "src/core/tsi/test_creds/ca.pem"
67
68 grpc_core::TraceFlag client_ssl_tsi_tracing_enabled(false, "tsi");
69
70 class SslLibraryInfo {
71 public:
SslLibraryInfo()72 SslLibraryInfo() {}
73
Notify()74 void Notify() {
75 grpc_core::MutexLock lock(&mu_);
76 ready_ = true;
77 cv_.Signal();
78 }
79
Await()80 void Await() {
81 grpc_core::MutexLock lock(&mu_);
82 while (!ready_) {
83 cv_.Wait(&mu_);
84 }
85 }
86
87 private:
88 grpc_core::Mutex mu_;
89 grpc_core::CondVar cv_;
90 bool ready_ ABSL_GUARDED_BY(mu_) = false;
91 };
92
93 // Arguments for TLS server thread.
94 typedef struct {
95 int socket;
96 char* alpn_preferred;
97 SslLibraryInfo* ssl_library_info;
98 } server_args;
99
100 // Based on https://wiki.openssl.org/index.php/Simple_TLS_Server.
101 // Pick an arbitrary unused port and return it in *out_port. Return
102 // an fd>=0 on success.
create_socket(int * out_port)103 static int create_socket(int* out_port) {
104 int s;
105 struct sockaddr_in addr;
106 socklen_t addr_len;
107 *out_port = -1;
108
109 addr.sin_family = AF_INET;
110 addr.sin_port = 0;
111 addr.sin_addr.s_addr = htonl(INADDR_ANY);
112
113 s = socket(AF_INET, SOCK_STREAM, 0);
114 if (s < 0) {
115 perror("Unable to create socket");
116 return -1;
117 }
118
119 if (bind(s, reinterpret_cast<struct sockaddr*>(&addr), sizeof(addr)) < 0) {
120 perror("Unable to bind");
121 gpr_log(GPR_ERROR, "%s", "Unable to bind to any port");
122 close(s);
123 return -1;
124 }
125
126 if (listen(s, 1) < 0) {
127 perror("Unable to listen");
128 close(s);
129 return -1;
130 }
131
132 addr_len = sizeof(addr);
133 if (getsockname(s, reinterpret_cast<struct sockaddr*>(&addr), &addr_len) !=
134 0 ||
135 addr_len > sizeof(addr)) {
136 perror("getsockname");
137 gpr_log(GPR_ERROR, "%s", "Unable to get socket local address");
138 close(s);
139 return -1;
140 }
141
142 *out_port = ntohs(addr.sin_port);
143 return s;
144 }
145
146 // Server callback during ALPN negotiation. See man page for
147 // SSL_CTX_set_alpn_select_cb.
alpn_select_cb(SSL *,const uint8_t ** out,uint8_t * out_len,const uint8_t * in,unsigned in_len,void * arg)148 static int alpn_select_cb(SSL* /*ssl*/, const uint8_t** out, uint8_t* out_len,
149 const uint8_t* in, unsigned in_len, void* arg) {
150 const uint8_t* alpn_preferred = static_cast<const uint8_t*>(arg);
151
152 *out = alpn_preferred;
153 *out_len = static_cast<uint8_t>(
154 strlen(reinterpret_cast<const char*>(alpn_preferred)));
155
156 // Validate that the ALPN list includes "h2".
157 bool h2_seen = false;
158 const char* inp = reinterpret_cast<const char*>(in);
159 const char* in_end = inp + in_len;
160 while (inp < in_end) {
161 const size_t length = static_cast<size_t>(*inp++);
162 if (length == strlen("h2") && strncmp(inp, "h2", length) == 0) {
163 h2_seen = true;
164 }
165 inp += length;
166 }
167
168 EXPECT_EQ(inp, in_end);
169 EXPECT_TRUE(h2_seen);
170
171 return SSL_TLSEXT_ERR_OK;
172 }
173
ssl_log_where_info(const SSL * ssl,int where,int flag,const char * msg)174 static void ssl_log_where_info(const SSL* ssl, int where, int flag,
175 const char* msg) {
176 if ((where & flag) &&
177 GRPC_TRACE_FLAG_ENABLED(client_ssl_tsi_tracing_enabled)) {
178 gpr_log(GPR_INFO, "%20.20s - %30.30s - %5.10s", msg,
179 SSL_state_string_long(ssl), SSL_state_string(ssl));
180 }
181 }
182
ssl_server_info_callback(const SSL * ssl,int where,int ret)183 static void ssl_server_info_callback(const SSL* ssl, int where, int ret) {
184 if (ret == 0) {
185 gpr_log(GPR_ERROR, "ssl_server_info_callback: error occurred.\n");
186 return;
187 }
188
189 ssl_log_where_info(ssl, where, SSL_CB_LOOP, "Server: LOOP");
190 ssl_log_where_info(ssl, where, SSL_CB_HANDSHAKE_START,
191 "Server: HANDSHAKE START");
192 ssl_log_where_info(ssl, where, SSL_CB_HANDSHAKE_DONE,
193 "Server: HANDSHAKE DONE");
194 }
195
196 // Minimal TLS server. This is largely based on the example at
197 // https://wiki.openssl.org/index.php/Simple_TLS_Server and the gRPC core
198 // internals in src/core/tsi/ssl_transport_security.c.
server_thread(void * arg)199 static void server_thread(void* arg) {
200 const server_args* args = static_cast<server_args*>(arg);
201
202 SSL_load_error_strings();
203 OpenSSL_add_ssl_algorithms();
204 args->ssl_library_info->Notify();
205
206 const SSL_METHOD* method = TLSv1_2_server_method();
207 SSL_CTX* ctx = SSL_CTX_new(method);
208 if (!ctx) {
209 perror("Unable to create SSL context");
210 ERR_print_errors_fp(stderr);
211 abort();
212 }
213
214 // Load key pair.
215 if (SSL_CTX_use_certificate_file(ctx, SSL_CERT_PATH, SSL_FILETYPE_PEM) < 0) {
216 perror("Unable to use certificate file.");
217 ERR_print_errors_fp(stderr);
218 abort();
219 }
220 if (SSL_CTX_use_PrivateKey_file(ctx, SSL_KEY_PATH, SSL_FILETYPE_PEM) < 0) {
221 perror("Unable to use private key file.");
222 ERR_print_errors_fp(stderr);
223 abort();
224 }
225 if (SSL_CTX_check_private_key(ctx) != 1) {
226 perror("Check private key failed.");
227 ERR_print_errors_fp(stderr);
228 abort();
229 }
230
231 // Set the cipher list to match the one expressed in
232 // src/core/tsi/ssl_transport_security.cc.
233 const char* cipher_list =
234 "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-"
235 "SHA384:ECDHE-RSA-AES256-GCM-SHA384";
236 if (!SSL_CTX_set_cipher_list(ctx, cipher_list)) {
237 ERR_print_errors_fp(stderr);
238 grpc_core::Crash("Couldn't set server cipher list.");
239 }
240
241 // Enable automatic curve selection. This is a NO-OP when using OpenSSL
242 // versions > 1.0.2.
243 if (!SSL_CTX_set_ecdh_auto(ctx, /*onoff=*/1)) {
244 ERR_print_errors_fp(stderr);
245 grpc_core::Crash("Couldn't set automatic curve selection.");
246 }
247
248 // Register the ALPN selection callback.
249 SSL_CTX_set_alpn_select_cb(ctx, alpn_select_cb, args->alpn_preferred);
250
251 // bind/listen/accept at TCP layer.
252 const int sock = args->socket;
253 gpr_log(GPR_INFO, "Server listening");
254 struct sockaddr_in addr;
255 socklen_t len = sizeof(addr);
256 const int client =
257 accept(sock, reinterpret_cast<struct sockaddr*>(&addr), &len);
258 if (client < 0) {
259 perror("Unable to accept");
260 abort();
261 }
262
263 // Establish a SSL* and accept at SSL layer.
264 SSL* ssl = SSL_new(ctx);
265 SSL_set_info_callback(ssl, ssl_server_info_callback);
266 ASSERT_TRUE(ssl);
267 SSL_set_fd(ssl, client);
268 if (SSL_accept(ssl) <= 0) {
269 ERR_print_errors_fp(stderr);
270 gpr_log(GPR_ERROR, "Handshake failed.");
271 } else {
272 gpr_log(GPR_INFO, "Handshake successful.");
273 }
274
275 // Send out the settings frame.
276 const char settings_frame[] = "\x00\x00\x00\x04\x00\x00\x00\x00\x00";
277 SSL_write(ssl, settings_frame, sizeof(settings_frame) - 1);
278
279 // Wait until the client drops its connection.
280 char buf;
281 while (SSL_read(ssl, &buf, sizeof(buf)) > 0) {
282 }
283
284 SSL_free(ssl);
285 close(client);
286 close(sock);
287 SSL_CTX_free(ctx);
288 }
289
290 // This test launches a minimal TLS server on a separate thread and then
291 // establishes a TLS handshake via the core library to the server. The TLS
292 // server validates ALPN aspects of the handshake and supplies the protocol
293 // specified in the server_alpn_preferred argument to the client.
client_ssl_test(char * server_alpn_preferred)294 static bool client_ssl_test(char* server_alpn_preferred) {
295 bool success = true;
296
297 grpc_init();
298
299 // Find a port we can bind to. Retries added to handle flakes in port server
300 // and port picking.
301 int port = -1;
302 int server_socket = -1;
303 int socket_retries = 30;
304 while (server_socket == -1 && socket_retries-- > 0) {
305 server_socket = create_socket(&port);
306 if (server_socket == -1) {
307 sleep(1);
308 }
309 }
310 EXPECT_GT(server_socket, 0);
311 EXPECT_GT(port, 0);
312
313 // Launch the TLS server thread.
314 SslLibraryInfo ssl_library_info;
315 server_args args = {server_socket, server_alpn_preferred, &ssl_library_info};
316 bool ok;
317 grpc_core::Thread thd("grpc_client_ssl_test", server_thread, &args, &ok);
318 EXPECT_TRUE(ok);
319 thd.Start();
320 ssl_library_info.Await();
321
322 // Load key pair and establish client SSL credentials.
323 std::string ca_cert = grpc_core::testing::GetFileContents(SSL_CA_PATH);
324 std::string cert = grpc_core::testing::GetFileContents(SSL_CERT_PATH);
325 std::string key = grpc_core::testing::GetFileContents(SSL_KEY_PATH);
326
327 grpc_ssl_pem_key_cert_pair pem_key_cert_pair;
328 pem_key_cert_pair.private_key = key.c_str();
329 pem_key_cert_pair.cert_chain = cert.c_str();
330 grpc_channel_credentials* ssl_creds = grpc_ssl_credentials_create(
331 ca_cert.c_str(), &pem_key_cert_pair, nullptr, nullptr);
332
333 // Establish a channel pointing at the TLS server. Since the gRPC runtime is
334 // lazy, this won't necessarily establish a connection yet.
335 std::string target = absl::StrCat("127.0.0.1:", port);
336 grpc_arg ssl_name_override = {
337 GRPC_ARG_STRING,
338 const_cast<char*>(GRPC_SSL_TARGET_NAME_OVERRIDE_ARG),
339 {const_cast<char*>("foo.test.google.fr")}};
340 grpc_channel_args grpc_args;
341 grpc_args.num_args = 1;
342 grpc_args.args = &ssl_name_override;
343 grpc_channel* channel =
344 grpc_channel_create(target.c_str(), ssl_creds, &grpc_args);
345 EXPECT_TRUE(channel);
346
347 // Initially the channel will be idle, the
348 // grpc_channel_check_connectivity_state triggers an attempt to connect.
349 EXPECT_EQ(
350 grpc_channel_check_connectivity_state(channel, 1 /* try_to_connect */),
351 GRPC_CHANNEL_IDLE);
352
353 // Wait a bounded number of times for the channel to be ready. When the
354 // channel is ready, the initial TLS handshake will have successfully
355 // completed and we know that the client's ALPN list satisfied the server.
356 int retries = 10;
357 grpc_connectivity_state state = GRPC_CHANNEL_IDLE;
358 grpc_completion_queue* cq = grpc_completion_queue_create_for_next(nullptr);
359
360 while (state != GRPC_CHANNEL_READY && retries-- > 0) {
361 grpc_channel_watch_connectivity_state(
362 channel, state, grpc_timeout_seconds_to_deadline(3), cq, nullptr);
363 gpr_timespec cq_deadline = grpc_timeout_seconds_to_deadline(5);
364 grpc_event ev = grpc_completion_queue_next(cq, cq_deadline, nullptr);
365 EXPECT_EQ(ev.type, GRPC_OP_COMPLETE);
366 state =
367 grpc_channel_check_connectivity_state(channel, 0 /* try_to_connect */);
368 }
369 grpc_completion_queue_destroy(cq);
370 if (retries < 0) {
371 success = false;
372 }
373
374 grpc_channel_destroy(channel);
375 grpc_channel_credentials_release(ssl_creds);
376
377 thd.Join();
378
379 grpc_shutdown();
380
381 return success;
382 }
383
TEST(ClientSslTest,MainTest)384 TEST(ClientSslTest, MainTest) {
385 // Handshake succeeeds when the server has h2 as the ALPN preference.
386 ASSERT_TRUE(client_ssl_test(const_cast<char*>("h2")));
387
388 // TODO(gtcooke94) Figure out why test is failing with OpenSSL and fix it.
389 #ifdef OPENSSL_IS_BORING_SSL
390 // Handshake fails when the server uses a fake protocol as its ALPN
391 // preference. This validates the client is correctly validating ALPN returns
392 // and sanity checks the client_ssl_test.
393 ASSERT_FALSE(client_ssl_test(const_cast<char*>("foo")));
394 #endif // OPENSSL_IS_BORING_SSL
395 // Clean up the SSL libraries.
396 EVP_cleanup();
397 }
398
399 #endif // GRPC_POSIX_SOCKET_TCP
400
main(int argc,char ** argv)401 int main(int argc, char** argv) {
402 grpc::testing::TestEnvironment env(&argc, argv);
403 ::testing::InitGoogleTest(&argc, argv);
404 return RUN_ALL_TESTS();
405 }
406