char *http_process_request(char *url, int method, char **type, int *code, int *size, const char *contype, char *post) { struct sockaddr_in serv_addr; int sockfd = 0, bytes = 0; int has_code = 0, has_type = 0; int pos = 0; size_t bufsize = BUFFER_SIZE; char ip[INET_ADDRSTRLEN+1], *content = NULL, *host = NULL, *auth = NULL, *auth64 = NULL; char *page = NULL, *tok = NULL; char recvBuff[BUFFER_SIZE+1], *header = MALLOC(bufsize); unsigned short port = 0, sslfree = 0, entropyfree = 0; size_t len = 0, tlen = 0, plen = 0; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; *size = 0; if(header == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } memset(header, '\0', bufsize); memset(recvBuff, '\0', BUFFER_SIZE+1); memset(&serv_addr, '\0', sizeof(struct sockaddr_in)); /* Check which port we need to use based on the http(s) protocol */ if(strncmp(url, "http://", 7) == 0) { port = 80; plen = 8; } else if(strncmp(url, "https://", 8) == 0) { port = 443; plen = 9; } else { logprintf(LOG_ERR, "an url should start with either http:// or https://", url); *code = -1; goto exit; } /* Split the url into a host and page part */ len = strlen(url); if((tok = strstr(&url[plen], "/"))) { tlen = (size_t)(tok-url)-plen+1; if((host = MALLOC(tlen+1)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strncpy(host, &url[plen-1], tlen); host[tlen] = '\0'; if((page = MALLOC(len-tlen)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strcpy(page, &url[tlen+(plen-1)]); } else { tlen = strlen(url)-(plen-1); if((host = MALLOC(tlen+1)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strncpy(host, &url[(plen-1)], tlen); host[tlen] = '\0'; if((page = MALLOC(2)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strcpy(page, "/"); } if((tok = strstr(host, "@"))) { size_t pglen = strlen(page); if(strcmp(page, "/") == 0) { pglen -= 1; } tlen = (size_t)(tok-host); if((auth = MALLOC(tlen+1)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strncpy(auth, &host[0], tlen); auth[tlen] = '\0'; strncpy(&host[0], &url[plen+tlen], len-(plen+tlen+pglen)); host[len-(plen+tlen+pglen)] = '\0'; auth64 = base64encode(auth, strlen(auth)); } #ifdef _WIN32 WSADATA wsa; if(WSAStartup(0x202, &wsa) != 0) { logprintf(LOG_ERR, "could not initialize new socket"); *code = -1; goto exit; } #endif if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0){ logprintf(LOG_ERR, "could not http create socket"); *code = -1; goto exit; } setsockopt(sockfd, SOL_SOCKET, SO_KEEPALIVE, 0, 0); char *w = ip; if(host2ip(host, w) == -1) { *code = -1; goto exit; } serv_addr.sin_family = AF_INET; if(inet_pton(AF_INET, ip, (void *)(&(serv_addr.sin_addr.s_addr))) <= 0) { logprintf(LOG_ERR, "%s is not a valid ip address", ip); *code = -1; goto exit; } serv_addr.sin_port = htons(port); /* Proper socket timeout testing */ switch(socket_timeout_connect(sockfd, (struct sockaddr *)&serv_addr, 3)) { case -1: logprintf(LOG_ERR, "could not connect to http socket (%s)", url); *code = -1; goto exit; case -2: logprintf(LOG_ERR, "http socket connection timeout (%s)", url); *code = -1; goto exit; case -3: logprintf(LOG_ERR, "error in http socket connection", url); *code = -1; goto exit; default: break; } if(method == HTTP_POST) { len = (size_t)snprintf(&header[0], bufsize, "POST %s HTTP/1.0\r\n", page); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Host: %s\r\n", host); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } if(auth64 != NULL) { len += (size_t)snprintf(&header[len], bufsize - len, "Authorization: Basic %s\r\n", auth64); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } } len += (size_t)snprintf(&header[len], bufsize - len, "User-Agent: %s\r\n", USERAGENT); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Content-Type: %s\r\n", contype); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Content-Length: %d\r\n\r\n", (int)strlen(post)); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "%s", post); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } } else if(method == HTTP_GET) { len = (size_t)snprintf(&header[0], bufsize, "GET %s HTTP/1.0\r\n", page); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Host: %s\r\n", host); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } if(auth64 != NULL) { len += (size_t)snprintf(&header[len], bufsize - len, "Authorization: Basic %s\r\n", auth64); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } } len += (size_t)snprintf(&header[len], bufsize - len, "User-Agent: %s\r\n", USERAGENT); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Connection: close\r\n\r\n"); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } } if(port == 443) { memset(&ssl, '\0', sizeof(ssl_context)); entropy_init(&entropy); entropyfree = 1; if((ctr_drbg_init(&ctr_drbg, entropy_func, &entropy, (const unsigned char *)USERAGENT, 6)) != 0) { logprintf(LOG_ERR, "ctr_drbg_init failed"); *code = -1; goto exit; } if((ssl_init(&ssl)) != 0) { logprintf(LOG_ERR, "ssl_init failed"); *code = -1; goto exit; } sslfree = 1; ssl_set_endpoint(&ssl, SSL_IS_CLIENT); ssl_set_rng(&ssl, ctr_drbg_random, &ctr_drbg); ssl_set_bio(&ssl, net_recv, &sockfd, net_send, &sockfd); int ret = 0; while((ret = ssl_handshake(&ssl)) != 0) { if(ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE) { logprintf(LOG_ERR, "ssl_handshake failed"); *code = -1; goto exit; } } while((ret = ssl_write(&ssl, (const unsigned char *)header, len)) <= 0) { if(ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE) { if(ret == -76) { logprintf(LOG_ERR, "ssl_write timed out"); } else { logprintf(LOG_ERR, "ssl_write failed"); } *code = -1; goto exit; } } } else { if((bytes = send(sockfd, header, len, 0)) <= 0) { logprintf(LOG_ERR, "sending header to http server failed"); *code = -1; goto exit; } } char *nl = NULL; char *tp = *type; memset(recvBuff, '\0', sizeof(recvBuff)); while(1) { if(port == 443) { bytes = ssl_read(&ssl, (unsigned char *)recvBuff, BUFFER_SIZE); if(bytes == POLARSSL_ERR_NET_WANT_READ || bytes == POLARSSL_ERR_NET_WANT_WRITE) { continue; } if(bytes == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY) { break; } } else { bytes = recv(sockfd, recvBuff, BUFFER_SIZE, 0); } if(bytes <= 0) { if(*size == 0) { logprintf(LOG_ERR, "http(s) read failed (%s)", url); } break; } if((content = REALLOC(content, (size_t)(*size+bytes+1))) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } memset(&content[*size], '\0', (size_t)(bytes+1)); strncpy(&content[*size], recvBuff, (size_t)(bytes)); *size += bytes; char **array = NULL; char *p = recvBuff; /* Let's first normalize the HEADER terminator */ str_replace("\r\n", "\n\r", &p); unsigned int n = explode(recvBuff, "\n\r", &array), q = 0; int z = 0; for(q=0;q<n;q++) { if(has_code == 0 && sscanf(array[q], "HTTP/1.%d%*[ ]%d%*s%*[ \n\r]", &z, code)) { has_code = 1; } // ;%*[ A-Za-z0-9\\/=+- \n\r] if(has_type == 0 && sscanf(array[q], "Content-%*[tT]ype:%*[ ]%[A-Za-z\\/+-]", tp)) { has_type = 1; } } array_free(&array, n); memset(recvBuff, '\0', sizeof(recvBuff)); } if(content != NULL) { /* Remove the header */ if((nl = strstr(content, "\r\n\r\n"))) { pos = (nl-content)+4; memmove(&content[0], &content[pos], (size_t)(*size-pos)); *size-=pos; } /* Remove the footer */ if((nl = strstr(content, "0\r\n\r\n"))) { *size -= 5; } } exit: if(port == 443) { if(sslfree == 1) { ssl_free(&ssl); } if(entropyfree == 1) { entropy_free(&entropy); } } if(header) FREE(header); if(auth) FREE(auth); if(auth64) FREE(auth64); if(page) FREE(page); if(host) FREE(host); if(sockfd > 0) { close(sockfd); } if(*size > 0) { content[*size] = '\0'; return content; } else { return NULL; } return NULL; }
int main( int argc, char *argv[] ) { int ret, len, server_fd = -1; unsigned char buf[1024]; const char *pers = "ssl_client1"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_crt cacert; ((void) argc); ((void) argv); #if defined(POLARSSL_DEBUG_C) debug_set_threshold( DEBUG_LEVEL ); #endif /* * 0. Initialize the RNG and the session data */ memset( &ssl, 0, sizeof( ssl_context ) ); x509_crt_init( &cacert ); printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n" ); /* * 0. Initialize certificates */ printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_CERTS_C) ret = x509_crt_parse( &cacert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); #else ret = 1; printf("POLARSSL_CERTS_C not defined."); #endif if( ret < 0 ) { printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } printf( " ok (%d skipped)\n", ret ); /* * 1. Start the connection */ printf( " . Connecting to tcp/%s/%4d...", SERVER_NAME, SERVER_PORT ); fflush( stdout ); if( ( ret = net_connect( &server_fd, SERVER_NAME, SERVER_PORT ) ) != 0 ) { printf( " failed\n ! net_connect returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); /* OPTIONAL is not optimal for security, * but makes interop easier in this simplified example */ ssl_set_authmode( &ssl, SSL_VERIFY_OPTIONAL ); ssl_set_ca_chain( &ssl, &cacert, NULL, "PolarSSL Server 1" ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); /* * 4. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto exit; } } printf( " ok\n" ); /* * 5. Verify the server certificate */ printf( " . Verifying peer X.509 certificate..." ); /* In real life, we may want to bail out when ret != 0 */ if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( " failed\n" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! server certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! server certificate has been revoked\n" ); if( ( ret & BADCERT_CN_MISMATCH ) != 0 ) printf( " ! CN mismatch (expected CN=%s)\n", "PolarSSL Server 1" ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n" ); } else printf( " ok\n" ); /* * 3. Write the GET request */ printf( " > Write to server:" ); fflush( stdout ); len = sprintf( (char *) buf, GET_REQUEST ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s", len, (char *) buf ); /* * 7. Read the HTTP response */ printf( " < Read from server:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY ) break; if( ret < 0 ) { printf( "failed\n ! ssl_read returned %d\n\n", ret ); break; } if( ret == 0 ) { printf( "\n\nEOF\n\n" ); break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); } while( 1 ); ssl_close_notify( &ssl ); exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( server_fd != -1 ) net_close( server_fd ); x509_crt_free( &cacert ); ssl_free( &ssl ); entropy_free( &entropy ); memset( &ssl, 0, sizeof( ssl ) ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { FILE *f; int ret, c; size_t i, olen = 0; pk_context pk; entropy_context entropy; ctr_drbg_context ctr_drbg; unsigned char result[1024]; unsigned char buf[512]; const char *pers = "pk_decrypt"; ((void) argv); memset(result, 0, sizeof( result ) ); ret = 1; if( argc != 2 ) { printf( "usage: pk_decrypt <key_file>\n" ); #if defined(_WIN32) printf( "\n" ); #endif goto exit; } printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( "\n . Reading private key from '%s'", argv[1] ); fflush( stdout ); pk_init( &pk ); if( ( ret = pk_parse_keyfile( &pk, argv[1], "" ) ) != 0 ) { printf( " failed\n ! pk_parse_keyfile returned -0x%04x\n", -ret ); goto exit; } /* * Extract the RSA encrypted value from the text file */ ret = 1; if( ( f = fopen( "result-enc.txt", "rb" ) ) == NULL ) { printf( "\n ! Could not open %s\n\n", "result-enc.txt" ); goto exit; } i = 0; while( fscanf( f, "%02X", &c ) > 0 && i < (int) sizeof( buf ) ) buf[i++] = (unsigned char) c; fclose( f ); /* * Decrypt the encrypted RSA data and print the result. */ printf( "\n . Decrypting the encrypted data" ); fflush( stdout ); if( ( ret = pk_decrypt( &pk, buf, i, result, &olen, sizeof(result), ctr_drbg_random, &ctr_drbg ) ) != 0 ) { printf( " failed\n ! pk_decrypt returned -0x%04x\n", -ret ); goto exit; } printf( "\n . OK\n\n" ); printf( "The decrypted result is: '%s'\n\n", result ); ret = 0; exit: entropy_free( &entropy ); #if defined(POLARSSL_ERROR_C) polarssl_strerror( ret, (char *) buf, sizeof(buf) ); printf( " ! Last error was: %s\n", buf ); #endif #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret; ecdsa_context ctx_sign, ctx_verify; entropy_context entropy; ctr_drbg_context ctr_drbg; unsigned char hash[] = "This should be the hash of a message."; unsigned char sig[512]; size_t sig_len; const char *pers = "ecdsa"; ((void) argv); ecdsa_init( &ctx_sign ); ecdsa_init( &ctx_verify ); memset(sig, 0, sizeof( sig ) ); ret = 1; if( argc != 1 ) { polarssl_printf( "usage: ecdsa\n" ); #if defined(_WIN32) polarssl_printf( "\n" ); #endif goto exit; } /* * Generate a key pair for signing */ polarssl_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { polarssl_printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } polarssl_printf( " ok\n . Generating key pair..." ); fflush( stdout ); if( ( ret = ecdsa_genkey( &ctx_sign, ECPARAMS, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { polarssl_printf( " failed\n ! ecdsa_genkey returned %d\n", ret ); goto exit; } polarssl_printf( " ok (key size: %d bits)\n", (int) ctx_sign.grp.pbits ); dump_pubkey( " + Public key: ", &ctx_sign ); /* * Sign some message hash */ polarssl_printf( " . Signing message..." ); fflush( stdout ); if( ( ret = ecdsa_write_signature( &ctx_sign, hash, sizeof( hash ), sig, &sig_len, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { polarssl_printf( " failed\n ! ecdsa_genkey returned %d\n", ret ); goto exit; } polarssl_printf( " ok (signature length = %u)\n", (unsigned int) sig_len ); dump_buf( " + Hash: ", hash, sizeof hash ); dump_buf( " + Signature: ", sig, sig_len ); /* * Signature is serialized as defined by RFC 4492 p. 20, * but one can also access 'r' and 's' directly from the context */ #ifdef POLARSSL_FS_IO mpi_write_file( " r = ", &ctx_sign.r, 16, NULL ); mpi_write_file( " s = ", &ctx_sign.s, 16, NULL ); #endif /* * Transfer public information to verifying context * * We could use the same context for verification and signatures, but we * chose to use a new one in order to make it clear that the verifying * context only needs the public key (Q), and not the private key (d). */ polarssl_printf( " . Preparing verification context..." ); fflush( stdout ); if( ( ret = ecp_group_copy( &ctx_verify.grp, &ctx_sign.grp ) ) != 0 ) { polarssl_printf( " failed\n ! ecp_group_copy returned %d\n", ret ); goto exit; } if( ( ret = ecp_copy( &ctx_verify.Q, &ctx_sign.Q ) ) != 0 ) { polarssl_printf( " failed\n ! ecp_copy returned %d\n", ret ); goto exit; } ret = 0; /* * Verify signature */ polarssl_printf( " ok\n . Verifying signature..." ); fflush( stdout ); if( ( ret = ecdsa_read_signature( &ctx_verify, hash, sizeof( hash ), sig, sig_len ) ) != 0 ) { polarssl_printf( " failed\n ! ecdsa_read_signature returned %d\n", ret ); goto exit; } polarssl_printf( " ok\n" ); exit: #if defined(_WIN32) polarssl_printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif ecdsa_free( &ctx_verify ); ecdsa_free( &ctx_sign ); ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); return( ret ); }
int rand_bytes(uint8_t *output, int len) { #if defined(USE_CRYPTO_OPENSSL) return RAND_bytes(output, len); #elif defined(USE_CRYPTO_POLARSSL) static entropy_context ec = {}; static ctr_drbg_context cd_ctx = {}; static unsigned char rand_initialised = 0; const size_t blen = min(len, CTR_DRBG_MAX_REQUEST); if (!rand_initialised) { #ifdef _WIN32 HCRYPTPROV hProvider; union { unsigned __int64 seed; BYTE buffer[8]; } rand_buffer; hProvider = 0; if (CryptAcquireContext(&hProvider, 0, 0, PROV_RSA_FULL, \ CRYPT_VERIFYCONTEXT | CRYPT_SILENT)) { CryptGenRandom(hProvider, 8, rand_buffer.buffer); CryptReleaseContext(hProvider, 0); } else { rand_buffer.seed = (unsigned __int64)clock(); } #else FILE *urand; union { uint64_t seed; uint8_t buffer[8]; } rand_buffer; urand = fopen("/dev/urandom", "r"); if (urand) { int read = fread(&rand_buffer.seed, sizeof(rand_buffer.seed), 1, urand); fclose(urand); if (read <= 0) { rand_buffer.seed = (uint64_t)clock(); } } else { rand_buffer.seed = (uint64_t)clock(); } #endif entropy_init(&ec); if (ctr_drbg_init(&cd_ctx, entropy_func, &ec, (const unsigned char *)rand_buffer.buffer, 8) != 0) { #if POLARSSL_VERSION_NUMBER >= 0x01030000 entropy_free(&ec); #endif FATAL("Failed to initialize random generator"); } rand_initialised = 1; } while (len > 0) { if (ctr_drbg_random(&cd_ctx, output, blen) != 0) { return 0; } output += blen; len -= blen; } return 1; #elif defined(USE_CRYPTO_MBEDTLS) static mbedtls_entropy_context ec = {}; // XXX: ctr_drbg_context changed, [if defined(MBEDTLS_THREADING_C) mbedtls_threading_mutex_t mutex;] static mbedtls_ctr_drbg_context cd_ctx = {}; static unsigned char rand_initialised = 0; const size_t blen = min(len, MBEDTLS_CTR_DRBG_MAX_REQUEST); if (!rand_initialised) { #ifdef _WIN32 HCRYPTPROV hProvider; union { unsigned __int64 seed; BYTE buffer[8]; } rand_buffer; hProvider = 0; if (CryptAcquireContext(&hProvider, 0, 0, PROV_RSA_FULL, \ CRYPT_VERIFYCONTEXT | CRYPT_SILENT)) { CryptGenRandom(hProvider, 8, rand_buffer.buffer); CryptReleaseContext(hProvider, 0); } else { rand_buffer.seed = (unsigned __int64)clock(); } #else FILE *urand; union { uint64_t seed; uint8_t buffer[8]; } rand_buffer; urand = fopen("/dev/urandom", "r"); if (urand) { int read = fread(&rand_buffer.seed, sizeof(rand_buffer.seed), 1, urand); fclose(urand); if (read <= 0) { rand_buffer.seed = (uint64_t)clock(); } } else { rand_buffer.seed = (uint64_t)clock(); } #endif mbedtls_entropy_init(&ec); // XXX: ctr_drbg_init changed, seems we should initialize it before calling mbedtls_ctr_drbg_seed() mbedtls_ctr_drbg_init(&cd_ctx); if (mbedtls_ctr_drbg_seed(&cd_ctx, mbedtls_entropy_func, &ec, (const unsigned char *)rand_buffer.buffer, 8) != 0) { mbedtls_entropy_free(&ec); FATAL("mbed TLS: Failed to initialize random generator"); } rand_initialised = 1; } while (len > 0) { if (mbedtls_ctr_drbg_random(&cd_ctx, output, blen) != 0) { return 0; } output += blen; len -= blen; } return 1; #endif }
/* * The actual entropy quality is hard to test, but we can at least * test that the functions don't cause errors and write the correct * amount of data to buffers. */ int entropy_self_test( int verbose ) { int ret = 0; entropy_context ctx; unsigned char buf[ENTROPY_BLOCK_SIZE] = { 0 }; unsigned char acc[ENTROPY_BLOCK_SIZE] = { 0 }; size_t i, j; if( verbose != 0 ) polarssl_printf( " ENTROPY test: " ); entropy_init( &ctx ); ret = entropy_add_source( &ctx, entropy_dummy_source, NULL, 16 ); if( ret != 0 ) goto cleanup; if( ( ret = entropy_gather( &ctx ) ) != 0 ) goto cleanup; if( ( ret = entropy_update_manual( &ctx, buf, sizeof buf ) ) != 0 ) goto cleanup; /* * To test that entropy_func writes correct number of bytes: * - use the whole buffer and rely on ASan to detect overruns * - collect entropy 8 times and OR the result in an accumulator: * any byte should then be 0 with probably 2^(-64), so requiring * each of the 32 or 64 bytes to be non-zero has a false failure rate * of at most 2^(-58) which is acceptable. */ for( i = 0; i < 8; i++ ) { if( ( ret = entropy_func( &ctx, buf, sizeof( buf ) ) ) != 0 ) goto cleanup; for( j = 0; j < sizeof( buf ); j++ ) acc[j] |= buf[j]; } for( j = 0; j < sizeof( buf ); j++ ) { if( acc[j] == 0 ) { ret = 1; goto cleanup; } } cleanup: entropy_free( &ctx ); if( verbose != 0 ) { if( ret != 0 ) polarssl_printf( "failed\n" ); else polarssl_printf( "passed\n" ); polarssl_printf( "\n" ); } return( ret != 0 ); }
bool CWII_IPC_HLE_Device_net_ssl::IOCtlV(u32 _CommandAddress) { SIOCtlVBuffer CommandBuffer(_CommandAddress); u32 _BufferIn = 0, _BufferIn2 = 0, _BufferIn3 = 0; u32 BufferInSize = 0, BufferInSize2 = 0, BufferInSize3 = 0; u32 BufferOut = 0, BufferOut2 = 0, BufferOut3 = 0; u32 BufferOutSize = 0, BufferOutSize2 = 0, BufferOutSize3 = 0; if (CommandBuffer.InBuffer.size() > 0) { _BufferIn = CommandBuffer.InBuffer.at(0).m_Address; BufferInSize = CommandBuffer.InBuffer.at(0).m_Size; } if (CommandBuffer.InBuffer.size() > 1) { _BufferIn2 = CommandBuffer.InBuffer.at(1).m_Address; BufferInSize2 = CommandBuffer.InBuffer.at(1).m_Size; } if (CommandBuffer.InBuffer.size() > 2) { _BufferIn3 = CommandBuffer.InBuffer.at(2).m_Address; BufferInSize3 = CommandBuffer.InBuffer.at(2).m_Size; } if (CommandBuffer.PayloadBuffer.size() > 0) { BufferOut = CommandBuffer.PayloadBuffer.at(0).m_Address; BufferOutSize = CommandBuffer.PayloadBuffer.at(0).m_Size; } if (CommandBuffer.PayloadBuffer.size() > 1) { BufferOut2 = CommandBuffer.PayloadBuffer.at(1).m_Address; BufferOutSize2 = CommandBuffer.PayloadBuffer.at(1).m_Size; } if (CommandBuffer.PayloadBuffer.size() > 2) { BufferOut3 = CommandBuffer.PayloadBuffer.at(2).m_Address; BufferOutSize3 = CommandBuffer.PayloadBuffer.at(2).m_Size; } switch (CommandBuffer.Parameter) { case IOCTLV_NET_SSL_NEW: { int verifyOption = Memory::Read_U32(BufferOut); const char * hostname = (const char*) Memory::GetPointer(BufferOut2); int freeSSL = this->getSSLFreeID(); if (freeSSL) { int sslID = freeSSL - 1; int ret = ssl_init(&_SSL[sslID].ctx); if (ret) { // Cleanup possibly dirty ctx memset(&_SSL[sslID].ctx, 0, sizeof(ssl_context)); goto _SSL_NEW_ERROR; } entropy_init(&_SSL[sslID].entropy); const char* pers = "dolphin-emu"; ret = ctr_drbg_init(&_SSL[sslID].ctr_drbg, entropy_func, &_SSL[sslID].entropy, (const unsigned char*)pers, strlen(pers)); if (ret) { ssl_free(&_SSL[sslID].ctx); // Cleanup possibly dirty ctx memset(&_SSL[sslID].ctx, 0, sizeof(ssl_context)); entropy_free(&_SSL[sslID].entropy); goto _SSL_NEW_ERROR; } ssl_set_rng(&_SSL[sslID].ctx, ctr_drbg_random, &_SSL[sslID].ctr_drbg); // For some reason we can't use TLSv1.2, v1.1 and below are fine! ssl_set_max_version(&_SSL[sslID].ctx, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); ssl_set_session(&_SSL[sslID].ctx, &_SSL[sslID].session); ssl_set_endpoint(&_SSL[sslID].ctx, SSL_IS_CLIENT); ssl_set_authmode(&_SSL[sslID].ctx, SSL_VERIFY_NONE); ssl_set_renegotiation(&_SSL[sslID].ctx, SSL_RENEGOTIATION_ENABLED); memcpy(_SSL[sslID].hostname, hostname, min((int)BufferOutSize2, NET_SSL_MAX_HOSTNAME_LEN)); _SSL[sslID].hostname[NET_SSL_MAX_HOSTNAME_LEN-1] = '\0'; ssl_set_hostname(&_SSL[sslID].ctx, _SSL[sslID].hostname); _SSL[sslID].active = true; Memory::Write_U32(freeSSL, _BufferIn); } else { _SSL_NEW_ERROR: Memory::Write_U32(SSL_ERR_FAILED, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_NEW (%d, %s) " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", verifyOption, hostname, _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_SHUTDOWN: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { ssl_close_notify(&_SSL[sslID].ctx); ssl_session_free(&_SSL[sslID].session); ssl_free(&_SSL[sslID].ctx); entropy_free(&_SSL[sslID].entropy); x509_crt_free(&_SSL[sslID].cacert); x509_crt_free(&_SSL[sslID].clicert); memset(&_SSL[sslID].ctx, 0, sizeof(ssl_context)); memset(&_SSL[sslID].session, 0, sizeof(ssl_session)); memset(&_SSL[sslID].entropy, 0, sizeof(entropy_context)); memset(_SSL[sslID].hostname, 0, NET_SSL_MAX_HOSTNAME_LEN); _SSL[sslID].active = false; Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SHUTDOWN " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_SETROOTCA: { INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETROOTCA " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { int ret = x509_crt_parse_der( &_SSL[sslID].cacert, Memory::GetPointer(BufferOut2), BufferOutSize2); if (ret) { Memory::Write_U32(SSL_ERR_FAILED, _BufferIn); } else { ssl_set_ca_chain(&_SSL[sslID].ctx, &_SSL[sslID].cacert, NULL, _SSL[sslID].hostname); Memory::Write_U32(SSL_OK, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETROOTCA = %d", ret); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } break; } case IOCTLV_NET_SSL_SETBUILTINCLIENTCERT: { INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINCLIENTCERT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { std::string cert_base_path(File::GetUserPath(D_WIIUSER_IDX)); int ret = x509_crt_parse_file(&_SSL[sslID].clicert, (cert_base_path + "clientca.pem").c_str()); int pk_ret = pk_parse_keyfile(&_SSL[sslID].pk, (cert_base_path + "clientcakey.pem").c_str(), NULL); if (ret || pk_ret) { x509_crt_free(&_SSL[sslID].clicert); pk_free(&_SSL[sslID].pk); memset(&_SSL[sslID].clicert, 0, sizeof(x509_crt)); memset(&_SSL[sslID].pk, 0, sizeof(pk_context)); Memory::Write_U32(SSL_ERR_FAILED, _BufferIn); } else { ssl_set_own_cert(&_SSL[sslID].ctx, &_SSL[sslID].clicert, &_SSL[sslID].pk); Memory::Write_U32(SSL_OK, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINCLIENTCERT = (%d, %d)", ret, pk_ret); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINCLIENTCERT invalid sslID = %d", sslID); } break; } case IOCTLV_NET_SSL_REMOVECLIENTCERT: { INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_REMOVECLIENTCERT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { x509_crt_free(&_SSL[sslID].clicert); pk_free(&_SSL[sslID].pk); memset(&_SSL[sslID].clicert, 0, sizeof(x509_crt)); memset(&_SSL[sslID].pk, 0, sizeof(pk_context)); ssl_set_own_cert(&_SSL[sslID].ctx, NULL, NULL); Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINCLIENTCERT invalid sslID = %d", sslID); } break; } case IOCTLV_NET_SSL_SETBUILTINROOTCA: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { std::string cert_base_path(File::GetUserPath(D_WIIUSER_IDX)); int ret = x509_crt_parse_file(&_SSL[sslID].cacert, (cert_base_path + "rootca.pem").c_str()); if (ret) { x509_crt_free(&_SSL[sslID].clicert); Memory::Write_U32(SSL_ERR_FAILED, _BufferIn); } else { ssl_set_ca_chain(&_SSL[sslID].ctx, &_SSL[sslID].cacert, NULL, _SSL[sslID].hostname); Memory::Write_U32(SSL_OK, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINROOTCA = %d", ret); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINROOTCA " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_CONNECT: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { _SSL[sslID].sockfd = Memory::Read_U32(BufferOut2); INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_CONNECT socket = %d", _SSL[sslID].sockfd); ssl_set_bio(&_SSL[sslID].ctx, net_recv, &_SSL[sslID].sockfd, net_send, &_SSL[sslID].sockfd); Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_CONNECT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_DOHANDSHAKE: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { WiiSockMan &sm = WiiSockMan::getInstance(); sm.doSock(_SSL[sslID].sockfd, _CommandAddress, IOCTLV_NET_SSL_DOHANDSHAKE); return false; } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } break; } case IOCTLV_NET_SSL_WRITE: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { WiiSockMan &sm = WiiSockMan::getInstance(); sm.doSock(_SSL[sslID].sockfd, _CommandAddress, IOCTLV_NET_SSL_WRITE); return false; } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_WRITE " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); INFO_LOG(WII_IPC_SSL, "%s", Memory::GetPointer(BufferOut2)); break; } case IOCTLV_NET_SSL_READ: { int ret = 0; int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { WiiSockMan &sm = WiiSockMan::getInstance(); sm.doSock(_SSL[sslID].sockfd, _CommandAddress, IOCTLV_NET_SSL_READ); return false; } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_READ(%d)" "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", ret, _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_SETROOTCADEFAULT: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETROOTCADEFAULT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_SETCLIENTCERTDEFAULT: { INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETCLIENTCERTDEFAULT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } break; } default: ERROR_LOG(WII_IPC_SSL, "%i " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", CommandBuffer.Parameter, _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } // SSL return codes are written to BufferIn Memory::Write_U32(0, _CommandAddress+4); return true; }
int main( int argc, char *argv[] ) { int ret, len, cnt = 0, pid; int listen_fd; int client_fd; unsigned char buf[1024]; const char *pers = "ssl_fork_server"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_cert srvcert; rsa_context rsa; ((void) argc); ((void) argv); signal( SIGCHLD, SIG_IGN ); /* * 0. Initial seeding of the RNG */ printf( "\n . Initial seeding of the random generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n" ); /* * 1. Load the certificates and private RSA key */ printf( " . Loading the server cert. and key..." ); fflush( stdout ); memset( &srvcert, 0, sizeof( x509_cert ) ); /* * This demonstration program uses embedded test certificates. * Instead, you may want to use x509parse_crtfile() to read the * server and CA certificates, as well as x509parse_keyfile(). */ ret = x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } ret = x509parse_crt( &srvcert, (const unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } rsa_init( &rsa, RSA_PKCS_V15, 0 ); ret = x509parse_key( &rsa, (const unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! x509parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup the listening TCP socket */ printf( " . Bind on https://localhost:4433/ ..." ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 ) { printf( " failed\n ! net_bind returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); while( 1 ) { /* * 3. Wait until a client connects */ client_fd = -1; memset( &ssl, 0, sizeof( ssl ) ); printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 3.5. Forking server thread */ pid = fork(); printf( " . Forking to handle connection ..." ); fflush( stdout ); if( pid < 0 ) { printf(" failed\n ! fork returned %d\n\n", pid ); goto exit; } printf( " ok\n" ); if( pid != 0 ) { if( ( ret = ctr_drbg_reseed( &ctr_drbg, (const unsigned char *) "parent", 6 ) ) != 0 ) { printf( " failed\n ! ctr_drbg_reseed returned %d\n", ret ); goto exit; } close( client_fd ); continue; } close( listen_fd ); /* * 4. Setup stuff */ printf( " . Setting up the SSL data...." ); fflush( stdout ); if( ( ret = ctr_drbg_reseed( &ctr_drbg, (const unsigned char *) "child", 5 ) ) != 0 ) { printf( " failed\n ! ctr_drbg_reseed returned %d\n", ret ); goto exit; } if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); ssl_set_ca_chain( &ssl, srvcert.next, NULL, NULL ); ssl_set_own_cert( &ssl, &srvcert, &rsa ); /* * 5. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned %d\n\n", ret ); goto exit; } } printf( " ok\n" ); /* * 6. Read the HTTP Request */ printf( " < Read from client:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned %d\n", ret ); break; } break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); } while( 0 ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_ciphersuite( &ssl ) ); while( cnt < 100 ) { while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " failed\n ! peer closed the connection\n\n" ); goto exit; } if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s\n", len, (char *) buf ); m_sleep( 1000 ); } ssl_close_notify( &ssl ); goto exit; } exit: net_close( client_fd ); x509_free( &srvcert ); rsa_free( &rsa ); ssl_free( &ssl ); #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0, len; int listen_fd; int client_fd = -1; unsigned char buf[1024]; const char *pers = "ssl_server2"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_cert cacert; x509_cert srvcert; rsa_context rsa; #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_context cache; #endif int i; char *p, *q; const int *list; /* * Make sure memory references are valid. */ listen_fd = 0; memset( &cacert, 0, sizeof( x509_cert ) ); memset( &srvcert, 0, sizeof( x509_cert ) ); memset( &rsa, 0, sizeof( rsa_context ) ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_init( &cache ); #endif if( argc == 0 ) { usage: if( ret == 0 ) ret = 1; printf( USAGE ); list = ssl_list_ciphersuites(); while( *list ) { printf(" %s\n", ssl_get_ciphersuite_name( *list ) ); list++; } printf("\n"); goto exit; } opt.server_port = DFL_SERVER_PORT; opt.debug_level = DFL_DEBUG_LEVEL; opt.ca_file = DFL_CA_FILE; opt.ca_path = DFL_CA_PATH; opt.crt_file = DFL_CRT_FILE; opt.key_file = DFL_KEY_FILE; opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; opt.renegotiation = DFL_RENEGOTIATION; opt.allow_legacy = DFL_ALLOW_LEGACY; opt.min_version = DFL_MIN_VERSION; opt.auth_mode = DFL_AUTH_MODE; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "server_port" ) == 0 ) { opt.server_port = atoi( q ); if( opt.server_port < 1 || opt.server_port > 65535 ) goto usage; } else if( strcmp( p, "debug_level" ) == 0 ) { opt.debug_level = atoi( q ); if( opt.debug_level < 0 || opt.debug_level > 65535 ) goto usage; } else if( strcmp( p, "ca_file" ) == 0 ) opt.ca_file = q; else if( strcmp( p, "ca_path" ) == 0 ) opt.ca_path = q; else if( strcmp( p, "crt_file" ) == 0 ) opt.crt_file = q; else if( strcmp( p, "key_file" ) == 0 ) opt.key_file = q; else if( strcmp( p, "force_ciphersuite" ) == 0 ) { opt.force_ciphersuite[0] = -1; opt.force_ciphersuite[0] = ssl_get_ciphersuite_id( q ); if( opt.force_ciphersuite[0] <= 0 ) { ret = 2; goto usage; } opt.force_ciphersuite[1] = 0; } else if( strcmp( p, "renegotiation" ) == 0 ) { opt.renegotiation = (atoi( q )) ? SSL_RENEGOTIATION_ENABLED : SSL_RENEGOTIATION_DISABLED; } else if( strcmp( p, "allow_legacy" ) == 0 ) { opt.allow_legacy = atoi( q ); if( opt.allow_legacy < 0 || opt.allow_legacy > 1 ) goto usage; } else if( strcmp( p, "min_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "auth_mode" ) == 0 ) { if( strcmp( q, "none" ) == 0 ) opt.auth_mode = SSL_VERIFY_NONE; else if( strcmp( q, "optional" ) == 0 ) opt.auth_mode = SSL_VERIFY_OPTIONAL; else if( strcmp( q, "required" ) == 0 ) opt.auth_mode = SSL_VERIFY_REQUIRED; else goto usage; } else goto usage; } /* * 0. Initialize the RNG and the session data */ printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned -0x%x\n", -ret ); goto exit; } printf( " ok\n" ); /* * 1.1. Load the trusted CA */ printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.ca_path ) ) ret = x509parse_crtpath( &cacert, opt.ca_path ); else if( strlen( opt.ca_file ) ) ret = x509parse_crtfile( &cacert, opt.ca_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_crt( &cacert, (const unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret < 0 ) { printf( " failed\n ! x509parse_crt returned -0x%x\n\n", -ret ); goto exit; } printf( " ok (%d skipped)\n", ret ); /* * 1.2. Load own certificate and private key */ printf( " . Loading the server cert. and key..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.crt_file ) ) ret = x509parse_crtfile( &srvcert, opt.crt_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned -0x%x\n\n", -ret ); goto exit; } #if defined(POLARSSL_FS_IO) if( strlen( opt.key_file ) ) ret = x509parse_keyfile( &rsa, opt.key_file, "" ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_key( &rsa, (const unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { printf( " failed\n ! x509parse_key returned -0x%x\n\n", -ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup the listening TCP socket */ printf( " . Bind on tcp://localhost:%-4d/ ...", opt.server_port ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, opt.server_port ) ) != 0 ) { printf( " failed\n ! net_bind returned -0x%x\n\n", -ret ); goto exit; } printf( " ok\n" ); /* * 3. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned -0x%x\n\n", -ret ); goto exit; } ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, opt.auth_mode ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); #if defined(POLARSSL_SSL_CACHE_C) ssl_set_session_cache( &ssl, ssl_cache_get, &cache, ssl_cache_set, &cache ); #endif if( opt.force_ciphersuite[0] == DFL_FORCE_CIPHER ) ssl_set_ciphersuites( &ssl, my_ciphersuites ); else ssl_set_ciphersuites( &ssl, opt.force_ciphersuite ); ssl_set_renegotiation( &ssl, opt.renegotiation ); ssl_legacy_renegotiation( &ssl, opt.allow_legacy ); ssl_set_ca_chain( &ssl, &cacert, NULL, NULL ); ssl_set_own_cert( &ssl, &srvcert, &rsa ); #if defined(POLARSSL_DHM_C) /* * Use different group than default DHM group */ ssl_set_dh_param( &ssl, POLARSSL_DHM_RFC5114_MODP_2048_P, POLARSSL_DHM_RFC5114_MODP_2048_G ); #endif if( opt.min_version != -1 ) ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version ); printf( " ok\n" ); reset: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; error_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( client_fd != -1 ) net_close( client_fd ); ssl_session_reset( &ssl ); /* * 3. Wait until a client connects */ #if defined(_WIN32_WCE) { SHELLEXECUTEINFO sei; ZeroMemory( &sei, sizeof( SHELLEXECUTEINFO ) ); sei.cbSize = sizeof( SHELLEXECUTEINFO ); sei.fMask = 0; sei.hwnd = 0; sei.lpVerb = _T( "open" ); sei.lpFile = _T( "https://localhost:4433/" ); sei.lpParameters = NULL; sei.lpDirectory = NULL; sei.nShow = SW_SHOWNORMAL; ShellExecuteEx( &sei ); } #elif defined(_WIN32) ShellExecute( NULL, "open", "https://localhost:4433/", NULL, NULL, SW_SHOWNORMAL ); #endif client_fd = -1; printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned -0x%x\n\n", -ret ); goto exit; } ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); printf( " ok\n" ); /* * 4. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto reset; } } printf( " ok\n [ Ciphersuite is %s ]\n", ssl_get_ciphersuite( &ssl ) ); /* * 5. Verify the server certificate */ printf( " . Verifying peer X.509 certificate..." ); if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( " failed\n" ); if( !ssl_get_peer_cert( &ssl ) ) printf( " ! no client certificate sent\n" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! client certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! client certificate has been revoked\n" ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n" ); } else printf( " ok\n" ); if( ssl_get_peer_cert( &ssl ) ) { printf( " . Peer certificate information ...\n" ); x509parse_cert_info( (char *) buf, sizeof( buf ) - 1, " ", ssl_get_peer_cert( &ssl ) ); printf( "%s\n", buf ); } /* * 6. Read the HTTP Request */ printf( " < Read from client:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned -0x%x\n", -ret ); break; } break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); if( ret > 0 ) break; } while( 1 ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_ciphersuite( &ssl ) ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " failed\n ! peer closed the connection\n\n" ); goto reset; } if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s\n", len, (char *) buf ); ret = 0; goto reset; exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; error_strerror( ret, error_buf, 100 ); printf("Last error was: -0x%X - %s\n\n", -ret, error_buf ); } #endif net_close( client_fd ); x509_free( &srvcert ); x509_free( &cacert ); rsa_free( &rsa ); ssl_free( &ssl ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_free( &cache ); #endif #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { FILE *f; int ret; rsa_context rsa; entropy_context entropy; ctr_drbg_context ctr_drbg; unsigned char hash[20]; unsigned char buf[POLARSSL_MPI_MAX_SIZE]; char filename[512]; const char *pers = "rsa_sign_pss"; ret = 1; if( argc != 3 ) { printf( "usage: rsa_sign_pss <key_file> <filename>\n" ); #if defined(_WIN32) printf( "\n" ); #endif goto exit; } printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( "\n . Reading private key from '%s'", argv[1] ); fflush( stdout ); rsa_init( &rsa, RSA_PKCS_V21, POLARSSL_MD_SHA1 ); if( ( ret = x509parse_keyfile( &rsa, argv[1], "" ) ) != 0 ) { ret = 1; printf( " failed\n ! Could not open '%s'\n", argv[1] ); goto exit; } /* * Compute the SHA-1 hash of the input file, * then calculate the RSA signature of the hash. */ printf( "\n . Generating the RSA/SHA-1 signature" ); fflush( stdout ); if( ( ret = sha1_file( argv[2], hash ) ) != 0 ) { printf( " failed\n ! Could not open or read %s\n\n", argv[2] ); goto exit; } if( ( ret = rsa_pkcs1_sign( &rsa, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, SIG_RSA_SHA1, 20, hash, buf ) ) != 0 ) { printf( " failed\n ! rsa_pkcs1_sign returned %d\n\n", ret ); goto exit; } /* * Write the signature into <filename>-sig.txt */ snprintf( filename, 512, "%s.sig", argv[2] ); if( ( f = fopen( filename, "wb+" ) ) == NULL ) { ret = 1; printf( " failed\n ! Could not create %s\n\n", filename ); goto exit; } if( fwrite( buf, 1, rsa.len, f ) != (size_t) rsa.len ) { printf( "failed\n ! fwrite failed\n\n" ); goto exit; } fclose( f ); printf( "\n . Done (created \"%s\")\n\n", filename ); exit: #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0, len, tail_len, server_fd, i, written, frags; unsigned char buf[SSL_MAX_CONTENT_LEN + 1]; #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) unsigned char psk[POLARSSL_PSK_MAX_LEN]; size_t psk_len = 0; #endif #if defined(POLARSSL_SSL_ALPN) const char *alpn_list[10]; #endif const char *pers = "ssl_client2"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; ssl_session saved_session; #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt cacert; x509_crt clicert; pk_context pkey; #endif char *p, *q; const int *list; /* * Make sure memory references are valid. */ server_fd = 0; memset( &ssl, 0, sizeof( ssl_context ) ); memset( &saved_session, 0, sizeof( ssl_session ) ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_init( &cacert ); x509_crt_init( &clicert ); pk_init( &pkey ); #endif #if defined(POLARSSL_SSL_ALPN) memset( (void * ) alpn_list, 0, sizeof( alpn_list ) ); #endif if( argc == 0 ) { usage: if( ret == 0 ) ret = 1; polarssl_printf( USAGE ); list = ssl_list_ciphersuites(); while( *list ) { polarssl_printf(" %-42s", ssl_get_ciphersuite_name( *list ) ); list++; if( !*list ) break; polarssl_printf(" %s\n", ssl_get_ciphersuite_name( *list ) ); list++; } polarssl_printf("\n"); goto exit; } opt.server_name = DFL_SERVER_NAME; opt.server_addr = DFL_SERVER_ADDR; opt.server_port = DFL_SERVER_PORT; opt.debug_level = DFL_DEBUG_LEVEL; opt.nbio = DFL_NBIO; opt.request_page = DFL_REQUEST_PAGE; opt.request_size = DFL_REQUEST_SIZE; opt.ca_file = DFL_CA_FILE; opt.ca_path = DFL_CA_PATH; opt.crt_file = DFL_CRT_FILE; opt.key_file = DFL_KEY_FILE; opt.psk = DFL_PSK; opt.psk_identity = DFL_PSK_IDENTITY; opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; opt.renegotiation = DFL_RENEGOTIATION; opt.allow_legacy = DFL_ALLOW_LEGACY; opt.renegotiate = DFL_RENEGOTIATE; opt.exchanges = DFL_EXCHANGES; opt.min_version = DFL_MIN_VERSION; opt.max_version = DFL_MAX_VERSION; opt.arc4 = DFL_ARC4; opt.auth_mode = DFL_AUTH_MODE; opt.mfl_code = DFL_MFL_CODE; opt.trunc_hmac = DFL_TRUNC_HMAC; opt.recsplit = DFL_RECSPLIT; opt.reconnect = DFL_RECONNECT; opt.reco_delay = DFL_RECO_DELAY; opt.tickets = DFL_TICKETS; opt.alpn_string = DFL_ALPN_STRING; opt.fallback = DFL_FALLBACK; opt.extended_ms = DFL_EXTENDED_MS; opt.etm = DFL_ETM; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "server_name" ) == 0 ) opt.server_name = q; else if( strcmp( p, "server_addr" ) == 0 ) opt.server_addr = q; else if( strcmp( p, "server_port" ) == 0 ) { opt.server_port = atoi( q ); if( opt.server_port < 1 || opt.server_port > 65535 ) goto usage; } else if( strcmp( p, "debug_level" ) == 0 ) { opt.debug_level = atoi( q ); if( opt.debug_level < 0 || opt.debug_level > 65535 ) goto usage; } else if( strcmp( p, "nbio" ) == 0 ) { opt.nbio = atoi( q ); if( opt.nbio < 0 || opt.nbio > 2 ) goto usage; } else if( strcmp( p, "request_page" ) == 0 ) opt.request_page = q; else if( strcmp( p, "request_size" ) == 0 ) { opt.request_size = atoi( q ); if( opt.request_size < 0 || opt.request_size > SSL_MAX_CONTENT_LEN ) goto usage; } else if( strcmp( p, "ca_file" ) == 0 ) opt.ca_file = q; else if( strcmp( p, "ca_path" ) == 0 ) opt.ca_path = q; else if( strcmp( p, "crt_file" ) == 0 ) opt.crt_file = q; else if( strcmp( p, "key_file" ) == 0 ) opt.key_file = q; else if( strcmp( p, "psk" ) == 0 ) opt.psk = q; else if( strcmp( p, "psk_identity" ) == 0 ) opt.psk_identity = q; else if( strcmp( p, "force_ciphersuite" ) == 0 ) { opt.force_ciphersuite[0] = ssl_get_ciphersuite_id( q ); if( opt.force_ciphersuite[0] == 0 ) { ret = 2; goto usage; } opt.force_ciphersuite[1] = 0; } else if( strcmp( p, "renegotiation" ) == 0 ) { opt.renegotiation = (atoi( q )) ? SSL_RENEGOTIATION_ENABLED : SSL_RENEGOTIATION_DISABLED; } else if( strcmp( p, "allow_legacy" ) == 0 ) { switch( atoi( q ) ) { case -1: opt.allow_legacy = SSL_LEGACY_BREAK_HANDSHAKE; break; case 0: opt.allow_legacy = SSL_LEGACY_NO_RENEGOTIATION; break; case 1: opt.allow_legacy = SSL_LEGACY_ALLOW_RENEGOTIATION; break; default: goto usage; } } else if( strcmp( p, "renegotiate" ) == 0 ) { opt.renegotiate = atoi( q ); if( opt.renegotiate < 0 || opt.renegotiate > 1 ) goto usage; } else if( strcmp( p, "exchanges" ) == 0 ) { opt.exchanges = atoi( q ); if( opt.exchanges < 1 ) goto usage; } else if( strcmp( p, "reconnect" ) == 0 ) { opt.reconnect = atoi( q ); if( opt.reconnect < 0 || opt.reconnect > 2 ) goto usage; } else if( strcmp( p, "reco_delay" ) == 0 ) { opt.reco_delay = atoi( q ); if( opt.reco_delay < 0 ) goto usage; } else if( strcmp( p, "tickets" ) == 0 ) { opt.tickets = atoi( q ); if( opt.tickets < 0 || opt.tickets > 2 ) goto usage; } else if( strcmp( p, "alpn" ) == 0 ) { opt.alpn_string = q; } else if( strcmp( p, "fallback" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.fallback = SSL_IS_NOT_FALLBACK; break; case 1: opt.fallback = SSL_IS_FALLBACK; break; default: goto usage; } } else if( strcmp( p, "extended_ms" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.extended_ms = SSL_EXTENDED_MS_DISABLED; break; case 1: opt.extended_ms = SSL_EXTENDED_MS_ENABLED; break; default: goto usage; } } else if( strcmp( p, "etm" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.etm = SSL_ETM_DISABLED; break; case 1: opt.etm = SSL_ETM_ENABLED; break; default: goto usage; } } else if( strcmp( p, "min_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "max_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "arc4" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.arc4 = SSL_ARC4_DISABLED; break; case 1: opt.arc4 = SSL_ARC4_ENABLED; break; default: goto usage; } } else if( strcmp( p, "force_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_0; opt.max_version = SSL_MINOR_VERSION_0; } else if( strcmp( q, "tls1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_1; opt.max_version = SSL_MINOR_VERSION_1; } else if( strcmp( q, "tls1_1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_2; opt.max_version = SSL_MINOR_VERSION_2; } else if( strcmp( q, "tls1_2" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_3; opt.max_version = SSL_MINOR_VERSION_3; } else goto usage; } else if( strcmp( p, "auth_mode" ) == 0 ) { if( strcmp( q, "none" ) == 0 ) opt.auth_mode = SSL_VERIFY_NONE; else if( strcmp( q, "optional" ) == 0 ) opt.auth_mode = SSL_VERIFY_OPTIONAL; else if( strcmp( q, "required" ) == 0 ) opt.auth_mode = SSL_VERIFY_REQUIRED; else goto usage; } else if( strcmp( p, "max_frag_len" ) == 0 ) { if( strcmp( q, "512" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_512; else if( strcmp( q, "1024" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_1024; else if( strcmp( q, "2048" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_2048; else if( strcmp( q, "4096" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_4096; else goto usage; } else if( strcmp( p, "trunc_hmac" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.trunc_hmac = SSL_TRUNC_HMAC_DISABLED; break; case 1: opt.trunc_hmac = SSL_TRUNC_HMAC_ENABLED; break; default: goto usage; } } else if( strcmp( p, "recsplit" ) == 0 ) { opt.recsplit = atoi( q ); if( opt.recsplit < 0 || opt.recsplit > 1 ) goto usage; } else goto usage; } #if defined(POLARSSL_DEBUG_C) debug_set_threshold( opt.debug_level ); #endif if( opt.force_ciphersuite[0] > 0 ) { const ssl_ciphersuite_t *ciphersuite_info; ciphersuite_info = ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); if( opt.max_version != -1 && ciphersuite_info->min_minor_ver > opt.max_version ) { polarssl_printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } if( opt.min_version != -1 && ciphersuite_info->max_minor_ver < opt.min_version ) { polarssl_printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } if( opt.max_version > ciphersuite_info->max_minor_ver ) opt.max_version = ciphersuite_info->max_minor_ver; if( opt.min_version < ciphersuite_info->min_minor_ver ) opt.min_version = ciphersuite_info->min_minor_ver; } #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) /* * Unhexify the pre-shared key if any is given */ if( strlen( opt.psk ) ) { unsigned char c; size_t j; if( strlen( opt.psk ) % 2 != 0 ) { polarssl_printf("pre-shared key not valid hex\n"); goto exit; } psk_len = strlen( opt.psk ) / 2; for( j = 0; j < strlen( opt.psk ); j += 2 ) { c = opt.psk[j]; if( c >= '0' && c <= '9' ) c -= '0'; else if( c >= 'a' && c <= 'f' ) c -= 'a' - 10; else if( c >= 'A' && c <= 'F' ) c -= 'A' - 10; else { polarssl_printf("pre-shared key not valid hex\n"); goto exit; } psk[ j / 2 ] = c << 4; c = opt.psk[j + 1]; if( c >= '0' && c <= '9' ) c -= '0'; else if( c >= 'a' && c <= 'f' ) c -= 'a' - 10; else if( c >= 'A' && c <= 'F' ) c -= 'A' - 10; else { polarssl_printf("pre-shared key not valid hex\n"); goto exit; } psk[ j / 2 ] |= c; } } #endif /* POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED */ #if defined(POLARSSL_SSL_ALPN) if( opt.alpn_string != NULL ) { p = (char *) opt.alpn_string; i = 0; /* Leave room for a final NULL in alpn_list */ while( i < (int) sizeof alpn_list - 1 && *p != '\0' ) { alpn_list[i++] = p; /* Terminate the current string and move on to next one */ while( *p != ',' && *p != '\0' ) p++; if( *p == ',' ) *p++ = '\0'; } } #endif /* POLARSSL_SSL_ALPN */ /* * 0. Initialize the RNG and the session data */ polarssl_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { polarssl_printf( " failed\n ! ctr_drbg_init returned -0x%x\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); #if defined(POLARSSL_X509_CRT_PARSE_C) /* * 1.1. Load the trusted CA */ polarssl_printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.ca_path ) ) if( strcmp( opt.ca_path, "none" ) == 0 ) ret = 0; else ret = x509_crt_parse_path( &cacert, opt.ca_path ); else if( strlen( opt.ca_file ) ) if( strcmp( opt.ca_file, "none" ) == 0 ) ret = 0; else ret = x509_crt_parse_file( &cacert, opt.ca_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509_crt_parse( &cacert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); #else { ret = 1; polarssl_printf("POLARSSL_CERTS_C not defined."); } #endif if( ret < 0 ) { polarssl_printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok (%d skipped)\n", ret ); /* * 1.2. Load own certificate and private key * * (can be skipped if client authentication is not required) */ polarssl_printf( " . Loading the client cert. and key..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.crt_file ) ) if( strcmp( opt.crt_file, "none" ) == 0 ) ret = 0; else ret = x509_crt_parse_file( &clicert, opt.crt_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509_crt_parse( &clicert, (const unsigned char *) test_cli_crt, strlen( test_cli_crt ) ); #else { ret = 1; polarssl_printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { polarssl_printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } #if defined(POLARSSL_FS_IO) if( strlen( opt.key_file ) ) if( strcmp( opt.key_file, "none" ) == 0 ) ret = 0; else ret = pk_parse_keyfile( &pkey, opt.key_file, "" ); else #endif #if defined(POLARSSL_CERTS_C) ret = pk_parse_key( &pkey, (const unsigned char *) test_cli_key, strlen( test_cli_key ), NULL, 0 ); #else { ret = 1; polarssl_printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { polarssl_printf( " failed\n ! pk_parse_key returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); #endif /* POLARSSL_X509_CRT_PARSE_C */ /* * 2. Start the connection */ if( opt.server_addr == NULL) opt.server_addr = opt.server_name; polarssl_printf( " . Connecting to tcp/%s/%-4d...", opt.server_addr, opt.server_port ); fflush( stdout ); if( ( ret = net_connect( &server_fd, opt.server_addr, opt.server_port ) ) != 0 ) { polarssl_printf( " failed\n ! net_connect returned -0x%x\n\n", -ret ); goto exit; } if( opt.nbio > 0 ) ret = net_set_nonblock( server_fd ); else ret = net_set_block( server_fd ); if( ret != 0 ) { polarssl_printf( " failed\n ! net_set_(non)block() returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); /* * 3. Setup stuff */ polarssl_printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_init returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); #if defined(POLARSSL_X509_CRT_PARSE_C) if( opt.debug_level > 0 ) ssl_set_verify( &ssl, my_verify, NULL ); #endif ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_authmode( &ssl, opt.auth_mode ); #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH) if( ( ret = ssl_set_max_frag_len( &ssl, opt.mfl_code ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_max_frag_len returned %d\n\n", ret ); goto exit; } #endif #if defined(POLARSSL_SSL_TRUNCATED_HMAC) if( opt.trunc_hmac != DFL_TRUNC_HMAC ) ssl_set_truncated_hmac( &ssl, opt.trunc_hmac ); #endif #if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET) if( opt.extended_ms != DFL_EXTENDED_MS ) ssl_set_extended_master_secret( &ssl, opt.extended_ms ); #endif #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC) if( opt.etm != DFL_ETM ) ssl_set_encrypt_then_mac( &ssl, opt.etm ); #endif #if defined(POLARSSL_SSL_CBC_RECORD_SPLITTING) if( opt.recsplit != DFL_RECSPLIT ) ssl_set_cbc_record_splitting( &ssl, opt.recsplit ? SSL_CBC_RECORD_SPLITTING_ENABLED : SSL_CBC_RECORD_SPLITTING_DISABLED ); #endif #if defined(POLARSSL_SSL_ALPN) if( opt.alpn_string != NULL ) if( ( ret = ssl_set_alpn_protocols( &ssl, alpn_list ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_alpn_protocols returned %d\n\n", ret ); goto exit; } #endif ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); if( opt.nbio == 2 ) ssl_set_bio( &ssl, my_recv, &server_fd, my_send, &server_fd ); else ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); #if defined(POLARSSL_SSL_SESSION_TICKETS) if( ( ret = ssl_set_session_tickets( &ssl, opt.tickets ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_session_tickets returned %d\n\n", ret ); goto exit; } #endif /* RC4 setting is redundant if we use only one ciphersuite */ if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER ) ssl_set_ciphersuites( &ssl, opt.force_ciphersuite ); else ssl_set_arc4_support( &ssl, opt.arc4 ); if( opt.allow_legacy != DFL_ALLOW_LEGACY ) ssl_legacy_renegotiation( &ssl, opt.allow_legacy ); #if defined(POLARSSL_SSL_RENEGOTIATION) ssl_set_renegotiation( &ssl, opt.renegotiation ); #endif #if defined(POLARSSL_X509_CRT_PARSE_C) if( strcmp( opt.ca_path, "none" ) != 0 && strcmp( opt.ca_file, "none" ) != 0 ) { ssl_set_ca_chain( &ssl, &cacert, NULL, opt.server_name ); } if( strcmp( opt.crt_file, "none" ) != 0 && strcmp( opt.key_file, "none" ) != 0 ) { if( ( ret = ssl_set_own_cert( &ssl, &clicert, &pkey ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_own_cert returned %d\n\n", ret ); goto exit; } } #endif #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) if( ( ret = ssl_set_psk( &ssl, psk, psk_len, (const unsigned char *) opt.psk_identity, strlen( opt.psk_identity ) ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_psk returned %d\n\n", ret ); goto exit; } #endif #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION) if( ( ret = ssl_set_hostname( &ssl, opt.server_name ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_hostname returned %d\n\n", ret ); goto exit; } #endif if( opt.min_version != -1 ) ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version ); if( opt.max_version != -1 ) ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version ); #if defined(POLARSSL_SSL_FALLBACK_SCSV) if( opt.fallback != DFL_FALLBACK ) ssl_set_fallback( &ssl, opt.fallback ); #endif /* * 4. Handshake */ polarssl_printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { polarssl_printf( " failed\n ! ssl_handshake returned -0x%x\n", -ret ); if( ret == POLARSSL_ERR_X509_CERT_VERIFY_FAILED ) polarssl_printf( " Unable to verify the server's certificate. " "Either it is invalid,\n" " or you didn't set ca_file or ca_path " "to an appropriate value.\n" " Alternatively, you may want to use " "auth_mode=optional for testing purposes.\n" ); polarssl_printf( "\n" ); goto exit; } } polarssl_printf( " ok\n [ Protocol is %s ]\n [ Ciphersuite is %s ]\n", ssl_get_version( &ssl ), ssl_get_ciphersuite( &ssl ) ); #if defined(POLARSSL_SSL_ALPN) if( opt.alpn_string != NULL ) { const char *alp = ssl_get_alpn_protocol( &ssl ); polarssl_printf( " [ Application Layer Protocol is %s ]\n", alp ? alp : "(none)" ); } #endif if( opt.reconnect != 0 ) { polarssl_printf(" . Saving session for reuse..." ); fflush( stdout ); if( ( ret = ssl_get_session( &ssl, &saved_session ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_get_session returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); } #if defined(POLARSSL_X509_CRT_PARSE_C) /* * 5. Verify the server certificate */ polarssl_printf( " . Verifying peer X.509 certificate..." ); if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { char vrfy_buf[512]; polarssl_printf( " failed\n" ); x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", ret ); polarssl_printf( "%s\n", vrfy_buf ); } else polarssl_printf( " ok\n" ); if( ssl_get_peer_cert( &ssl ) != NULL ) { polarssl_printf( " . Peer certificate information ...\n" ); x509_crt_info( (char *) buf, sizeof( buf ) - 1, " ", ssl_get_peer_cert( &ssl ) ); polarssl_printf( "%s\n", buf ); } #endif /* POLARSSL_X509_CRT_PARSE_C */ #if defined(POLARSSL_SSL_RENEGOTIATION) if( opt.renegotiate ) { /* * Perform renegotiation (this must be done when the server is waiting * for input from our side). */ polarssl_printf( " . Performing renegotiation..." ); fflush( stdout ); while( ( ret = ssl_renegotiate( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { polarssl_printf( " failed\n ! ssl_renegotiate returned %d\n\n", ret ); goto exit; } } polarssl_printf( " ok\n" ); } #endif /* POLARSSL_SSL_RENEGOTIATION */ /* * 6. Write the GET request */ send_request: polarssl_printf( " > Write to server:" ); fflush( stdout ); len = polarssl_snprintf( (char *) buf, sizeof(buf) - 1, GET_REQUEST, opt.request_page ); tail_len = strlen( GET_REQUEST_END ); /* Add padding to GET request to reach opt.request_size in length */ if( opt.request_size != DFL_REQUEST_SIZE && len + tail_len < opt.request_size ) { memset( buf + len, 'A', opt.request_size - len - tail_len ); len += opt.request_size - len - tail_len; } strncpy( (char *) buf + len, GET_REQUEST_END, sizeof(buf) - len - 1 ); len += tail_len; /* Truncate if request size is smaller than the "natural" size */ if( opt.request_size != DFL_REQUEST_SIZE && len > opt.request_size ) { len = opt.request_size; /* Still end with \r\n unless that's really not possible */ if( len >= 2 ) buf[len - 2] = '\r'; if( len >= 1 ) buf[len - 1] = '\n'; } for( written = 0, frags = 0; written < len; written += ret, frags++ ) { while( ( ret = ssl_write( &ssl, buf + written, len - written ) ) <= 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { polarssl_printf( " failed\n ! ssl_write returned -0x%x\n\n", -ret ); goto exit; } } } buf[written] = '\0'; polarssl_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf ); /* * 7. Read the HTTP response */ polarssl_printf( " < Read from server:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: polarssl_printf( " connection was closed gracefully\n" ); ret = 0; goto close_notify; case 0: case POLARSSL_ERR_NET_CONN_RESET: polarssl_printf( " connection was reset by peer\n" ); ret = 0; goto reconnect; default: polarssl_printf( " ssl_read returned -0x%x\n", -ret ); goto exit; } } len = ret; buf[len] = '\0'; polarssl_printf( " %d bytes read\n\n%s", len, (char *) buf ); /* End of message should be detected according to the syntax of the * application protocol (eg HTTP), just use a dummy test here. */ if( ret > 0 && buf[len-1] == '\n' ) { ret = 0; break; } } while( 1 ); /* * 7b. Continue doing data exchanges? */ if( --opt.exchanges > 0 ) goto send_request; /* * 8. Done, cleanly close the connection */ close_notify: polarssl_printf( " . Closing the connection..." ); /* No error checking, the connection might be closed already */ do ret = ssl_close_notify( &ssl ); while( ret == POLARSSL_ERR_NET_WANT_WRITE ); ret = 0; polarssl_printf( " done\n" ); /* * 9. Reconnect? */ reconnect: if( opt.reconnect != 0 ) { --opt.reconnect; net_close( server_fd ); #if defined(POLARSSL_TIMING_C) if( opt.reco_delay > 0 ) m_sleep( 1000 * opt.reco_delay ); #endif polarssl_printf( " . Reconnecting with saved session..." ); fflush( stdout ); if( ( ret = ssl_session_reset( &ssl ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_session_reset returned -0x%x\n\n", -ret ); goto exit; } if( ( ret = ssl_set_session( &ssl, &saved_session ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_session returned %d\n\n", ret ); goto exit; } if( ( ret = net_connect( &server_fd, opt.server_addr, opt.server_port ) ) != 0 ) { polarssl_printf( " failed\n ! net_connect returned -0x%x\n\n", -ret ); goto exit; } while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { polarssl_printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto exit; } } polarssl_printf( " ok\n" ); goto send_request; } /* * Cleanup and exit */ exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); polarssl_printf("Last error was: -0x%X - %s\n\n", -ret, error_buf ); } #endif if( server_fd ) net_close( server_fd ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_free( &clicert ); x509_crt_free( &cacert ); pk_free( &pkey ); #endif ssl_session_free( &saved_session ); ssl_free( &ssl ); ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) polarssl_printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif // Shell can not handle large exit numbers -> 1 for errors if( ret < 0 ) ret = 1; return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0; x509_crt issuer_crt; pk_context loaded_issuer_key, loaded_subject_key; pk_context *issuer_key = &loaded_issuer_key, *subject_key = &loaded_subject_key; char buf[1024]; char issuer_name[128]; int i, j, n; char *p, *q, *r; #if defined(POLARSSL_X509_CSR_PARSE_C) char subject_name[128]; x509_csr csr; #endif x509write_cert crt; mpi serial; entropy_context entropy; ctr_drbg_context ctr_drbg; const char *pers = "crt example app"; /* * Set to sane values */ x509write_crt_init( &crt ); x509write_crt_set_md_alg( &crt, POLARSSL_MD_SHA1 ); pk_init( &loaded_issuer_key ); pk_init( &loaded_subject_key ); mpi_init( &serial ); #if defined(POLARSSL_X509_CSR_PARSE_C) x509_csr_init( &csr ); #endif x509_crt_init( &issuer_crt ); memset( buf, 0, 1024 ); if( argc == 0 ) { usage: printf( USAGE ); ret = 1; goto exit; } opt.issuer_crt = DFL_ISSUER_CRT; opt.request_file = DFL_REQUEST_FILE; opt.request_file = DFL_REQUEST_FILE; opt.subject_key = DFL_SUBJECT_KEY; opt.issuer_key = DFL_ISSUER_KEY; opt.subject_pwd = DFL_SUBJECT_PWD; opt.issuer_pwd = DFL_ISSUER_PWD; opt.output_file = DFL_OUTPUT_FILENAME; opt.subject_name = DFL_SUBJECT_NAME; opt.issuer_name = DFL_ISSUER_NAME; opt.not_before = DFL_NOT_BEFORE; opt.not_after = DFL_NOT_AFTER; opt.serial = DFL_SERIAL; opt.selfsign = DFL_SELFSIGN; opt.is_ca = DFL_IS_CA; opt.max_pathlen = DFL_MAX_PATHLEN; opt.key_usage = DFL_KEY_USAGE; opt.ns_cert_type = DFL_NS_CERT_TYPE; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; n = strlen( p ); for( j = 0; j < n; j++ ) { if( argv[i][j] >= 'A' && argv[i][j] <= 'Z' ) argv[i][j] |= 0x20; } if( strcmp( p, "request_file" ) == 0 ) opt.request_file = q; else if( strcmp( p, "subject_key" ) == 0 ) opt.subject_key = q; else if( strcmp( p, "issuer_key" ) == 0 ) opt.issuer_key = q; else if( strcmp( p, "subject_pwd" ) == 0 ) opt.subject_pwd = q; else if( strcmp( p, "issuer_pwd" ) == 0 ) opt.issuer_pwd = q; else if( strcmp( p, "issuer_crt" ) == 0 ) opt.issuer_crt = q; else if( strcmp( p, "output_file" ) == 0 ) opt.output_file = q; else if( strcmp( p, "subject_name" ) == 0 ) { opt.subject_name = q; } else if( strcmp( p, "issuer_name" ) == 0 ) { opt.issuer_name = q; } else if( strcmp( p, "not_before" ) == 0 ) { opt.not_before = q; } else if( strcmp( p, "not_after" ) == 0 ) { opt.not_after = q; } else if( strcmp( p, "serial" ) == 0 ) { opt.serial = q; } else if( strcmp( p, "selfsign" ) == 0 ) { opt.selfsign = atoi( q ); if( opt.selfsign < 0 || opt.selfsign > 1 ) goto usage; } else if( strcmp( p, "is_ca" ) == 0 ) { opt.is_ca = atoi( q ); if( opt.is_ca < 0 || opt.is_ca > 1 ) goto usage; } else if( strcmp( p, "max_pathlen" ) == 0 ) { opt.max_pathlen = atoi( q ); if( opt.max_pathlen < -1 || opt.max_pathlen > 127 ) goto usage; } else if( strcmp( p, "key_usage" ) == 0 ) { while( q != NULL ) { if( ( r = strchr( q, ',' ) ) != NULL ) *r++ = '\0'; if( strcmp( q, "digital_signature" ) == 0 ) opt.key_usage |= KU_DIGITAL_SIGNATURE; else if( strcmp( q, "non_repudiation" ) == 0 ) opt.key_usage |= KU_NON_REPUDIATION; else if( strcmp( q, "key_encipherment" ) == 0 ) opt.key_usage |= KU_KEY_ENCIPHERMENT; else if( strcmp( q, "data_encipherment" ) == 0 ) opt.key_usage |= KU_DATA_ENCIPHERMENT; else if( strcmp( q, "key_agreement" ) == 0 ) opt.key_usage |= KU_KEY_AGREEMENT; else if( strcmp( q, "key_cert_sign" ) == 0 ) opt.key_usage |= KU_KEY_CERT_SIGN; else if( strcmp( q, "crl_sign" ) == 0 ) opt.key_usage |= KU_CRL_SIGN; else goto usage; q = r; } } else if( strcmp( p, "ns_cert_type" ) == 0 ) { while( q != NULL ) { if( ( r = strchr( q, ',' ) ) != NULL ) *r++ = '\0'; if( strcmp( q, "ssl_client" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_SSL_CLIENT; else if( strcmp( q, "ssl_server" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_SSL_SERVER; else if( strcmp( q, "email" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_EMAIL; else if( strcmp( q, "object_signing" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_OBJECT_SIGNING; else if( strcmp( q, "ssl_ca" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_SSL_CA; else if( strcmp( q, "email_ca" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_EMAIL_CA; else if( strcmp( q, "object_signing_ca" ) == 0 ) opt.ns_cert_type |= NS_CERT_TYPE_OBJECT_SIGNING_CA; else goto usage; q = r; } } else goto usage; } printf("\n"); /* * 0. Seed the PRNG */ printf( " . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! ctr_drbg_init returned %d - %s\n", ret, buf ); goto exit; } printf( " ok\n" ); // Parse serial to MPI // printf( " . Reading serial number..." ); fflush( stdout ); if( ( ret = mpi_read_string( &serial, 10, opt.serial ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! mpi_read_string returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); // Parse issuer certificate if present // if( !opt.selfsign && strlen( opt.issuer_crt ) ) { /* * 1.0.a. Load the certificates */ printf( " . Loading the issuer certificate ..." ); fflush( stdout ); if( ( ret = x509_crt_parse_file( &issuer_crt, opt.issuer_crt ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509_crt_parse_file returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } ret = x509_dn_gets( issuer_name, sizeof(issuer_name), &issuer_crt.issuer ); if( ret < 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509_dn_gets returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } opt.issuer_name = issuer_name; printf( " ok\n" ); } #if defined(POLARSSL_X509_CSR_PARSE_C) // Parse certificate request if present // if( !opt.selfsign && strlen( opt.request_file ) ) { /* * 1.0.b. Load the CSR */ printf( " . Loading the certificate request ..." ); fflush( stdout ); if( ( ret = x509_csr_parse_file( &csr, opt.request_file ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509_csr_parse_file returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } ret = x509_dn_gets( subject_name, sizeof(subject_name), &csr.subject ); if( ret < 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509_dn_gets returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } opt.subject_name = subject_name; subject_key = &csr.pk; printf( " ok\n" ); } #endif /* POLARSSL_X509_CSR_PARSE_C */ /* * 1.1. Load the keys */ if( !opt.selfsign && !strlen( opt.request_file ) ) { printf( " . Loading the subject key ..." ); fflush( stdout ); ret = pk_parse_keyfile( &loaded_subject_key, opt.subject_key, opt.subject_pwd ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! pk_parse_keyfile returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); } printf( " . Loading the issuer key ..." ); fflush( stdout ); ret = pk_parse_keyfile( &loaded_issuer_key, opt.issuer_key, opt.issuer_pwd ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! pk_parse_keyfile returned -x%02x - %s\n\n", -ret, buf ); goto exit; } // Check if key and issuer certificate match // if( strlen( opt.issuer_crt ) ) { if( !pk_can_do( &issuer_crt.pk, POLARSSL_PK_RSA ) || mpi_cmp_mpi( &pk_rsa( issuer_crt.pk )->N, &pk_rsa( *issuer_key )->N ) != 0 || mpi_cmp_mpi( &pk_rsa( issuer_crt.pk )->E, &pk_rsa( *issuer_key )->E ) != 0 ) { printf( " failed\n ! issuer_key does not match issuer certificate\n\n" ); ret = -1; goto exit; } } printf( " ok\n" ); if( opt.selfsign ) { opt.subject_name = opt.issuer_name; subject_key = issuer_key; } x509write_crt_set_subject_key( &crt, subject_key ); x509write_crt_set_issuer_key( &crt, issuer_key ); /* * 1.0. Check the names for validity */ if( ( ret = x509write_crt_set_subject_name( &crt, opt.subject_name ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_subject_name returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } if( ( ret = x509write_crt_set_issuer_name( &crt, opt.issuer_name ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_issuer_name returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " . Setting certificate values ..." ); fflush( stdout ); ret = x509write_crt_set_serial( &crt, &serial ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_serial returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } ret = x509write_crt_set_validity( &crt, opt.not_before, opt.not_after ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_validity returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); printf( " . Adding the Basic Constraints extension ..." ); fflush( stdout ); ret = x509write_crt_set_basic_constraints( &crt, opt.is_ca, opt.max_pathlen ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_basic_contraints returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); #if defined(POLARSSL_SHA1_C) printf( " . Adding the Subject Key Identifier ..." ); fflush( stdout ); ret = x509write_crt_set_subject_key_identifier( &crt ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_subject_key_identifier returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); printf( " . Adding the Authority Key Identifier ..." ); fflush( stdout ); ret = x509write_crt_set_authority_key_identifier( &crt ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_authority_key_identifier returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); #endif /* POLARSSL_SHA1_C */ if( opt.key_usage ) { printf( " . Adding the Key Usage extension ..." ); fflush( stdout ); ret = x509write_crt_set_key_usage( &crt, opt.key_usage ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_key_usage returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); } if( opt.ns_cert_type ) { printf( " . Adding the NS Cert Type extension ..." ); fflush( stdout ); ret = x509write_crt_set_ns_cert_type( &crt, opt.ns_cert_type ); if( ret != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! x509write_crt_set_ns_cert_type returned -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); } /* * 1.2. Writing the request */ printf( " . Writing the certificate..." ); fflush( stdout ); if( ( ret = write_certificate( &crt, opt.output_file, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { error_strerror( ret, buf, 1024 ); printf( " failed\n ! write_certifcate -0x%02x - %s\n\n", -ret, buf ); goto exit; } printf( " ok\n" ); exit: x509write_crt_free( &crt ); pk_free( &loaded_subject_key ); pk_free( &loaded_issuer_key ); mpi_free( &serial ); entropy_free( &entropy ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0, len, written, frags; int listen_fd; int client_fd = -1; unsigned char buf[1024]; #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) unsigned char psk[256]; size_t psk_len = 0; #endif const char *pers = "ssl_server2"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt cacert; x509_crt srvcert; pk_context pkey; x509_crt srvcert2; pk_context pkey2; int key_cert_init = 0, key_cert_init2 = 0; #endif #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_context cache; #endif #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) unsigned char alloc_buf[100000]; #endif int i; char *p, *q; const int *list; #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) memory_buffer_alloc_init( alloc_buf, sizeof(alloc_buf) ); #endif /* * Make sure memory references are valid in case we exit early. */ listen_fd = 0; memset( &ssl, 0, sizeof( ssl_context ) ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_init( &cacert ); x509_crt_init( &srvcert ); pk_init( &pkey ); x509_crt_init( &srvcert2 ); pk_init( &pkey2 ); #endif #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_init( &cache ); #endif if( argc == 0 ) { usage: if( ret == 0 ) ret = 1; printf( USAGE ); list = ssl_list_ciphersuites(); while( *list ) { printf(" %-42s", ssl_get_ciphersuite_name( *list ) ); list++; if( !*list ) break; printf(" %s\n", ssl_get_ciphersuite_name( *list ) ); list++; } printf("\n"); goto exit; } opt.server_port = DFL_SERVER_PORT; opt.debug_level = DFL_DEBUG_LEVEL; opt.ca_file = DFL_CA_FILE; opt.ca_path = DFL_CA_PATH; opt.crt_file = DFL_CRT_FILE; opt.key_file = DFL_KEY_FILE; opt.crt_file2 = DFL_CRT_FILE2; opt.key_file2 = DFL_KEY_FILE2; opt.psk = DFL_PSK; opt.psk_identity = DFL_PSK_IDENTITY; opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; opt.renegotiation = DFL_RENEGOTIATION; opt.allow_legacy = DFL_ALLOW_LEGACY; opt.min_version = DFL_MIN_VERSION; opt.max_version = DFL_MAX_VERSION; opt.auth_mode = DFL_AUTH_MODE; opt.mfl_code = DFL_MFL_CODE; opt.tickets = DFL_TICKETS; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "server_port" ) == 0 ) { opt.server_port = atoi( q ); if( opt.server_port < 1 || opt.server_port > 65535 ) goto usage; } else if( strcmp( p, "debug_level" ) == 0 ) { opt.debug_level = atoi( q ); if( opt.debug_level < 0 || opt.debug_level > 65535 ) goto usage; } else if( strcmp( p, "ca_file" ) == 0 ) opt.ca_file = q; else if( strcmp( p, "ca_path" ) == 0 ) opt.ca_path = q; else if( strcmp( p, "crt_file" ) == 0 ) opt.crt_file = q; else if( strcmp( p, "key_file" ) == 0 ) opt.key_file = q; else if( strcmp( p, "crt_file2" ) == 0 ) opt.crt_file2 = q; else if( strcmp( p, "key_file2" ) == 0 ) opt.key_file2 = q; else if( strcmp( p, "psk" ) == 0 ) opt.psk = q; else if( strcmp( p, "psk_identity" ) == 0 ) opt.psk_identity = q; else if( strcmp( p, "force_ciphersuite" ) == 0 ) { opt.force_ciphersuite[0] = -1; opt.force_ciphersuite[0] = ssl_get_ciphersuite_id( q ); if( opt.force_ciphersuite[0] <= 0 ) { ret = 2; goto usage; } opt.force_ciphersuite[1] = 0; } else if( strcmp( p, "renegotiation" ) == 0 ) { opt.renegotiation = (atoi( q )) ? SSL_RENEGOTIATION_ENABLED : SSL_RENEGOTIATION_DISABLED; } else if( strcmp( p, "allow_legacy" ) == 0 ) { opt.allow_legacy = atoi( q ); if( opt.allow_legacy < 0 || opt.allow_legacy > 1 ) goto usage; } else if( strcmp( p, "min_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "max_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "force_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_0; opt.max_version = SSL_MINOR_VERSION_0; } else if( strcmp( q, "tls1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_1; opt.max_version = SSL_MINOR_VERSION_1; } else if( strcmp( q, "tls1_1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_2; opt.max_version = SSL_MINOR_VERSION_2; } else if( strcmp( q, "tls1_2" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_3; opt.max_version = SSL_MINOR_VERSION_3; } else goto usage; } else if( strcmp( p, "auth_mode" ) == 0 ) { if( strcmp( q, "none" ) == 0 ) opt.auth_mode = SSL_VERIFY_NONE; else if( strcmp( q, "optional" ) == 0 ) opt.auth_mode = SSL_VERIFY_OPTIONAL; else if( strcmp( q, "required" ) == 0 ) opt.auth_mode = SSL_VERIFY_REQUIRED; else goto usage; } else if( strcmp( p, "max_frag_len" ) == 0 ) { if( strcmp( q, "512" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_512; else if( strcmp( q, "1024" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_1024; else if( strcmp( q, "2048" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_2048; else if( strcmp( q, "4096" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_4096; else goto usage; } else if( strcmp( p, "tickets" ) == 0 ) { opt.tickets = atoi( q ); if( opt.tickets < 0 || opt.tickets > 1 ) goto usage; } else goto usage; } if( opt.force_ciphersuite[0] > 0 ) { const ssl_ciphersuite_t *ciphersuite_info; ciphersuite_info = ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); if( opt.max_version != -1 && ciphersuite_info->min_minor_ver > opt.max_version ) { printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } if( opt.min_version != -1 && ciphersuite_info->max_minor_ver < opt.min_version ) { printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } if( opt.max_version > ciphersuite_info->max_minor_ver ) opt.max_version = ciphersuite_info->max_minor_ver; if( opt.min_version < ciphersuite_info->min_minor_ver ) opt.min_version = ciphersuite_info->min_minor_ver; } #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) /* * Unhexify the pre-shared key if any is given */ if( strlen( opt.psk ) ) { unsigned char c; size_t j; if( strlen( opt.psk ) % 2 != 0 ) { printf("pre-shared key not valid hex\n"); goto exit; } psk_len = strlen( opt.psk ) / 2; for( j = 0; j < strlen( opt.psk ); j += 2 ) { c = opt.psk[j]; if( c >= '0' && c <= '9' ) c -= '0'; else if( c >= 'a' && c <= 'f' ) c -= 'a' - 10; else if( c >= 'A' && c <= 'F' ) c -= 'A' - 10; else { printf("pre-shared key not valid hex\n"); goto exit; } psk[ j / 2 ] = c << 4; c = opt.psk[j + 1]; if( c >= '0' && c <= '9' ) c -= '0'; else if( c >= 'a' && c <= 'f' ) c -= 'a' - 10; else if( c >= 'A' && c <= 'F' ) c -= 'A' - 10; else { printf("pre-shared key not valid hex\n"); goto exit; } psk[ j / 2 ] |= c; } } #endif /* POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED */ /* * 0. Initialize the RNG and the session data */ printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned -0x%x\n", -ret ); goto exit; } printf( " ok\n" ); #if defined(POLARSSL_X509_CRT_PARSE_C) /* * 1.1. Load the trusted CA */ printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.ca_path ) ) ret = x509_crt_parse_path( &cacert, opt.ca_path ); else if( strlen( opt.ca_file ) ) ret = x509_crt_parse_file( &cacert, opt.ca_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509_crt_parse( &cacert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret < 0 ) { printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } printf( " ok (%d skipped)\n", ret ); /* * 1.2. Load own certificate and private key */ printf( " . Loading the server cert. and key..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.crt_file ) ) { key_cert_init++; if( ( ret = x509_crt_parse_file( &srvcert, opt.crt_file ) ) != 0 ) { printf( " failed\n ! x509_crt_parse_file returned -0x%x\n\n", -ret ); goto exit; } } if( strlen( opt.key_file ) ) { key_cert_init++; if( ( ret = pk_parse_keyfile( &pkey, opt.key_file, "" ) ) != 0 ) { printf( " failed\n ! pk_parse_keyfile returned -0x%x\n\n", -ret ); goto exit; } } if( key_cert_init == 1 ) { printf( " failed\n ! crt_file without key_file or vice-versa\n\n" ); goto exit; } if( strlen( opt.crt_file2 ) ) { key_cert_init2++; if( ( ret = x509_crt_parse_file( &srvcert2, opt.crt_file2 ) ) != 0 ) { printf( " failed\n ! x509_crt_parse_file(2) returned -0x%x\n\n", -ret ); goto exit; } } if( strlen( opt.key_file2 ) ) { key_cert_init2++; if( ( ret = pk_parse_keyfile( &pkey2, opt.key_file2, "" ) ) != 0 ) { printf( " failed\n ! pk_parse_keyfile(2) returned -0x%x\n\n", -ret ); goto exit; } } if( key_cert_init2 == 1 ) { printf( " failed\n ! crt_file2 without key_file2 or vice-versa\n\n" ); goto exit; } #endif if( key_cert_init == 0 && key_cert_init2 == 0 ) { #if !defined(POLARSSL_CERTS_C) printf( "Not certificated or key provided, and \n" "POLARSSL_CERTS_C not defined!\n" ); goto exit; #else #if defined(POLARSSL_RSA_C) if( ( ret = x509_crt_parse( &srvcert, (const unsigned char *) test_srv_crt_rsa, strlen( test_srv_crt_rsa ) ) ) != 0 ) { printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } if( ( ret = pk_parse_key( &pkey, (const unsigned char *) test_srv_key_rsa, strlen( test_srv_key_rsa ), NULL, 0 ) ) != 0 ) { printf( " failed\n ! pk_parse_key returned -0x%x\n\n", -ret ); goto exit; } key_cert_init = 2; #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECDSA_C) if( ( ret = x509_crt_parse( &srvcert2, (const unsigned char *) test_srv_crt_ec, strlen( test_srv_crt_ec ) ) ) != 0 ) { printf( " failed\n ! x509_crt_parse2 returned -0x%x\n\n", -ret ); goto exit; } if( ( ret = pk_parse_key( &pkey2, (const unsigned char *) test_srv_key_ec, strlen( test_srv_key_ec ), NULL, 0 ) ) != 0 ) { printf( " failed\n ! pk_parse_key2 returned -0x%x\n\n", -ret ); goto exit; } key_cert_init2 = 2; #endif /* POLARSSL_ECDSA_C */ #endif /* POLARSSL_CERTS_C */ } printf( " ok\n" ); #endif /* POLARSSL_X509_CRT_PARSE_C */ /* * 2. Setup the listening TCP socket */ printf( " . Bind on tcp://localhost:%-4d/ ...", opt.server_port ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, opt.server_port ) ) != 0 ) { printf( " failed\n ! net_bind returned -0x%x\n\n", -ret ); goto exit; } printf( " ok\n" ); /* * 3. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned -0x%x\n\n", -ret ); goto exit; } ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, opt.auth_mode ); #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH) ssl_set_max_frag_len( &ssl, opt.mfl_code ); #endif ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); #if defined(POLARSSL_SSL_CACHE_C) ssl_set_session_cache( &ssl, ssl_cache_get, &cache, ssl_cache_set, &cache ); #endif #if defined(POLARSSL_SSL_SESSION_TICKETS) ssl_set_session_tickets( &ssl, opt.tickets ); #endif if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER ) ssl_set_ciphersuites( &ssl, opt.force_ciphersuite ); ssl_set_renegotiation( &ssl, opt.renegotiation ); ssl_legacy_renegotiation( &ssl, opt.allow_legacy ); #if defined(POLARSSL_X509_CRT_PARSE_C) ssl_set_ca_chain( &ssl, &cacert, NULL, NULL ); if( key_cert_init ) ssl_set_own_cert( &ssl, &srvcert, &pkey ); if( key_cert_init2 ) ssl_set_own_cert( &ssl, &srvcert2, &pkey2 ); #endif #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) ssl_set_psk( &ssl, psk, psk_len, (const unsigned char *) opt.psk_identity, strlen( opt.psk_identity ) ); #endif #if defined(POLARSSL_DHM_C) /* * Use different group than default DHM group */ ssl_set_dh_param( &ssl, POLARSSL_DHM_RFC5114_MODP_2048_P, POLARSSL_DHM_RFC5114_MODP_2048_G ); #endif if( opt.min_version != -1 ) ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version ); if( opt.max_version != -1 ) ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version ); printf( " ok\n" ); reset: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( client_fd != -1 ) net_close( client_fd ); ssl_session_reset( &ssl ); /* * 3. Wait until a client connects */ #if defined(_WIN32_WCE) { SHELLEXECUTEINFO sei; ZeroMemory( &sei, sizeof( SHELLEXECUTEINFO ) ); sei.cbSize = sizeof( SHELLEXECUTEINFO ); sei.fMask = 0; sei.hwnd = 0; sei.lpVerb = _T( "open" ); sei.lpFile = _T( "https://localhost:4433/" ); sei.lpParameters = NULL; sei.lpDirectory = NULL; sei.nShow = SW_SHOWNORMAL; ShellExecuteEx( &sei ); } #elif defined(_WIN32) ShellExecute( NULL, "open", "https://localhost:4433/", NULL, NULL, SW_SHOWNORMAL ); #endif client_fd = -1; printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned -0x%x\n\n", -ret ); goto exit; } ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); printf( " ok\n" ); /* * 4. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto reset; } } printf( " ok\n [ Ciphersuite is %s ]\n", ssl_get_ciphersuite( &ssl ) ); #if defined(POLARSSL_X509_CRT_PARSE_C) /* * 5. Verify the server certificate */ printf( " . Verifying peer X.509 certificate..." ); if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( " failed\n" ); if( !ssl_get_peer_cert( &ssl ) ) printf( " ! no client certificate sent\n" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! client certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! client certificate has been revoked\n" ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n" ); } else printf( " ok\n" ); if( ssl_get_peer_cert( &ssl ) ) { printf( " . Peer certificate information ...\n" ); x509_crt_info( (char *) buf, sizeof( buf ) - 1, " ", ssl_get_peer_cert( &ssl ) ); printf( "%s\n", buf ); } #endif /* POLARSSL_X509_CRT_PARSE_C */ /* * 6. Read the HTTP Request */ printf( " < Read from client:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned -0x%x\n", -ret ); break; } break; } len = ret; printf( " %d bytes read\n\n%s\n", len, (char *) buf ); if( memcmp( buf, "SERVERQUIT", 10 ) == 0 ) { ret = 0; goto exit; } if( ret > 0 ) break; } while( 1 ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_ciphersuite( &ssl ) ); for( written = 0, frags = 0; written < len; written += ret, frags++ ) { while( ( ret = ssl_write( &ssl, buf + written, len - written ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " failed\n ! peer closed the connection\n\n" ); goto reset; } if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } } buf[written] = '\0'; printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf ); #ifdef TEST_RENEGO /* * Request renegotiation (this must be done when the client is still * waiting for input from our side). */ printf( " . Requestion renegotiation..." ); fflush( stdout ); while( ( ret = ssl_renegotiate( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_renegotiate returned %d\n\n", ret ); goto exit; } } /* * Should be a while loop, not an if, but here we're not actually * expecting data from the client, and since we're running tests locally, * we can just hope the handshake will finish the during the first call. */ if( ( ret = ssl_read( &ssl, buf, 0 ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_read returned %d\n\n", ret ); /* Unexpected message probably means client didn't renegotiate */ if( ret == POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE ) goto reset; else goto exit; } } printf( " ok\n" ); #endif ret = 0; goto reset; exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf("Last error was: -0x%X - %s\n\n", -ret, error_buf ); } #endif net_close( client_fd ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_free( &cacert ); x509_crt_free( &srvcert ); pk_free( &pkey ); x509_crt_free( &srvcert2 ); pk_free( &pkey2 ); #endif ssl_free( &ssl ); entropy_free( &entropy ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_free( &cache ); #endif #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) #if defined(POLARSSL_MEMORY_DEBUG) memory_buffer_alloc_status(); #endif memory_buffer_alloc_free(); #endif #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif // Shell can not handle large exit numbers -> 1 for errors if( ret < 0 ) ret = 1; return( ret ); }
int main( int argc, char *argv[] ) { FILE *f; int i, k, ret; ctr_drbg_context ctr_drbg; entropy_context entropy; unsigned char buf[1024]; if( argc < 2 ) { fprintf( stderr, "usage: %s <output filename>\n", argv[0] ); return( 1 ); } if( ( f = fopen( argv[1], "wb+" ) ) == NULL ) { printf( "failed to open '%s' for writing.\n", argv[0] ); return( 1 ); } entropy_init( &entropy ); ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) "RANDOM_GEN", 10 ); if( ret != 0 ) { printf( "failed in ctr_drbg_init: %d\n", ret ); goto cleanup; } ctr_drbg_set_prediction_resistance( &ctr_drbg, CTR_DRBG_PR_OFF ); #if defined(POLARSSL_FS_IO) ret = ctr_drbg_update_seed_file( &ctr_drbg, "seedfile" ); if( ret == POLARSSL_ERR_CTR_DRBG_FILE_IO_ERROR ) { printf( "Failed to open seedfile. Generating one.\n" ); ret = ctr_drbg_write_seed_file( &ctr_drbg, "seedfile" ); if( ret != 0 ) { printf( "failed in ctr_drbg_write_seed_file: %d\n", ret ); goto cleanup; } } else if( ret != 0 ) { printf( "failed in ctr_drbg_update_seed_file: %d\n", ret ); goto cleanup; } #endif for( i = 0, k = 768; i < k; i++ ) { ret = ctr_drbg_random( &ctr_drbg, buf, sizeof( buf ) ); if( ret != 0 ) { printf("failed!\n"); goto cleanup; } fwrite( buf, 1, sizeof( buf ), f ); printf( "Generating 32Mb of data in file '%s'... %04.1f" \ "%% done\r", argv[1], (100 * (float) (i + 1)) / k ); fflush( stdout ); } ret = 0; cleanup: printf("\n"); fclose( f ); entropy_free( &entropy ); return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0; pk_context key; char buf[1024]; int i; char *p, *q; entropy_context entropy; ctr_drbg_context ctr_drbg; const char *pers = "gen_key"; #if defined(POLARSSL_ECP_C) const ecp_curve_info *curve_info; #endif /* * Set to sane values */ pk_init( &key ); memset( buf, 0, sizeof( buf ) ); if( argc == 0 ) { usage: ret = 1; printf( USAGE ); #if defined(POLARSSL_ECP_C) printf( " availabled ec_curve values:\n" ); curve_info = ecp_curve_list(); printf( " %s (default)\n", curve_info->name ); while( ( ++curve_info )->name != NULL ) printf( " %s\n", curve_info->name ); #endif goto exit; } opt.type = DFL_TYPE; opt.rsa_keysize = DFL_RSA_KEYSIZE; opt.ec_curve = DFL_EC_CURVE; opt.filename = DFL_FILENAME; opt.format = DFL_FORMAT; opt.use_dev_random = DFL_USE_DEV_RANDOM; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "type" ) == 0 ) { if( strcmp( q, "rsa" ) == 0 ) opt.type = POLARSSL_PK_RSA; else if( strcmp( q, "ec" ) == 0 ) opt.type = POLARSSL_PK_ECKEY; else goto usage; } else if( strcmp( p, "format" ) == 0 ) { if( strcmp( q, "pem" ) == 0 ) opt.format = FORMAT_PEM; else if( strcmp( q, "der" ) == 0 ) opt.format = FORMAT_DER; else goto usage; } else if( strcmp( p, "rsa_keysize" ) == 0 ) { opt.rsa_keysize = atoi( q ); if( opt.rsa_keysize < 1024 || opt.rsa_keysize > 8192 ) goto usage; } else if( strcmp( p, "ec_curve" ) == 0 ) { if( ( curve_info = ecp_curve_info_from_name( q ) ) == NULL ) goto usage; opt.ec_curve = curve_info->grp_id; } else if( strcmp( p, "filename" ) == 0 ) opt.filename = q; else if( strcmp( p, "use_dev_random" ) == 0 ) { opt.use_dev_random = atoi( q ); if( opt.use_dev_random < 0 || opt.use_dev_random > 1 ) goto usage; } else goto usage; } printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); #if !defined(_WIN32) && defined(POLARSSL_FS_IO) if( opt.use_dev_random ) { if( ( ret = entropy_add_source( &entropy, dev_random_entropy_poll, NULL, DEV_RANDOM_THRESHOLD ) ) != 0 ) { printf( " failed\n ! entropy_add_source returned -0x%04x\n", -ret ); goto exit; } printf("\n Using /dev/random, so can take a long time! " ); fflush( stdout ); } #endif /* !_WIN32 && POLARSSL_FS_IO */ if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned -0x%04x\n", -ret ); goto exit; } /* * 1.1. Generate the key */ printf( "\n . Generating the private key ..." ); fflush( stdout ); if( ( ret = pk_init_ctx( &key, pk_info_from_type( opt.type ) ) ) != 0 ) { printf( " failed\n ! pk_init_ctx returned -0x%04x", -ret ); goto exit; } #if defined(POLARSSL_RSA_C) && defined(POLARSSL_GENPRIME) if( opt.type == POLARSSL_PK_RSA ) { ret = rsa_gen_key( pk_rsa( key ), ctr_drbg_random, &ctr_drbg, opt.rsa_keysize, 65537 ); if( ret != 0 ) { printf( " failed\n ! rsa_gen_key returned -0x%04x", -ret ); goto exit; } } else #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECP_C) if( opt.type == POLARSSL_PK_ECKEY ) { ret = ecp_gen_key( opt.ec_curve, pk_ec( key ), ctr_drbg_random, &ctr_drbg ); if( ret != 0 ) { printf( " failed\n ! rsa_gen_key returned -0x%04x", -ret ); goto exit; } } else #endif /* POLARSSL_ECP_C */ { printf( " failed\n ! key type not supported\n" ); goto exit; } /* * 1.2 Print the key */ printf( " ok\n . Key information:\n" ); #if defined(POLARSSL_RSA_C) if( pk_get_type( &key ) == POLARSSL_PK_RSA ) { rsa_context *rsa = pk_rsa( key ); mpi_write_file( "N: ", &rsa->N, 16, NULL ); mpi_write_file( "E: ", &rsa->E, 16, NULL ); mpi_write_file( "D: ", &rsa->D, 16, NULL ); mpi_write_file( "P: ", &rsa->P, 16, NULL ); mpi_write_file( "Q: ", &rsa->Q, 16, NULL ); mpi_write_file( "DP: ", &rsa->DP, 16, NULL ); mpi_write_file( "DQ: ", &rsa->DQ, 16, NULL ); mpi_write_file( "QP: ", &rsa->QP, 16, NULL ); } else #endif #if defined(POLARSSL_ECP_C) if( pk_get_type( &key ) == POLARSSL_PK_ECKEY ) { ecp_keypair *ecp = pk_ec( key ); printf( "curve: %s\n", ecp_curve_info_from_grp_id( ecp->grp.id )->name ); mpi_write_file( "X_Q: ", &ecp->Q.X, 16, NULL ); mpi_write_file( "Y_Q: ", &ecp->Q.Y, 16, NULL ); mpi_write_file( "D: ", &ecp->d , 16, NULL ); } else #endif printf(" ! key type not supported\n"); write_private_key( &key, opt.filename ); exit: if( ret != 0 && ret != 1) { #ifdef POLARSSL_ERROR_C polarssl_strerror( ret, buf, sizeof( buf ) ); printf( " - %s\n", buf ); #else printf("\n"); #endif } pk_free( &key ); ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
/** * Run SSL handshake and store the resulting time value in the * 'time_map'. * * @param time_map where to store the current time */ static void run_ssl (uint32_t *time_map, int time_is_an_illusion) { entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; proxy_polarssl_ctx proxy_ctx; x509_cert cacert; struct stat statbuf; int ret = 0, server_fd = 0; char *pers = "tlsdate-helper"; memset (&ssl, 0, sizeof(ssl_context)); memset (&cacert, 0, sizeof(x509_cert)); verb("V: Using PolarSSL for SSL\n"); if (ca_racket) { if (-1 == stat (ca_cert_container, &statbuf)) { die("Unable to stat CA certficate container %s\n", ca_cert_container); } else { switch (statbuf.st_mode & S_IFMT) { case S_IFREG: if (0 > x509parse_crtfile(&cacert, ca_cert_container)) fprintf(stderr, "x509parse_crtfile failed\n"); break; case S_IFDIR: if (0 > x509parse_crtpath(&cacert, ca_cert_container)) fprintf(stderr, "x509parse_crtpath failed\n"); break; default: die("Unable to load CA certficate container %s\n", ca_cert_container); } } } entropy_init (&entropy); if (0 != ctr_drbg_init (&ctr_drbg, entropy_func, &entropy, (unsigned char *) pers, strlen(pers))) { die("Failed to initialize CTR_DRBG\n"); } if (0 != ssl_init (&ssl)) { die("SSL initialization failed\n"); } ssl_set_endpoint (&ssl, SSL_IS_CLIENT); ssl_set_rng (&ssl, ctr_drbg_random, &ctr_drbg); ssl_set_ca_chain (&ssl, &cacert, NULL, hostname_to_verify); if (ca_racket) { // You can do SSL_VERIFY_REQUIRED here, but then the check in // inspect_key() never happens as the ssl_handshake() will fail. ssl_set_authmode (&ssl, SSL_VERIFY_OPTIONAL); } if (proxy) { char *scheme; char *proxy_host; char *proxy_port; parse_proxy_uri (proxy, &scheme, &proxy_host, &proxy_port); verb("V: opening socket to proxy %s:%s\n", proxy_host, proxy_port); if (0 != net_connect (&server_fd, proxy_host, atoi(proxy_port))) { die ("SSL connection failed\n"); } proxy_polarssl_init (&proxy_ctx); proxy_polarssl_set_bio (&proxy_ctx, net_recv, &server_fd, net_send, &server_fd); proxy_polarssl_set_host (&proxy_ctx, host); proxy_polarssl_set_port (&proxy_ctx, atoi(port)); proxy_polarssl_set_scheme (&proxy_ctx, scheme); ssl_set_bio (&ssl, proxy_polarssl_recv, &proxy_ctx, proxy_polarssl_send, &proxy_ctx); verb("V: Handle proxy connection\n"); if (0 == proxy_ctx.f_connect (&proxy_ctx)) die("Proxy connection failed\n"); } else { verb("V: opening socket to %s:%s\n", host, port); if (0 != net_connect (&server_fd, host, atoi(port))) { die ("SSL connection failed\n"); } ssl_set_bio (&ssl, net_recv, &server_fd, net_send, &server_fd); } verb("V: starting handshake\n"); if (0 != ssl_do_handshake_part (&ssl)) die("SSL handshake first part failed\n"); uint32_t timestamp = ( (uint32_t) ssl.in_msg[6] << 24 ) | ( (uint32_t) ssl.in_msg[7] << 16 ) | ( (uint32_t) ssl.in_msg[8] << 8 ) | ( (uint32_t) ssl.in_msg[9] ); check_timestamp (timestamp); verb("V: continuing handshake\n"); /* Continue with handshake */ while (0 != (ret = ssl_handshake (&ssl))) { if (POLARSSL_ERR_NET_WANT_READ != ret && POLARSSL_ERR_NET_WANT_WRITE != ret) { die("SSL handshake failed\n"); } } // Verify the peer certificate against the CA certs on the local system if (ca_racket) { inspect_key (&ssl, hostname_to_verify); } else { verb ("V: Certificate verification skipped!\n"); } check_key_length (&ssl); memcpy (time_map, ×tamp, sizeof(uint32_t)); proxy_polarssl_free (&proxy_ctx); ssl_free (&ssl); x509_free (&cacert); }
int main( int argc, char *argv[] ) { FILE *f; int ret; size_t n, buflen; int server_fd = -1; unsigned char *p, *end; unsigned char buf[2048]; unsigned char hash[20]; const char *pers = "dh_client"; entropy_context entropy; ctr_drbg_context ctr_drbg; rsa_context rsa; dhm_context dhm; aes_context aes; ((void) argc); ((void) argv); memset( &rsa, 0, sizeof( rsa ) ); memset( &dhm, 0, sizeof( dhm ) ); /* * 1. Setup the RNG */ printf( "\n . Seeding the random number generator" ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } /* * 2. Read the server's public RSA key */ printf( "\n . Reading public key from rsa_pub.txt" ); fflush( stdout ); if( ( f = fopen( "rsa_pub.txt", "rb" ) ) == NULL ) { ret = 1; printf( " failed\n ! Could not open rsa_pub.txt\n" \ " ! Please run rsa_genkey first\n\n" ); goto exit; } rsa_init( &rsa, RSA_PKCS_V15, 0 ); if( ( ret = mpi_read_file( &rsa.N, 16, f ) ) != 0 || ( ret = mpi_read_file( &rsa.E, 16, f ) ) != 0 ) { printf( " failed\n ! mpi_read_file returned %d\n\n", ret ); goto exit; } rsa.len = ( mpi_msb( &rsa.N ) + 7 ) >> 3; fclose( f ); /* * 3. Initiate the connection */ printf( "\n . Connecting to tcp/%s/%d", SERVER_NAME, SERVER_PORT ); fflush( stdout ); if( ( ret = net_connect( &server_fd, SERVER_NAME, SERVER_PORT ) ) != 0 ) { printf( " failed\n ! net_connect returned %d\n\n", ret ); goto exit; } /* * 4a. First get the buffer length */ printf( "\n . Receiving the server's DH parameters" ); fflush( stdout ); memset( buf, 0, sizeof( buf ) ); if( ( ret = net_recv( &server_fd, buf, 2 ) ) != 2 ) { printf( " failed\n ! net_recv returned %d\n\n", ret ); goto exit; } n = buflen = ( buf[0] << 8 ) | buf[1]; if( buflen < 1 || buflen > sizeof( buf ) ) { printf( " failed\n ! Got an invalid buffer length\n\n" ); goto exit; } /* * 4b. Get the DHM parameters: P, G and Ys = G^Xs mod P */ memset( buf, 0, sizeof( buf ) ); if( ( ret = net_recv( &server_fd, buf, n ) ) != (int) n ) { printf( " failed\n ! net_recv returned %d\n\n", ret ); goto exit; } p = buf, end = buf + buflen; if( ( ret = dhm_read_params( &dhm, &p, end ) ) != 0 ) { printf( " failed\n ! dhm_read_params returned %d\n\n", ret ); goto exit; } if( dhm.len < 64 || dhm.len > 512 ) { ret = 1; printf( " failed\n ! Invalid DHM modulus size\n\n" ); goto exit; } /* * 5. Check that the server's RSA signature matches * the SHA-1 hash of (P,G,Ys) */ printf( "\n . Verifying the server's RSA signature" ); fflush( stdout ); p += 2; if( ( n = (size_t) ( end - p ) ) != rsa.len ) { ret = 1; printf( " failed\n ! Invalid RSA signature size\n\n" ); goto exit; } sha1( buf, (int)( p - 2 - buf ), hash ); if( ( ret = rsa_pkcs1_verify( &rsa, RSA_PUBLIC, SIG_RSA_SHA1, 0, hash, p ) ) != 0 ) { printf( " failed\n ! rsa_pkcs1_verify returned %d\n\n", ret ); goto exit; } /* * 6. Send our public value: Yc = G ^ Xc mod P */ printf( "\n . Sending own public value to server" ); fflush( stdout ); n = dhm.len; if( ( ret = dhm_make_public( &dhm, dhm.len, buf, n, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { printf( " failed\n ! dhm_make_public returned %d\n\n", ret ); goto exit; } if( ( ret = net_send( &server_fd, buf, n ) ) != (int) n ) { printf( " failed\n ! net_send returned %d\n\n", ret ); goto exit; } /* * 7. Derive the shared secret: K = Ys ^ Xc mod P */ printf( "\n . Shared secret: " ); fflush( stdout ); n = dhm.len; if( ( ret = dhm_calc_secret( &dhm, buf, &n ) ) != 0 ) { printf( " failed\n ! dhm_calc_secret returned %d\n\n", ret ); goto exit; } for( n = 0; n < 16; n++ ) printf( "%02x", buf[n] ); /* * 8. Setup the AES-256 decryption key * * This is an overly simplified example; best practice is * to hash the shared secret with a random value to derive * the keying material for the encryption/decryption keys, * IVs and MACs. */ printf( "...\n . Receiving and decrypting the ciphertext" ); fflush( stdout ); aes_setkey_dec( &aes, buf, 256 ); memset( buf, 0, sizeof( buf ) ); if( ( ret = net_recv( &server_fd, buf, 16 ) ) != 16 ) { printf( " failed\n ! net_recv returned %d\n\n", ret ); goto exit; } aes_crypt_ecb( &aes, AES_DECRYPT, buf, buf ); buf[16] = '\0'; printf( "\n . Plaintext is \"%s\"\n\n", (char *) buf ); exit: net_close( server_fd ); rsa_free( &rsa ); dhm_free( &dhm ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret, len; int listen_fd; int client_fd = -1; unsigned char buf[1024]; const char *pers = "ssl_server"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_crt srvcert; pk_context pkey; #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_context cache; #endif ((void) argc); ((void) argv); memset( &ssl, 0, sizeof(ssl_context) ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_init( &cache ); #endif x509_crt_init( &srvcert ); pk_init( &pkey ); entropy_init( &entropy ); #if defined(POLARSSL_DEBUG_C) debug_set_threshold( DEBUG_LEVEL ); #endif /* * 1. Load the certificates and private RSA key */ printf( "\n . Loading the server cert. and key..." ); fflush( stdout ); /* * This demonstration program uses embedded test certificates. * Instead, you may want to use x509_crt_parse_file() to read the * server and CA certificates, as well as pk_parse_keyfile(). */ ret = x509_crt_parse( &srvcert, (const unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509_crt_parse returned %d\n\n", ret ); goto exit; } ret = x509_crt_parse( &srvcert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); if( ret != 0 ) { printf( " failed\n ! x509_crt_parse returned %d\n\n", ret ); goto exit; } ret = pk_parse_key( &pkey, (const unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! pk_parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup the listening TCP socket */ printf( " . Bind on https://localhost:4433/ ..." ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 ) { printf( " failed\n ! net_bind returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 3. Seed the RNG */ printf( " . Seeding the random number generator..." ); fflush( stdout ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n" ); /* * 4. Setup stuff */ printf( " . Setting up the SSL data...." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); #if defined(POLARSSL_SSL_CACHE_C) ssl_set_session_cache( &ssl, ssl_cache_get, &cache, ssl_cache_set, &cache ); #endif ssl_set_ca_chain( &ssl, srvcert.next, NULL, NULL ); if( ( ret = ssl_set_own_cert( &ssl, &srvcert, &pkey ) ) != 0 ) { printf( " failed\n ! ssl_set_own_cert returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); reset: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( client_fd != -1 ) net_close( client_fd ); ssl_session_reset( &ssl ); /* * 3. Wait until a client connects */ client_fd = -1; printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned %d\n\n", ret ); goto exit; } ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); printf( " ok\n" ); /* * 5. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned %d\n\n", ret ); goto reset; } } printf( " ok\n" ); /* * 6. Read the HTTP Request */ printf( " < Read from client:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned -0x%x\n", -ret ); break; } break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); if( ret > 0 ) break; } while( 1 ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_ciphersuite( &ssl ) ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " failed\n ! peer closed the connection\n\n" ); goto reset; } if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s\n", len, (char *) buf ); printf( " . Closing the connection..." ); while( ( ret = ssl_close_notify( &ssl ) ) < 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_close_notify returned %d\n\n", ret ); goto reset; } } printf( " ok\n" ); ret = 0; goto reset; exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( client_fd != -1 ) net_close( client_fd ); x509_crt_free( &srvcert ); pk_free( &pkey ); ssl_free( &ssl ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_free( &cache ); #endif ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret, len, server_fd = -1; unsigned char buf[1024]; const char *pers = "dtls_client"; int retry_left = MAX_RETRY; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_crt cacert; ((void) argc); ((void) argv); #if defined(POLARSSL_DEBUG_C) debug_set_threshold( DEBUG_LEVEL ); #endif /* * 0. Initialize the RNG and the session data */ memset( &ssl, 0, sizeof( ssl_context ) ); x509_crt_init( &cacert ); printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n" ); /* * 0. Initialize certificates */ printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_CERTS_C) ret = x509_crt_parse( &cacert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); #else ret = 1; printf("POLARSSL_CERTS_C not defined."); #endif if( ret < 0 ) { printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } printf( " ok (%d skipped)\n", ret ); /* * 1. Start the connection */ printf( " . Connecting to udp/%s/%4d...", SERVER_NAME, SERVER_PORT ); fflush( stdout ); if( ( ret = net_connect( &server_fd, SERVER_ADDR, SERVER_PORT, NET_PROTO_UDP ) ) != 0 ) { printf( " failed\n ! net_connect returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup stuff */ printf( " . Setting up the DTLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_transport( &ssl, SSL_TRANSPORT_DATAGRAM ); /* OPTIONAL is usually a bad choice for security, but makes interop easier * in this simplified example, in which the ca chain is hardcoded. * Production code should set a proper ca chain and use REQUIRED. */ ssl_set_authmode( &ssl, SSL_VERIFY_OPTIONAL ); ssl_set_ca_chain( &ssl, &cacert, NULL, SERVER_NAME ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_bio_timeout( &ssl, &server_fd, net_send, net_recv, net_recv_timeout, READ_TIMEOUT_MS ); /* * 4. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); do ret = ssl_handshake( &ssl ); while( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ); if( ret != 0 ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto exit; } printf( " ok\n" ); /* * 5. Verify the server certificate */ printf( " . Verifying peer X.509 certificate..." ); /* In real life, we would have used SSL_VERIFY_REQUIRED so that the * handshake would not succeed if the peer's cert is bad. Even if we used * SSL_VERIFY_OPTIONAL, we would bail out here if ret != 0 */ if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( " failed\n" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! server certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! server certificate has been revoked\n" ); if( ( ret & BADCERT_CN_MISMATCH ) != 0 ) printf( " ! CN mismatch (expected CN=%s)\n", SERVER_NAME ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n" ); } else printf( " ok\n" ); /* * 6. Write the echo request */ send_request: printf( " > Write to server:" ); fflush( stdout ); len = sizeof( MESSAGE ) - 1; do ret = ssl_write( &ssl, (unsigned char *) MESSAGE, len ); while( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ); if( ret < 0 ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } len = ret; printf( " %d bytes written\n\n%s\n\n", len, MESSAGE ); /* * 7. Read the echo response */ printf( " < Read from server:" ); fflush( stdout ); len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); do ret = ssl_read( &ssl, buf, len ); while( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ); if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_NET_TIMEOUT: printf( " timeout\n\n" ); if( retry_left-- > 0 ) goto send_request; goto exit; case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); ret = 0; goto close_notify; default: printf( " ssl_read returned -0x%x\n\n", -ret ); goto exit; } } len = ret; printf( " %d bytes read\n\n%s\n\n", len, buf ); /* * 8. Done, cleanly close the connection */ close_notify: printf( " . Closing the connection..." ); /* No error checking, the connection might be closed already */ do ret = ssl_close_notify( &ssl ); while( ret == POLARSSL_ERR_NET_WANT_WRITE ); ret = 0; printf( " done\n" ); /* * 9. Final clean-ups and exit */ exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf( "Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( server_fd != -1 ) net_close( server_fd ); x509_crt_free( &cacert ); ssl_free( &ssl ); ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif /* Shell can not handle large exit numbers -> 1 for errors */ if( ret < 0 ) ret = 1; return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0, len, server_fd; unsigned char buf[1024]; char *pers = "ssl_client2"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_cert cacert; x509_cert clicert; rsa_context rsa; int i; char *p, *q; const int *list; /* * Make sure memory references are valid. */ server_fd = 0; memset( &ssl, 0, sizeof( ssl_context ) ); memset( &cacert, 0, sizeof( x509_cert ) ); memset( &clicert, 0, sizeof( x509_cert ) ); memset( &rsa, 0, sizeof( rsa_context ) ); if( argc == 0 ) { usage: if( ret == 0 ) ret = 1; printf( USAGE ); list = ssl_list_ciphersuites(); while( *list ) { printf(" %s\n", ssl_get_ciphersuite_name( *list ) ); list++; } printf("\n"); goto exit; } opt.server_name = DFL_SERVER_NAME; opt.server_port = DFL_SERVER_PORT; opt.debug_level = DFL_DEBUG_LEVEL; opt.request_page = DFL_REQUEST_PAGE; opt.ca_file = DFL_CA_FILE; opt.ca_path = DFL_CA_PATH; opt.crt_file = DFL_CRT_FILE; opt.key_file = DFL_KEY_FILE; opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; opt.renegotiation = DFL_RENEGOTIATION; opt.allow_legacy = DFL_ALLOW_LEGACY; opt.min_version = DFL_MIN_VERSION; opt.max_version = DFL_MAX_VERSION; opt.auth_mode = DFL_AUTH_MODE; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "server_name" ) == 0 ) opt.server_name = q; else if( strcmp( p, "server_port" ) == 0 ) { opt.server_port = atoi( q ); if( opt.server_port < 1 || opt.server_port > 65535 ) goto usage; } else if( strcmp( p, "debug_level" ) == 0 ) { opt.debug_level = atoi( q ); if( opt.debug_level < 0 || opt.debug_level > 65535 ) goto usage; } else if( strcmp( p, "request_page" ) == 0 ) opt.request_page = q; else if( strcmp( p, "ca_file" ) == 0 ) opt.ca_file = q; else if( strcmp( p, "ca_path" ) == 0 ) opt.ca_path = q; else if( strcmp( p, "crt_file" ) == 0 ) opt.crt_file = q; else if( strcmp( p, "key_file" ) == 0 ) opt.key_file = q; else if( strcmp( p, "force_ciphersuite" ) == 0 ) { opt.force_ciphersuite[0] = -1; opt.force_ciphersuite[0] = ssl_get_ciphersuite_id( q ); if( opt.force_ciphersuite[0] <= 0 ) { ret = 2; goto usage; } opt.force_ciphersuite[1] = 0; } else if( strcmp( p, "renegotiation" ) == 0 ) { opt.renegotiation = (atoi( q )) ? SSL_RENEGOTIATION_ENABLED : SSL_RENEGOTIATION_DISABLED; } else if( strcmp( p, "allow_legacy" ) == 0 ) { opt.allow_legacy = atoi( q ); if( opt.allow_legacy < 0 || opt.allow_legacy > 1 ) goto usage; } else if( strcmp( p, "min_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "max_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "force_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_0; opt.max_version = SSL_MINOR_VERSION_0; } else if( strcmp( q, "tls1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_1; opt.max_version = SSL_MINOR_VERSION_1; } else if( strcmp( q, "tls1_1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_2; opt.max_version = SSL_MINOR_VERSION_2; } else if( strcmp( q, "tls1_2" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_3; opt.max_version = SSL_MINOR_VERSION_3; } else goto usage; } else if( strcmp( p, "auth_mode" ) == 0 ) { if( strcmp( q, "none" ) == 0 ) opt.auth_mode = SSL_VERIFY_NONE; else if( strcmp( q, "optional" ) == 0 ) opt.auth_mode = SSL_VERIFY_OPTIONAL; else if( strcmp( q, "required" ) == 0 ) opt.auth_mode = SSL_VERIFY_REQUIRED; else goto usage; } else goto usage; } /* * 0. Initialize the RNG and the session data */ printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned -0x%x\n", -ret ); goto exit; } printf( " ok\n" ); /* * 1.1. Load the trusted CA */ printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.ca_path ) ) ret = x509parse_crtpath( &cacert, opt.ca_path ); else if( strlen( opt.ca_file ) ) ret = x509parse_crtfile( &cacert, opt.ca_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_crt( &cacert, (unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret < 0 ) { printf( " failed\n ! x509parse_crt returned -0x%x\n\n", -ret ); goto exit; } printf( " ok (%d skipped)\n", ret ); /* * 1.2. Load own certificate and private key * * (can be skipped if client authentication is not required) */ printf( " . Loading the client cert. and key..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.crt_file ) ) ret = x509parse_crtfile( &clicert, opt.crt_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_crt( &clicert, (unsigned char *) test_cli_crt, strlen( test_cli_crt ) ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned -0x%x\n\n", -ret ); goto exit; } #if defined(POLARSSL_FS_IO) if( strlen( opt.key_file ) ) ret = x509parse_keyfile( &rsa, opt.key_file, "" ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_key( &rsa, (unsigned char *) test_cli_key, strlen( test_cli_key ), NULL, 0 ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { printf( " failed\n ! x509parse_key returned -0x%x\n\n", -ret ); goto exit; } printf( " ok\n" ); /* * 2. Start the connection */ printf( " . Connecting to tcp/%s/%-4d...", opt.server_name, opt.server_port ); fflush( stdout ); if( ( ret = net_connect( &server_fd, opt.server_name, opt.server_port ) ) != 0 ) { printf( " failed\n ! net_connect returned -0x%x\n\n", -ret ); goto exit; } printf( " ok\n" ); /* * 3. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned -0x%x\n\n", -ret ); goto exit; } printf( " ok\n" ); if( opt.debug_level > 0 ) ssl_set_verify( &ssl, my_verify, NULL ); ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_authmode( &ssl, opt.auth_mode ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER ) ssl_set_ciphersuites( &ssl, opt.force_ciphersuite ); ssl_set_renegotiation( &ssl, opt.renegotiation ); ssl_legacy_renegotiation( &ssl, opt.allow_legacy ); ssl_set_ca_chain( &ssl, &cacert, NULL, opt.server_name ); ssl_set_own_cert( &ssl, &clicert, &rsa ); ssl_set_hostname( &ssl, opt.server_name ); if( opt.min_version != -1 ) ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version ); if( opt.max_version != -1 ) ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version ); /* * 4. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto exit; } } printf( " ok\n [ Ciphersuite is %s ]\n", ssl_get_ciphersuite( &ssl ) ); /* * 5. Verify the server certificate */ printf( " . Verifying peer X.509 certificate..." ); if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( " failed\n" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! server certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! server certificate has been revoked\n" ); if( ( ret & BADCERT_CN_MISMATCH ) != 0 ) printf( " ! CN mismatch (expected CN=%s)\n", opt.server_name ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n" ); } else printf( " ok\n" ); printf( " . Peer certificate information ...\n" ); x509parse_cert_info( (char *) buf, sizeof( buf ) - 1, " ", ssl_get_peer_cert( &ssl ) ); printf( "%s\n", buf ); /* * 6. Write the GET request */ printf( " > Write to server:" ); fflush( stdout ); len = sprintf( (char *) buf, GET_REQUEST, opt.request_page ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned -0x%x\n\n", -ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s", len, (char *) buf ); /* * 7. Read the HTTP response */ printf( " < Read from server:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY ) break; if( ret < 0 ) { printf( "failed\n ! ssl_read returned -0x%x\n\n", -ret ); break; } if( ret == 0 ) { printf("\n\nEOF\n\n"); break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); } while( 1 ); ssl_close_notify( &ssl ); exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; error_strerror( ret, error_buf, 100 ); printf("Last error was: -0x%X - %s\n\n", -ret, error_buf ); } #endif if( server_fd ) net_close( server_fd ); x509_free( &clicert ); x509_free( &cacert ); rsa_free( &rsa ); ssl_free( &ssl ); memset( &ssl, 0, sizeof( ssl ) ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret = 1; mpi G, P, Q; entropy_context entropy; ctr_drbg_context ctr_drbg; const char *pers = "dh_genprime"; FILE *fout; ((void) argc); ((void) argv); mpi_init( &G ); mpi_init( &P ); mpi_init( &Q ); mpi_read_string( &G, 10, GENERATOR ); printf( "\nWARNING: You should not generate and use your own DHM primes\n" ); printf( " unless you are very certain of what you are doing!\n" ); printf( " Failing to follow this instruction may result in\n" ); printf( " weak security for your connections! Use the\n" ); printf( " predefined DHM parameters from dhm.h instead!\n\n" ); printf( "============================================================\n\n" ); printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n . Generating the modulus, please wait..." ); fflush( stdout ); /* * This can take a long time... */ if( ( ret = mpi_gen_prime( &P, DH_P_SIZE, 1, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { printf( " failed\n ! mpi_gen_prime returned %d\n\n", ret ); goto exit; } printf( " ok\n . Verifying that Q = (P-1)/2 is prime..." ); fflush( stdout ); if( ( ret = mpi_sub_int( &Q, &P, 1 ) ) != 0 ) { printf( " failed\n ! mpi_sub_int returned %d\n\n", ret ); goto exit; } if( ( ret = mpi_div_int( &Q, NULL, &Q, 2 ) ) != 0 ) { printf( " failed\n ! mpi_div_int returned %d\n\n", ret ); goto exit; } if( ( ret = mpi_is_prime( &Q, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { printf( " failed\n ! mpi_is_prime returned %d\n\n", ret ); goto exit; } printf( " ok\n . Exporting the value in dh_prime.txt..." ); fflush( stdout ); if( ( fout = fopen( "dh_prime.txt", "wb+" ) ) == NULL ) { ret = 1; printf( " failed\n ! Could not create dh_prime.txt\n\n" ); goto exit; } if( ( ret = mpi_write_file( "P = ", &P, 16, fout ) != 0 ) || ( ret = mpi_write_file( "G = ", &G, 16, fout ) != 0 ) ) { printf( " failed\n ! mpi_write_file returned %d\n\n", ret ); goto exit; } printf( " ok\n\n" ); fclose( fout ); exit: mpi_free( &G ); mpi_free( &P ); mpi_free( &Q ); entropy_free( &entropy ); #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { FILE *f; int ret, c; size_t i; rsa_context rsa; entropy_context entropy; ctr_drbg_context ctr_drbg; unsigned char result[1024]; unsigned char buf[512]; const char *pers = "rsa_decrypt"; ((void) argv); memset(result, 0, sizeof( result ) ); ret = 1; if( argc != 1 ) { polarssl_printf( "usage: rsa_decrypt\n" ); #if defined(_WIN32) polarssl_printf( "\n" ); #endif goto exit; } polarssl_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { polarssl_printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } polarssl_printf( "\n . Reading private key from rsa_priv.txt" ); fflush( stdout ); if( ( f = fopen( "rsa_priv.txt", "rb" ) ) == NULL ) { polarssl_printf( " failed\n ! Could not open rsa_priv.txt\n" \ " ! Please run rsa_genkey first\n\n" ); goto exit; } rsa_init( &rsa, RSA_PKCS_V15, 0 ); if( ( ret = mpi_read_file( &rsa.N , 16, f ) ) != 0 || ( ret = mpi_read_file( &rsa.E , 16, f ) ) != 0 || ( ret = mpi_read_file( &rsa.D , 16, f ) ) != 0 || ( ret = mpi_read_file( &rsa.P , 16, f ) ) != 0 || ( ret = mpi_read_file( &rsa.Q , 16, f ) ) != 0 || ( ret = mpi_read_file( &rsa.DP, 16, f ) ) != 0 || ( ret = mpi_read_file( &rsa.DQ, 16, f ) ) != 0 || ( ret = mpi_read_file( &rsa.QP, 16, f ) ) != 0 ) { polarssl_printf( " failed\n ! mpi_read_file returned %d\n\n", ret ); goto exit; } rsa.len = ( mpi_msb( &rsa.N ) + 7 ) >> 3; fclose( f ); /* * Extract the RSA encrypted value from the text file */ ret = 1; if( ( f = fopen( "result-enc.txt", "rb" ) ) == NULL ) { polarssl_printf( "\n ! Could not open %s\n\n", "result-enc.txt" ); goto exit; } i = 0; while( fscanf( f, "%02X", &c ) > 0 && i < (int) sizeof( buf ) ) buf[i++] = (unsigned char) c; fclose( f ); if( i != rsa.len ) { polarssl_printf( "\n ! Invalid RSA signature format\n\n" ); goto exit; } /* * Decrypt the encrypted RSA data and print the result. */ polarssl_printf( "\n . Decrypting the encrypted data" ); fflush( stdout ); if( ( ret = rsa_pkcs1_decrypt( &rsa, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, &i, buf, result, 1024 ) ) != 0 ) { polarssl_printf( " failed\n ! rsa_pkcs1_decrypt returned %d\n\n", ret ); goto exit; } polarssl_printf( "\n . OK\n\n" ); polarssl_printf( "The decrypted result is: '%s'\n\n", result ); ret = 0; exit: ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) polarssl_printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret; rsa_context rsa; entropy_context entropy; ctr_drbg_context ctr_drbg; FILE *fpub = NULL; FILE *fpriv = NULL; const char *pers = "rsa_genkey"; ((void) argc); ((void) argv); printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n . Generating the RSA key [ %d-bit ]...", KEY_SIZE ); fflush( stdout ); rsa_init( &rsa, RSA_PKCS_V15, 0 ); if( ( ret = rsa_gen_key( &rsa, ctr_drbg_random, &ctr_drbg, KEY_SIZE, EXPONENT ) ) != 0 ) { printf( " failed\n ! rsa_gen_key returned %d\n\n", ret ); goto exit; } printf( " ok\n . Exporting the public key in rsa_pub.txt...." ); fflush( stdout ); if( ( fpub = fopen( "rsa_pub.txt", "wb+" ) ) == NULL ) { printf( " failed\n ! could not open rsa_pub.txt for writing\n\n" ); ret = 1; goto exit; } if( ( ret = mpi_write_file( "N = ", &rsa.N, 16, fpub ) ) != 0 || ( ret = mpi_write_file( "E = ", &rsa.E, 16, fpub ) ) != 0 ) { printf( " failed\n ! mpi_write_file returned %d\n\n", ret ); goto exit; } printf( " ok\n . Exporting the private key in rsa_priv.txt..." ); fflush( stdout ); if( ( fpriv = fopen( "rsa_priv.txt", "wb+" ) ) == NULL ) { printf( " failed\n ! could not open rsa_priv.txt for writing\n" ); ret = 1; goto exit; } if( ( ret = mpi_write_file( "N = " , &rsa.N , 16, fpriv ) ) != 0 || ( ret = mpi_write_file( "E = " , &rsa.E , 16, fpriv ) ) != 0 || ( ret = mpi_write_file( "D = " , &rsa.D , 16, fpriv ) ) != 0 || ( ret = mpi_write_file( "P = " , &rsa.P , 16, fpriv ) ) != 0 || ( ret = mpi_write_file( "Q = " , &rsa.Q , 16, fpriv ) ) != 0 || ( ret = mpi_write_file( "DP = ", &rsa.DP, 16, fpriv ) ) != 0 || ( ret = mpi_write_file( "DQ = ", &rsa.DQ, 16, fpriv ) ) != 0 || ( ret = mpi_write_file( "QP = ", &rsa.QP, 16, fpriv ) ) != 0 ) { printf( " failed\n ! mpi_write_file returned %d\n\n", ret ); goto exit; } /* printf( " ok\n . Generating the certificate..." ); x509write_init_raw( &cert ); x509write_add_pubkey( &cert, &rsa ); x509write_add_subject( &cert, "CN='localhost'" ); x509write_add_validity( &cert, "2007-09-06 17:00:32", "2010-09-06 17:00:32" ); x509write_create_selfsign( &cert, &rsa ); x509write_crtfile( &cert, "cert.der", X509_OUTPUT_DER ); x509write_crtfile( &cert, "cert.pem", X509_OUTPUT_PEM ); x509write_free_raw( &cert ); */ printf( " ok\n\n" ); exit: if( fpub != NULL ) fclose( fpub ); if( fpriv != NULL ) fclose( fpriv ); rsa_free( &rsa ); #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { FILE *f; int ret; size_t i, olen = 0; pk_context pk; entropy_context entropy; ctr_drbg_context ctr_drbg; unsigned char input[1024]; unsigned char buf[512]; const char *pers = "pk_encrypt"; ret = 1; if( argc != 3 ) { polarssl_printf( "usage: pk_encrypt <key_file> <string of max 100 characters>\n" ); #if defined(_WIN32) polarssl_printf( "\n" ); #endif goto exit; } polarssl_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { polarssl_printf( " failed\n ! ctr_drbg_init returned -0x%04x\n", -ret ); goto exit; } polarssl_printf( "\n . Reading public key from '%s'", argv[1] ); fflush( stdout ); pk_init( &pk ); if( ( ret = pk_parse_public_keyfile( &pk, argv[1] ) ) != 0 ) { polarssl_printf( " failed\n ! pk_parse_public_keyfile returned -0x%04x\n", -ret ); goto exit; } if( strlen( argv[2] ) > 100 ) { polarssl_printf( " Input data larger than 100 characters.\n\n" ); goto exit; } memcpy( input, argv[2], strlen( argv[2] ) ); /* * Calculate the RSA encryption of the hash. */ polarssl_printf( "\n . Generating the encrypted value" ); fflush( stdout ); if( ( ret = pk_encrypt( &pk, input, strlen( argv[2] ), buf, &olen, sizeof(buf), ctr_drbg_random, &ctr_drbg ) ) != 0 ) { polarssl_printf( " failed\n ! pk_encrypt returned -0x%04x\n", -ret ); goto exit; } /* * Write the signature into result-enc.txt */ if( ( f = fopen( "result-enc.txt", "wb+" ) ) == NULL ) { ret = 1; polarssl_printf( " failed\n ! Could not create %s\n\n", "result-enc.txt" ); goto exit; } for( i = 0; i < olen; i++ ) polarssl_fprintf( f, "%02X%s", buf[i], ( i + 1 ) % 16 == 0 ? "\r\n" : " " ); fclose( f ); polarssl_printf( "\n . Done (created \"%s\")\n\n", "result-enc.txt" ); exit: ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(POLARSSL_ERROR_C) polarssl_strerror( ret, (char *) buf, sizeof(buf) ); polarssl_printf( " ! Last error was: %s\n", buf ); #endif #if defined(_WIN32) polarssl_printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret; rainbow_context rb; pk_context ctx; entropy_context entropy; ctr_drbg_context ctr_drbg; FILE *fpub = NULL; FILE *fpriv = NULL; const char *pers = "rb_genkey"; unsigned char large_buffer[256000]; ctx.pk_info = &rainbow_info; ctx.pk_ctx = &rb; ((void) argc); ((void) argv); printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n . Generating the TTS key [ %d-bit ]...", TTS_PUBKEY_SIZE_BYTE * 8 ); fflush( stdout ); if( ( ret = rb_genkey( (uint8_t *) &rb.pk, (uint8_t *) &rb.sk, &myrand, NULL ) ) != 0 ) { printf( " failed\n ! rb_genkey returned %d\n\n", ret ); goto exit; } printf( " ok\n . Exporting the public key in ./self-signed/rb-pub.pem...." ); fflush( stdout ); if( ( fpub = fopen( "./self-signed/rb-pub.pem", "wb+" ) ) == NULL ) { printf( " failed\n ! could not open ./self-signed/rb-pub.pem for writing\n\n" ); ret = 1; goto exit; } pk_write_pubkey_pem( &ctx, large_buffer, 256000 ); fwrite( large_buffer, 1, 256000, fpub ); printf( " ok\n . Exporting the private key in ./self-signed/rb-prv.pem..." ); fflush( stdout ); if( ( fpriv = fopen( "./self-signed/rb-prv.pem", "wb+" ) ) == NULL ) { printf( " failed\n ! could not open ./self-signed/rb-prv.pem for writing\n" ); ret = 1; goto exit; } pk_write_key_pem( &ctx, large_buffer, 256000 ); fwrite( large_buffer, 1, 256000, fpriv ); printf( " ok\n\n" ); exit: if( fpub != NULL ) fclose( fpub ); if( fpriv != NULL ) fclose( fpriv ); ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0, len, server_fd; unsigned char buf[1024]; #if defined(POLARSSL_BASE64_C) unsigned char base[1024]; #endif char hostname[32]; char *pers = "ssl_mail_client"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; ssl_session ssn; x509_cert cacert; x509_cert clicert; rsa_context rsa; int i; size_t j, n; char *p, *q; const int *list; /* * Make sure memory references are valid. */ server_fd = 0; memset( &ssn, 0, sizeof( ssl_session ) ); memset( &ssl, 0, sizeof( ssl_context ) ); memset( &cacert, 0, sizeof( x509_cert ) ); memset( &clicert, 0, sizeof( x509_cert ) ); memset( &rsa, 0, sizeof( rsa_context ) ); if( argc == 0 ) { usage: printf( USAGE ); list = ssl_list_ciphersuites(); while( *list ) { printf(" %s\n", ssl_get_ciphersuite_name( *list ) ); list++; } printf("\n"); goto exit; } opt.server_name = DFL_SERVER_NAME; opt.server_port = DFL_SERVER_PORT; opt.debug_level = DFL_DEBUG_LEVEL; opt.authentication = DFL_AUTHENTICATION; opt.mode = DFL_MODE; opt.user_name = DFL_USER_NAME; opt.user_pwd = DFL_USER_PWD; opt.mail_from = DFL_MAIL_FROM; opt.mail_to = DFL_MAIL_TO; opt.ca_file = DFL_CA_FILE; opt.crt_file = DFL_CRT_FILE; opt.key_file = DFL_KEY_FILE; opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; for( i = 1; i < argc; i++ ) { n = strlen( argv[i] ); for( j = 0; j < n; j++ ) { if( argv[i][j] == '=') break; if( argv[i][j] >= 'A' && argv[i][j] <= 'Z' ) argv[i][j] |= 0x20; } p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "server_name" ) == 0 ) opt.server_name = q; else if( strcmp( p, "server_port" ) == 0 ) { opt.server_port = atoi( q ); if( opt.server_port < 1 || opt.server_port > 65535 ) goto usage; } else if( strcmp( p, "debug_level" ) == 0 ) { opt.debug_level = atoi( q ); if( opt.debug_level < 0 || opt.debug_level > 65535 ) goto usage; } else if( strcmp( p, "authentication" ) == 0 ) { opt.authentication = atoi( q ); if( opt.authentication < 0 || opt.authentication > 1 ) goto usage; } else if( strcmp( p, "mode" ) == 0 ) { opt.mode = atoi( q ); if( opt.mode < 0 || opt.mode > 1 ) goto usage; } else if( strcmp( p, "user_name" ) == 0 ) opt.user_name = q; else if( strcmp( p, "user_pwd" ) == 0 ) opt.user_pwd = q; else if( strcmp( p, "mail_from" ) == 0 ) opt.mail_from = q; else if( strcmp( p, "mail_to" ) == 0 ) opt.mail_to = q; else if( strcmp( p, "ca_file" ) == 0 ) opt.ca_file = q; else if( strcmp( p, "crt_file" ) == 0 ) opt.crt_file = q; else if( strcmp( p, "key_file" ) == 0 ) opt.key_file = q; else if( strcmp( p, "force_ciphersuite" ) == 0 ) { opt.force_ciphersuite[0] = -1; opt.force_ciphersuite[0] = ssl_get_ciphersuite_id( q ); if( opt.force_ciphersuite[0] <= 0 ) goto usage; opt.force_ciphersuite[1] = 0; } else goto usage; } /* * 0. Initialize the RNG and the session data */ printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n" ); /* * 1.1. Load the trusted CA */ printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.ca_file ) ) ret = x509parse_crtfile( &cacert, opt.ca_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_crt( &cacert, (unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 1.2. Load own certificate and private key * * (can be skipped if client authentication is not required) */ printf( " . Loading the client cert. and key..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.crt_file ) ) ret = x509parse_crtfile( &clicert, opt.crt_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_crt( &clicert, (unsigned char *) test_cli_crt, strlen( test_cli_crt ) ); #else { ret = -1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } #if defined(POLARSSL_FS_IO) if( strlen( opt.key_file ) ) ret = x509parse_keyfile( &rsa, opt.key_file, "" ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509parse_key( &rsa, (unsigned char *) test_cli_key, strlen( test_cli_key ), NULL, 0 ); #else { ret = -1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { printf( " failed\n ! x509parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Start the connection */ printf( " . Connecting to tcp/%s/%-4d...", opt.server_name, opt.server_port ); fflush( stdout ); if( ( ret = net_connect( &server_fd, opt.server_name, opt.server_port ) ) != 0 ) { printf( " failed\n ! net_connect returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 3. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_authmode( &ssl, SSL_VERIFY_OPTIONAL ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); if( opt.force_ciphersuite[0] == DFL_FORCE_CIPHER ) ssl_set_ciphersuites( &ssl, ssl_default_ciphersuites ); else ssl_set_ciphersuites( &ssl, opt.force_ciphersuite ); ssl_set_session( &ssl, 1, 600, &ssn ); ssl_set_ca_chain( &ssl, &cacert, NULL, opt.server_name ); ssl_set_own_cert( &ssl, &clicert, &rsa ); ssl_set_hostname( &ssl, opt.server_name ); if( opt.mode == MODE_SSL_TLS ) { if( do_handshake( &ssl, &opt ) != 0 ) goto exit; printf( " > Get header from server:" ); fflush( stdout ); ret = write_ssl_and_get_response( &ssl, buf, 0 ); if( ret < 200 || ret > 299 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); printf( " > Write EHLO to server:" ); fflush( stdout ); gethostname( hostname, 32 ); len = sprintf( (char *) buf, "EHLO %s\n", hostname ); ret = write_ssl_and_get_response( &ssl, buf, len ); if( ret < 200 || ret > 299 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } } else { printf( " > Get header from server:" ); fflush( stdout ); ret = write_and_get_response( server_fd, buf, 0 ); if( ret < 200 || ret > 299 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); printf( " > Write EHLO to server:" ); fflush( stdout ); gethostname( hostname, 32 ); len = sprintf( (char *) buf, "EHLO %s\n", hostname ); ret = write_and_get_response( server_fd, buf, len ); if( ret < 200 || ret > 299 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); printf( " > Write STARTTLS to server:" ); fflush( stdout ); gethostname( hostname, 32 ); len = sprintf( (char *) buf, "STARTTLS\n" ); ret = write_and_get_response( server_fd, buf, len ); if( ret < 200 || ret > 299 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); if( do_handshake( &ssl, &opt ) != 0 ) goto exit; } #if defined(POLARSSL_BASE64_C) if( opt.authentication ) { printf( " > Write AUTH LOGIN to server:" ); fflush( stdout ); len = sprintf( (char *) buf, "AUTH LOGIN\n" ); ret = write_ssl_and_get_response( &ssl, buf, len ); if( ret < 200 || ret > 399 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); printf( " > Write username to server: %s", opt.user_name ); fflush( stdout ); n = sizeof( buf ); len = base64_encode( base, &n, (unsigned char *) opt.user_name, strlen( opt.user_name ) ); len = sprintf( (char *) buf, "%s\n", base ); ret = write_ssl_and_get_response( &ssl, buf, len ); if( ret < 300 || ret > 399 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); printf( " > Write password to server: %s", opt.user_pwd ); fflush( stdout ); len = base64_encode( base, &n, (unsigned char *) opt.user_pwd, strlen( opt.user_pwd ) ); len = sprintf( (char *) buf, "%s\n", base ); ret = write_ssl_and_get_response( &ssl, buf, len ); if( ret < 200 || ret > 399 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); } #endif printf( " > Write MAIL FROM to server:" ); fflush( stdout ); len = sprintf( (char *) buf, "MAIL FROM:<%s>\n", opt.mail_from ); ret = write_ssl_and_get_response( &ssl, buf, len ); if( ret < 200 || ret > 299 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); printf( " > Write RCPT TO to server:" ); fflush( stdout ); len = sprintf( (char *) buf, "RCPT TO:<%s>\n", opt.mail_to ); ret = write_ssl_and_get_response( &ssl, buf, len ); if( ret < 200 || ret > 299 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); printf( " > Write DATA to server:" ); fflush( stdout ); len = sprintf( (char *) buf, "DATA\n" ); ret = write_ssl_and_get_response( &ssl, buf, len ); if( ret < 300 || ret > 399 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); printf( " > Write content to server:" ); fflush( stdout ); len = sprintf( (char *) buf, "From: %s\nSubject: PolarSSL Test mail\n\n" "This is a simple test mail from the " "PolarSSL mail client example.\n" "\n" "Enjoy!", opt.mail_from ); ret = write_ssl_data( &ssl, buf, len ); len = sprintf( (char *) buf, "\r\n.\r\n"); ret = write_ssl_and_get_response( &ssl, buf, len ); if( ret < 200 || ret > 299 ) { printf( " failed\n ! server responded with %d\n\n", ret ); goto exit; } printf(" ok\n" ); ssl_close_notify( &ssl ); exit: if( server_fd ) net_close( server_fd ); x509_free( &clicert ); x509_free( &cacert ); rsa_free( &rsa ); ssl_free( &ssl ); memset( &ssl, 0, sizeof( ssl ) ); #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { FILE *f; int ret = 1; pk_context pk; entropy_context entropy; ctr_drbg_context ctr_drbg; unsigned char hash[20]; unsigned char buf[POLARSSL_MPI_MAX_SIZE]; char filename[512]; const char *pers = "pk_sign"; size_t olen = 0; entropy_init( &entropy ); pk_init( &pk ); if( argc != 3 ) { printf( "usage: pk_sign <key_file> <filename>\n" ); #if defined(_WIN32) printf( "\n" ); #endif goto exit; } printf( "\n . Seeding the random number generator..." ); fflush( stdout ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned -0x%04x\n", -ret ); goto exit; } printf( "\n . Reading private key from '%s'", argv[1] ); fflush( stdout ); if( ( ret = pk_parse_keyfile( &pk, argv[1], "" ) ) != 0 ) { ret = 1; printf( " failed\n ! Could not open '%s'\n", argv[1] ); goto exit; } /* * Compute the SHA-1 hash of the input file, * then calculate the signature of the hash. */ printf( "\n . Generating the SHA-1 signature" ); fflush( stdout ); if( ( ret = sha1_file( argv[2], hash ) ) != 0 ) { printf( " failed\n ! Could not open or read %s\n\n", argv[2] ); goto exit; } if( ( ret = pk_sign( &pk, POLARSSL_MD_SHA1, hash, 0, buf, &olen, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { printf( " failed\n ! pk_sign returned -0x%04x\n", -ret ); goto exit; } /* * Write the signature into <filename>-sig.txt */ snprintf( filename, sizeof(filename), "%s.sig", argv[2] ); if( ( f = fopen( filename, "wb+" ) ) == NULL ) { ret = 1; printf( " failed\n ! Could not create %s\n\n", filename ); goto exit; } if( fwrite( buf, 1, olen, f ) != olen ) { printf( "failed\n ! fwrite failed\n\n" ); goto exit; } fclose( f ); printf( "\n . Done (created \"%s\")\n\n", filename ); exit: pk_free( &pk ); entropy_free( &entropy ); #if defined(POLARSSL_ERROR_C) polarssl_strerror( ret, (char *) buf, sizeof(buf) ); printf( " ! Last error was: %s\n", buf ); #endif #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( void ) { int ret = exit_ok; int server_fd = -1; struct sockaddr_in addr; #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt ca; #endif entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; /* * 0. Initialize and setup stuff */ memset( &ssl, 0, sizeof( ssl_context ) ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_init( &ca ); #endif entropy_init( &entropy ); if( ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) != 0 ) { ret = ssl_init_failed; goto exit; } if( ssl_init( &ssl ) != 0 ) { ret = ssl_init_failed; goto exit; } ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) ssl_set_psk( &ssl, psk, sizeof( psk ), (const unsigned char *) psk_id, sizeof( psk_id ) - 1 ); #endif #if defined(POLARSSL_X509_CRT_PARSE_C) if( x509_crt_parse_der( &ca, ca_cert, sizeof( ca_cert ) ) != 0 ) { ret = x509_crt_parse_failed; goto exit; } ssl_set_ca_chain( &ssl, &ca, NULL, HOSTNAME ); ssl_set_authmode( &ssl, SSL_VERIFY_REQUIRED ); #endif /* * 1. Start the connection */ memset( &addr, 0, sizeof( addr ) ); addr.sin_family = AF_INET; ret = 1; /* for endianness detection */ addr.sin_port = *((char *) &ret) == ret ? PORT_LE : PORT_BE; addr.sin_addr.s_addr = *((char *) &ret) == ret ? ADDR_LE : ADDR_BE; ret = 0; if( ( server_fd = socket( AF_INET, SOCK_STREAM, 0 ) ) < 0 ) { ret = socket_failed; goto exit; } if( connect( server_fd, (const struct sockaddr *) &addr, sizeof( addr ) ) < 0 ) { ret = connect_failed; goto exit; } ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); if( ssl_handshake( &ssl ) != 0 ) { ret = ssl_handshake_failed; goto exit; } /* * 2. Write the GET request and close the connection */ if( ssl_write( &ssl, (const unsigned char *) GET_REQUEST, sizeof( GET_REQUEST ) - 1 ) <= 0 ) { ret = ssl_write_failed; goto exit; } ssl_close_notify( &ssl ); exit: if( server_fd != -1 ) net_close( server_fd ); ssl_free( &ssl ); ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_free( &ca ); #endif return( ret ); }
static CURLcode polarssl_connect_step1(struct connectdata *conn, int sockindex) { struct SessionHandle *data = conn->data; struct ssl_connect_data* connssl = &conn->ssl[sockindex]; bool sni = true; /* default is SNI enabled */ int ret = -1; #ifdef ENABLE_IPV6 struct in6_addr addr; #else struct in_addr addr; #endif void *old_session = NULL; size_t old_session_size = 0; char errorbuf[128]; errorbuf[0]=0; /* PolarSSL only supports SSLv3 and TLSv1 */ if(data->set.ssl.version == CURL_SSLVERSION_SSLv2) { failf(data, "PolarSSL does not support SSLv2"); return CURLE_SSL_CONNECT_ERROR; } else if(data->set.ssl.version == CURL_SSLVERSION_SSLv3) sni = false; /* SSLv3 has no SNI */ #ifdef THREADING_SUPPORT entropy_init_mutex(&entropy); if((ret = ctr_drbg_init(&connssl->ctr_drbg, entropy_func_mutex, &entropy, connssl->ssn.id, connssl->ssn.length)) != 0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #else entropy_init(&connssl->entropy); if((ret = ctr_drbg_init(&connssl->ctr_drbg, entropy_func, &connssl->entropy, connssl->ssn.id, connssl->ssn.length)) != 0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #endif /* THREADING_SUPPORT */ /* Load the trusted CA */ memset(&connssl->cacert, 0, sizeof(x509_crt)); if(data->set.str[STRING_SSL_CAFILE]) { ret = x509_crt_parse_file(&connssl->cacert, data->set.str[STRING_SSL_CAFILE]); if(ret<0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading ca cert file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CAFILE], -ret, errorbuf); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } if(data->set.str[STRING_SSL_CAPATH]) { ret = x509_crt_parse_path(&connssl->cacert, data->set.str[STRING_SSL_CAPATH]); if(ret<0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading ca cert path %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CAPATH], -ret, errorbuf); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } /* Load the client certificate */ memset(&connssl->clicert, 0, sizeof(x509_crt)); if(data->set.str[STRING_CERT]) { ret = x509_crt_parse_file(&connssl->clicert, data->set.str[STRING_CERT]); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading client cert file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_CERT], -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the client private key */ if(data->set.str[STRING_KEY]) { pk_context pk; pk_init(&pk); ret = pk_parse_keyfile(&pk, data->set.str[STRING_KEY], data->set.str[STRING_KEY_PASSWD]); if(ret == 0 && !pk_can_do(&pk, POLARSSL_PK_RSA)) ret = POLARSSL_ERR_PK_TYPE_MISMATCH; if(ret == 0) rsa_copy(&connssl->rsa, pk_rsa(pk)); else rsa_free(&connssl->rsa); pk_free(&pk); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading private key %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_KEY], -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the CRL */ memset(&connssl->crl, 0, sizeof(x509_crl)); if(data->set.str[STRING_SSL_CRLFILE]) { ret = x509_crl_parse_file(&connssl->crl, data->set.str[STRING_SSL_CRLFILE]); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading CRL file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CRLFILE], -ret, errorbuf); return CURLE_SSL_CRL_BADFILE; } } infof(data, "PolarSSL: Connecting to %s:%d\n", conn->host.name, conn->remote_port); if(ssl_init(&connssl->ssl)) { failf(data, "PolarSSL: ssl_init failed"); return CURLE_SSL_CONNECT_ERROR; } switch(data->set.ssl.version) { default: case CURL_SSLVERSION_DEFAULT: case CURL_SSLVERSION_TLSv1: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); break; case CURL_SSLVERSION_SSLv3: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); infof(data, "PolarSSL: Forced min. SSL Version to be SSLv3\n"); break; case CURL_SSLVERSION_TLSv1_0: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.0\n"); break; case CURL_SSLVERSION_TLSv1_1: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.1\n"); break; case CURL_SSLVERSION_TLSv1_2: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.2\n"); break; } ssl_set_endpoint(&connssl->ssl, SSL_IS_CLIENT); ssl_set_authmode(&connssl->ssl, SSL_VERIFY_OPTIONAL); ssl_set_rng(&connssl->ssl, ctr_drbg_random, &connssl->ctr_drbg); ssl_set_bio(&connssl->ssl, net_recv, &conn->sock[sockindex], net_send, &conn->sock[sockindex]); ssl_set_ciphersuites(&connssl->ssl, ssl_list_ciphersuites()); if(!Curl_ssl_getsessionid(conn, &old_session, &old_session_size)) { memcpy(&connssl->ssn, old_session, old_session_size); infof(data, "PolarSSL re-using session\n"); } ssl_set_session(&connssl->ssl, &connssl->ssn); ssl_set_ca_chain(&connssl->ssl, &connssl->cacert, &connssl->crl, conn->host.name); ssl_set_own_cert_rsa(&connssl->ssl, &connssl->clicert, &connssl->rsa); if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) && #ifdef ENABLE_IPV6 !Curl_inet_pton(AF_INET6, conn->host.name, &addr) && #endif sni && ssl_set_hostname(&connssl->ssl, conn->host.name)) { infof(data, "WARNING: failed to configure " "server name indication (SNI) TLS extension\n"); } #ifdef HAS_ALPN if(data->set.ssl_enable_alpn) { static const char* protocols[3]; int cur = 0; #ifdef USE_NGHTTP2 if(data->set.httpversion == CURL_HTTP_VERSION_2_0) { protocols[cur++] = NGHTTP2_PROTO_VERSION_ID; infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID); } #endif protocols[cur++] = ALPN_HTTP_1_1; infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1); protocols[cur] = NULL; ssl_set_alpn_protocols(&connssl->ssl, protocols); } #endif #ifdef POLARSSL_DEBUG ssl_set_dbg(&connssl->ssl, polarssl_debug, data); #endif connssl->connecting_state = ssl_connect_2; return CURLE_OK; }
int main( int argc, char *argv[] ) { int ret; int listen_fd; int client_fd = -1; entropy_context entropy; x509_crt srvcert; pk_context pkey; #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) unsigned char alloc_buf[100000]; #endif #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_context cache; #endif ((void) argc); ((void) argv); #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) memory_buffer_alloc_init( alloc_buf, sizeof(alloc_buf) ); #endif #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_init( &cache ); base_info.cache = &cache; #endif memset( threads, 0, sizeof(threads) ); polarssl_mutex_init( &debug_mutex ); /* * We use only a single entropy source that is used in all the threads. */ entropy_init( &entropy ); base_info.entropy = &entropy; /* * 1. Load the certificates and private RSA key */ printf( "\n . Loading the server cert. and key..." ); fflush( stdout ); x509_crt_init( &srvcert ); /* * This demonstration program uses embedded test certificates. * Instead, you may want to use x509_crt_parse_file() to read the * server and CA certificates, as well as pk_parse_keyfile(). */ ret = x509_crt_parse( &srvcert, (const unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509_crt_parse returned %d\n\n", ret ); goto exit; } ret = x509_crt_parse( &srvcert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); if( ret != 0 ) { printf( " failed\n ! x509_crt_parse returned %d\n\n", ret ); goto exit; } pk_init( &pkey ); ret = pk_parse_key( &pkey, (const unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! pk_parse_key returned %d\n\n", ret ); goto exit; } base_info.ca_chain = srvcert.next; base_info.server_cert = &srvcert; base_info.server_key = &pkey; printf( " ok\n" ); /* * 2. Setup the listening TCP socket */ printf( " . Bind on https://localhost:4433/ ..." ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 ) { printf( " failed\n ! net_bind returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); reset: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf( " [ main ] Last error was: -0x%04x - %s\n", -ret, error_buf ); } #endif /* * 3. Wait until a client connects */ client_fd = -1; printf( " [ main ] Waiting for a remote connection\n" ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " [ main ] failed: net_accept returned -0x%04x\n", ret ); goto exit; } printf( " [ main ] ok\n" ); printf( " [ main ] Creating a new thread\n" ); if( ( ret = thread_create( client_fd ) ) != 0 ) { printf( " [ main ] failed: thread_create returned %d\n", ret ); net_close( client_fd ); goto reset; } ret = 0; goto reset; exit: x509_crt_free( &srvcert ); pk_free( &pkey ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_free( &cache ); #endif ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); polarssl_mutex_free( &debug_mutex ); #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) memory_buffer_alloc_free(); #endif #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }