OpenSSL session cache
Michel Arboi <[email protected]>
| Newsgroups | gmane.comp.security.nessus.devel |
|---|---|
| Message-ID | <[email protected]> |
In a desperate attempt to save CPU time, I'm playing with OpenSSL
"cache".
My first question is if there could be any bad side effect that could
make Nessus miss vulnerabilities.
The second point is simply: "does this *ing thing work??"
This code does not reuse sessions and I don't see where the problem is.
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/ssl.h>
#include <netinet/in.h>
void sslerror2(txt, err)
char *txt;
int err;
{
char string[120];
ERR_error_string(err, string);
fprintf(stderr, "%s: %s\n", txt, string);
}
void
sslerror(txt)
char *txt;
{
sslerror2(txt, ERR_get_error());
}
static int
pouet(const struct sockaddr_in *paddr)
{
int s, i;
SSL_CTX *ctx;
SSL_METHOD *mt;
SSL *ssl;
SSL_SESSION *sess = NULL;
mt = SSLv23_client_method();
if (mt == NULL)
{
sslerror("SSLv23_client_method");
return -1;
}
ctx = SSL_CTX_new(mt);
if (ctx == NULL)
{
sslerror("SSL_CTX_new");
return -1;
}
if (! SSL_CTX_set_session_id_context(ctx, "tagada", 6))
sslerror("SSL_CTX_set_session_id_context");
if (!SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER))
sslerror("SSL_CTX_set_session_cache_mode");
/* Using BOTH or CLIENT does not change anything to the result!*/
if (! SSL_CTX_set_options(ctx, SSL_OP_ALL))
sslerror("SSL_CTX_set_options(SSL_OP_ALL)");
for (i = 0; i < 3; i ++)
{
printf(">>> %d\n", i);
s = socket(AF_INET, SOCK_STREAM,IPPROTO_TCP);
if (s < 0)
{
perror("socket");
return -1;
}
if (connect(s, paddr, sizeof(*paddr)) < 0)
{
perror("connect");
return -1;
}
ssl = SSL_new(ctx);
if (ssl == NULL)
{
sslerror("SSL_new");
return -1;
}
if (sess != NULL)
if (! SSL_set_session(ssl, sess))
sslerror("SSL_set_session");
if (! SSL_set_fd(ssl, s))
{
sslerror("SSL_set_fd");
return -1;
}
if (SSL_connect(ssl) <= 0)
{
sslerror("SSL_connect");
return -1;
}
fprintf(stderr, "open_SSL_connection: SSL_session_reused=%d\n",
SSL_session_reused(ssl));
#if 0
sess = SSL_get1_session(ssl);
if (sess == NULL)
sslerror("SSL_get1_session");
#else
sess = NULL;
#endif
SSL_shutdown(ssl);
SSL_free(ssl);
close(s);
}
return 0;
}
int
main(int argc, char* argv[])
{
int fd;
struct sockaddr_in addr;
unsigned short port;
if (argc != 3)
{
fprintf(stderr, "Usage: s IP port\n");
exit(1);
}
SSL_library_init();
SSL_load_error_strings();
port = atoi(argv[2]);
bzero(&addr, sizeof(addr));
if (! inet_aton(argv[1], &addr.sin_addr))
{
fprintf(stderr, "Invalid address %s\n", argv[1]);
exit(1);
}
addr.sin_family = AF_INET;
addr.sin_port = htons(port);
pouet(&addr);
exit(0);
}