static CURLcode polarssl_connect_step1(struct connectdata *conn, int sockindex) { struct SessionHandle *data = conn->data; struct ssl_connect_data* connssl = &conn->ssl[sockindex]; bool sni = TRUE; /* default is SNI enabled */ int ret = -1; #ifdef ENABLE_IPV6 struct in6_addr addr; #else struct in_addr addr; #endif void *old_session = NULL; size_t old_session_size = 0; char errorbuf[128]; errorbuf[0]=0; /* PolarSSL only supports SSLv3 and TLSv1 */ if(data->set.ssl.version == CURL_SSLVERSION_SSLv2) { failf(data, "PolarSSL does not support SSLv2"); return CURLE_SSL_CONNECT_ERROR; } else if(data->set.ssl.version == CURL_SSLVERSION_SSLv3) sni = FALSE; /* SSLv3 has no SNI */ #ifdef THREADING_SUPPORT entropy_init_mutex(&entropy); if((ret = ctr_drbg_init(&connssl->ctr_drbg, entropy_func_mutex, &entropy, connssl->ssn.id, connssl->ssn.length)) != 0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #else entropy_init(&connssl->entropy); if((ret = ctr_drbg_init(&connssl->ctr_drbg, entropy_func, &connssl->entropy, connssl->ssn.id, connssl->ssn.length)) != 0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Failed - PolarSSL: ctr_drbg_init returned (-0x%04X) %s\n", -ret, errorbuf); } #endif /* THREADING_SUPPORT */ /* Load the trusted CA */ memset(&connssl->cacert, 0, sizeof(x509_crt)); if(data->set.str[STRING_SSL_CAFILE]) { ret = x509_crt_parse_file(&connssl->cacert, data->set.str[STRING_SSL_CAFILE]); if(ret<0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading ca cert file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CAFILE], -ret, errorbuf); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } if(data->set.str[STRING_SSL_CAPATH]) { ret = x509_crt_parse_path(&connssl->cacert, data->set.str[STRING_SSL_CAPATH]); if(ret<0) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading ca cert path %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CAPATH], -ret, errorbuf); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } /* Load the client certificate */ memset(&connssl->clicert, 0, sizeof(x509_crt)); if(data->set.str[STRING_CERT]) { ret = x509_crt_parse_file(&connssl->clicert, data->set.str[STRING_CERT]); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading client cert file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_CERT], -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the client private key */ if(data->set.str[STRING_KEY]) { pk_context pk; pk_init(&pk); ret = pk_parse_keyfile(&pk, data->set.str[STRING_KEY], data->set.str[STRING_KEY_PASSWD]); if(ret == 0 && !pk_can_do(&pk, POLARSSL_PK_RSA)) ret = POLARSSL_ERR_PK_TYPE_MISMATCH; if(ret == 0) rsa_copy(&connssl->rsa, pk_rsa(pk)); else rsa_free(&connssl->rsa); pk_free(&pk); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading private key %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_KEY], -ret, errorbuf); return CURLE_SSL_CERTPROBLEM; } } /* Load the CRL */ memset(&connssl->crl, 0, sizeof(x509_crl)); if(data->set.str[STRING_SSL_CRLFILE]) { ret = x509_crl_parse_file(&connssl->crl, data->set.str[STRING_SSL_CRLFILE]); if(ret) { #ifdef POLARSSL_ERROR_C error_strerror(ret, errorbuf, sizeof(errorbuf)); #endif /* POLARSSL_ERROR_C */ failf(data, "Error reading CRL file %s - PolarSSL: (-0x%04X) %s", data->set.str[STRING_SSL_CRLFILE], -ret, errorbuf); return CURLE_SSL_CRL_BADFILE; } } infof(data, "PolarSSL: Connecting to %s:%d\n", conn->host.name, conn->remote_port); if(ssl_init(&connssl->ssl)) { failf(data, "PolarSSL: ssl_init failed"); return CURLE_SSL_CONNECT_ERROR; } switch(data->set.ssl.version) { default: case CURL_SSLVERSION_DEFAULT: case CURL_SSLVERSION_TLSv1: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); break; case CURL_SSLVERSION_SSLv3: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_0); infof(data, "PolarSSL: Forced min. SSL Version to be SSLv3\n"); break; case CURL_SSLVERSION_TLSv1_0: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_1); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.0\n"); break; case CURL_SSLVERSION_TLSv1_1: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.1\n"); break; case CURL_SSLVERSION_TLSv1_2: ssl_set_min_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3); ssl_set_max_version(&connssl->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3); infof(data, "PolarSSL: Forced min. SSL Version to be TLS 1.2\n"); break; } ssl_set_endpoint(&connssl->ssl, SSL_IS_CLIENT); ssl_set_authmode(&connssl->ssl, SSL_VERIFY_OPTIONAL); ssl_set_rng(&connssl->ssl, ctr_drbg_random, &connssl->ctr_drbg); ssl_set_bio(&connssl->ssl, net_recv, &conn->sock[sockindex], net_send, &conn->sock[sockindex]); ssl_set_ciphersuites(&connssl->ssl, ssl_list_ciphersuites()); if(!Curl_ssl_getsessionid(conn, &old_session, &old_session_size)) { memcpy(&connssl->ssn, old_session, old_session_size); infof(data, "PolarSSL re-using session\n"); } ssl_set_session(&connssl->ssl, &connssl->ssn); ssl_set_ca_chain(&connssl->ssl, &connssl->cacert, &connssl->crl, conn->host.name); ssl_set_own_cert_rsa(&connssl->ssl, &connssl->clicert, &connssl->rsa); if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) && #ifdef ENABLE_IPV6 !Curl_inet_pton(AF_INET6, conn->host.name, &addr) && #endif sni && ssl_set_hostname(&connssl->ssl, conn->host.name)) { infof(data, "WARNING: failed to configure " "server name indication (SNI) TLS extension\n"); } #ifdef HAS_ALPN if(data->set.ssl_enable_alpn) { static const char* protocols[3]; int cur = 0; #ifdef USE_NGHTTP2 if(data->set.httpversion >= CURL_HTTP_VERSION_2) { protocols[cur++] = NGHTTP2_PROTO_VERSION_ID; infof(data, "ALPN, offering %s\n", NGHTTP2_PROTO_VERSION_ID); } #endif protocols[cur++] = ALPN_HTTP_1_1; infof(data, "ALPN, offering %s\n", ALPN_HTTP_1_1); protocols[cur] = NULL; ssl_set_alpn_protocols(&connssl->ssl, protocols); } #endif #ifdef POLARSSL_DEBUG ssl_set_dbg(&connssl->ssl, polarssl_debug, data); #endif connssl->connecting_state = ssl_connect_2; return CURLE_OK; }
bool CWII_IPC_HLE_Device_net_ssl::IOCtlV(u32 _CommandAddress) { SIOCtlVBuffer CommandBuffer(_CommandAddress); u32 _BufferIn = 0, _BufferIn2 = 0, _BufferIn3 = 0; u32 BufferInSize = 0, BufferInSize2 = 0, BufferInSize3 = 0; u32 BufferOut = 0, BufferOut2 = 0, BufferOut3 = 0; u32 BufferOutSize = 0, BufferOutSize2 = 0, BufferOutSize3 = 0; if (CommandBuffer.InBuffer.size() > 0) { _BufferIn = CommandBuffer.InBuffer.at(0).m_Address; BufferInSize = CommandBuffer.InBuffer.at(0).m_Size; } if (CommandBuffer.InBuffer.size() > 1) { _BufferIn2 = CommandBuffer.InBuffer.at(1).m_Address; BufferInSize2 = CommandBuffer.InBuffer.at(1).m_Size; } if (CommandBuffer.InBuffer.size() > 2) { _BufferIn3 = CommandBuffer.InBuffer.at(2).m_Address; BufferInSize3 = CommandBuffer.InBuffer.at(2).m_Size; } if (CommandBuffer.PayloadBuffer.size() > 0) { BufferOut = CommandBuffer.PayloadBuffer.at(0).m_Address; BufferOutSize = CommandBuffer.PayloadBuffer.at(0).m_Size; } if (CommandBuffer.PayloadBuffer.size() > 1) { BufferOut2 = CommandBuffer.PayloadBuffer.at(1).m_Address; BufferOutSize2 = CommandBuffer.PayloadBuffer.at(1).m_Size; } if (CommandBuffer.PayloadBuffer.size() > 2) { BufferOut3 = CommandBuffer.PayloadBuffer.at(2).m_Address; BufferOutSize3 = CommandBuffer.PayloadBuffer.at(2).m_Size; } switch (CommandBuffer.Parameter) { case IOCTLV_NET_SSL_NEW: { int verifyOption = Memory::Read_U32(BufferOut); const char * hostname = (const char*) Memory::GetPointer(BufferOut2); int freeSSL = this->getSSLFreeID(); if (freeSSL) { int sslID = freeSSL - 1; int ret = ssl_init(&_SSL[sslID].ctx); if (ret) { // Cleanup possibly dirty ctx memset(&_SSL[sslID].ctx, 0, sizeof(ssl_context)); goto _SSL_NEW_ERROR; } entropy_init(&_SSL[sslID].entropy); ssl_set_rng(&_SSL[sslID].ctx, entropy_func, &_SSL[sslID].entropy); // For some reason we can't use TLSv1.2, v1.1 and below are fine! ssl_set_max_version(&_SSL[sslID].ctx, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); ssl_set_session(&_SSL[sslID].ctx, &_SSL[sslID].session); ssl_set_endpoint(&_SSL[sslID].ctx, SSL_IS_CLIENT); ssl_set_authmode(&_SSL[sslID].ctx, SSL_VERIFY_NONE); ssl_set_renegotiation(&_SSL[sslID].ctx, SSL_RENEGOTIATION_ENABLED); memcpy(_SSL[sslID].hostname, hostname, min((int)BufferOutSize2, NET_SSL_MAX_HOSTNAME_LEN)); _SSL[sslID].hostname[NET_SSL_MAX_HOSTNAME_LEN-1] = '\0'; ssl_set_hostname(&_SSL[sslID].ctx, _SSL[sslID].hostname); _SSL[sslID].active = true; Memory::Write_U32(freeSSL, _BufferIn); } else { _SSL_NEW_ERROR: Memory::Write_U32(SSL_ERR_FAILED, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_NEW (%d, %s) " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", verifyOption, hostname, _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_SHUTDOWN: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { ssl_close_notify(&_SSL[sslID].ctx); ssl_session_free(&_SSL[sslID].session); ssl_free(&_SSL[sslID].ctx); x509_crt_free(&_SSL[sslID].cacert); x509_crt_free(&_SSL[sslID].clicert); memset(&_SSL[sslID].ctx, 0, sizeof(ssl_context)); memset(&_SSL[sslID].session, 0, sizeof(ssl_session)); memset(&_SSL[sslID].entropy, 0, sizeof(entropy_context)); memset(_SSL[sslID].hostname, 0, NET_SSL_MAX_HOSTNAME_LEN); _SSL[sslID].active = false; Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SHUTDOWN " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_SETROOTCA: { INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETROOTCA " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { int ret = x509_crt_parse_der( &_SSL[sslID].cacert, Memory::GetPointer(BufferOut2), BufferOutSize2); if (ret) { Memory::Write_U32(SSL_ERR_FAILED, _BufferIn); } else { ssl_set_ca_chain(&_SSL[sslID].ctx, &_SSL[sslID].cacert, NULL, _SSL[sslID].hostname); Memory::Write_U32(SSL_OK, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETROOTCA = %d", ret); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } break; } case IOCTLV_NET_SSL_SETBUILTINCLIENTCERT: { INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINCLIENTCERT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { std::string cert_base_path(File::GetUserPath(D_WIIUSER_IDX)); int ret = x509_crt_parse_file(&_SSL[sslID].clicert, (cert_base_path + "clientca.pem").c_str()); int pk_ret = pk_parse_keyfile(&_SSL[sslID].pk, (cert_base_path + "clientcakey.pem").c_str(), NULL); if (ret || pk_ret) { x509_crt_free(&_SSL[sslID].clicert); pk_free(&_SSL[sslID].pk); memset(&_SSL[sslID].clicert, 0, sizeof(x509_crt)); memset(&_SSL[sslID].pk, 0, sizeof(pk_context)); Memory::Write_U32(SSL_ERR_FAILED, _BufferIn); } else { ssl_set_own_cert(&_SSL[sslID].ctx, &_SSL[sslID].clicert, &_SSL[sslID].pk); Memory::Write_U32(SSL_OK, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINCLIENTCERT = (%d, %d)", ret, pk_ret); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINCLIENTCERT invalid sslID = %d", sslID); } break; } case IOCTLV_NET_SSL_REMOVECLIENTCERT: { INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_REMOVECLIENTCERT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { x509_crt_free(&_SSL[sslID].clicert); pk_free(&_SSL[sslID].pk); memset(&_SSL[sslID].clicert, 0, sizeof(x509_crt)); memset(&_SSL[sslID].pk, 0, sizeof(pk_context)); ssl_set_own_cert(&_SSL[sslID].ctx, NULL, NULL); Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINCLIENTCERT invalid sslID = %d", sslID); } break; } case IOCTLV_NET_SSL_SETBUILTINROOTCA: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { std::string cert_base_path(File::GetUserPath(D_WIIUSER_IDX)); int ret = x509_crt_parse_file(&_SSL[sslID].cacert, (cert_base_path + "rootca.pem").c_str()); if (ret) { x509_crt_free(&_SSL[sslID].clicert); Memory::Write_U32(SSL_ERR_FAILED, _BufferIn); } else { ssl_set_ca_chain(&_SSL[sslID].ctx, &_SSL[sslID].cacert, NULL, _SSL[sslID].hostname); Memory::Write_U32(SSL_OK, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINROOTCA = %d", ret); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETBUILTINROOTCA " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_CONNECT: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { _SSL[sslID].sockfd = Memory::Read_U32(BufferOut2); INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_CONNECT socket = %d", _SSL[sslID].sockfd); ssl_set_bio(&_SSL[sslID].ctx, net_recv, &_SSL[sslID].sockfd, net_send, &_SSL[sslID].sockfd); Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_CONNECT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_DOHANDSHAKE: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { WiiSockMan &sm = WiiSockMan::getInstance(); sm.doSock(_SSL[sslID].sockfd, _CommandAddress, IOCTLV_NET_SSL_DOHANDSHAKE); return false; } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } break; } case IOCTLV_NET_SSL_WRITE: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { WiiSockMan &sm = WiiSockMan::getInstance(); sm.doSock(_SSL[sslID].sockfd, _CommandAddress, IOCTLV_NET_SSL_WRITE); return false; } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_WRITE " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); INFO_LOG(WII_IPC_SSL, "%s", Memory::GetPointer(BufferOut2)); break; } case IOCTLV_NET_SSL_READ: { int ret = 0; int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { WiiSockMan &sm = WiiSockMan::getInstance(); sm.doSock(_SSL[sslID].sockfd, _CommandAddress, IOCTLV_NET_SSL_READ); return false; } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_READ(%d)" "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", ret, _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_SETROOTCADEFAULT: { int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETROOTCADEFAULT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } case IOCTLV_NET_SSL_SETCLIENTCERTDEFAULT: { INFO_LOG(WII_IPC_SSL, "IOCTLV_NET_SSL_SETCLIENTCERTDEFAULT " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); int sslID = Memory::Read_U32(BufferOut) - 1; if (SSLID_VALID(sslID)) { Memory::Write_U32(SSL_OK, _BufferIn); } else { Memory::Write_U32(SSL_ERR_ID, _BufferIn); } break; } default: ERROR_LOG(WII_IPC_SSL, "%i " "BufferIn: (%08x, %i), BufferIn2: (%08x, %i), " "BufferIn3: (%08x, %i), BufferOut: (%08x, %i), " "BufferOut2: (%08x, %i), BufferOut3: (%08x, %i)", CommandBuffer.Parameter, _BufferIn, BufferInSize, _BufferIn2, BufferInSize2, _BufferIn3, BufferInSize3, BufferOut, BufferOutSize, BufferOut2, BufferOutSize2, BufferOut3, BufferOutSize3); break; } // SSL return codes are written to BufferIn Memory::Write_U32(0, _CommandAddress+4); return true; }
LWS_VISIBLE int lws_server_socket_service_ssl(struct lws *wsi, lws_sockfd_type accept_fd) { struct lws_context *context = wsi->context; struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi]; int n, m; #if !defined(USE_WOLFSSL) && !defined(LWS_USE_POLARSSL) && !defined(LWS_USE_MBEDTLS) BIO *bio; #endif if (!LWS_SSL_ENABLED(wsi->vhost)) return 0; switch (wsi->mode) { case LWSCM_SSL_INIT: if (wsi->ssl) lwsl_err("%s: leaking ssl\n", __func__); if (accept_fd == LWS_SOCK_INVALID) assert(0); #if defined(LWS_USE_POLARSSL) { ssl_session *ssn; int rc; wsi->ssl = lws_zalloc(sizeof(ssl_context)); ssn = lws_zalloc(sizeof(ssl_session)); rc = ssl_init(wsi->ssl); if (rc) { lwsl_err("ssl_init failed\n"); goto fail; } ssl_set_endpoint(wsi->ssl, SSL_IS_SERVER); ssl_set_authmode(wsi->ssl, SSL_VERIFY_OPTIONAL); ssl_set_rng(wsi->ssl, urandom_bytes, NULL); ssl_set_dbg(wsi->ssl, pssl_debug, NULL); ssl_set_bio(wsi->ssl, net_recv, &wsi->sock, net_send, &wsi->sock); ssl_set_ciphersuites(wsi->ssl, ciphers); ssl_set_session(wsi->ssl, ssn); ssl_set_ca_chain(wsi->ssl, &wsi->vhost->ssl_ctx->ca, NULL, NULL); ssl_set_own_cert_rsa(wsi->ssl, &wsi->vhost->ssl_ctx->certificate, &wsi->vhost->ssl_ctx->key); // ssl_set_dh_param(wsi->ssl, my_dhm_P, my_dhm_G); lwsl_err("%s: polarssl init done\n", __func__); } #else #if defined(LWS_USE_MBEDTLS) #else wsi->ssl = SSL_new(wsi->vhost->ssl_ctx); if (wsi->ssl == NULL) { lwsl_err("SSL_new failed: %s\n", ERR_error_string(lws_ssl_get_error(wsi, 0), NULL)); lws_decode_ssl_error(); if (accept_fd != LWS_SOCK_INVALID) compatible_close(accept_fd); goto fail; } SSL_set_ex_data(wsi->ssl, openssl_websocket_private_data_index, wsi->vhost); SSL_set_fd(wsi->ssl, accept_fd); #endif #endif #ifdef USE_WOLFSSL #ifdef USE_OLD_CYASSL CyaSSL_set_using_nonblock(wsi->ssl, 1); #else wolfSSL_set_using_nonblock(wsi->ssl, 1); #endif #else #if defined(LWS_USE_POLARSSL) #else #if defined(LWS_USE_MBEDTLS) #else SSL_set_mode(wsi->ssl, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER); bio = SSL_get_rbio(wsi->ssl); if (bio) BIO_set_nbio(bio, 1); /* nonblocking */ else lwsl_notice("NULL rbio\n"); bio = SSL_get_wbio(wsi->ssl); if (bio) BIO_set_nbio(bio, 1); /* nonblocking */ else lwsl_notice("NULL rbio\n"); #endif #endif #endif /* * we are not accepted yet, but we need to enter ourselves * as a live connection. That way we can retry when more * pieces come if we're not sorted yet */ wsi->mode = LWSCM_SSL_ACK_PENDING; if (insert_wsi_socket_into_fds(context, wsi)) { lwsl_err("%s: failed to insert into fds\n", __func__); goto fail; } lws_set_timeout(wsi, PENDING_TIMEOUT_SSL_ACCEPT, context->timeout_secs); lwsl_info("inserted SSL accept into fds, trying SSL_accept\n"); /* fallthru */ case LWSCM_SSL_ACK_PENDING: if (lws_change_pollfd(wsi, LWS_POLLOUT, 0)) { lwsl_err("%s: lws_change_pollfd failed\n", __func__); goto fail; } lws_latency_pre(context, wsi); n = recv(wsi->sock, (char *)pt->serv_buf, context->pt_serv_buf_size, MSG_PEEK); /* * optionally allow non-SSL connect on SSL listening socket * This is disabled by default, if enabled it goes around any * SSL-level access control (eg, client-side certs) so leave * it disabled unless you know it's not a problem for you */ if (wsi->vhost->allow_non_ssl_on_ssl_port) { if (n >= 1 && pt->serv_buf[0] >= ' ') { /* * TLS content-type for Handshake is 0x16, and * for ChangeCipherSpec Record, it's 0x14 * * A non-ssl session will start with the HTTP * method in ASCII. If we see it's not a legit * SSL handshake kill the SSL for this * connection and try to handle as a HTTP * connection upgrade directly. */ wsi->use_ssl = 0; #if defined(LWS_USE_POLARSSL) ssl_close_notify(wsi->ssl); ssl_free(wsi->ssl); #else #if defined(LWS_USE_MBEDTLS) #else SSL_shutdown(wsi->ssl); SSL_free(wsi->ssl); #endif #endif wsi->ssl = NULL; if (lws_check_opt(context->options, LWS_SERVER_OPTION_REDIRECT_HTTP_TO_HTTPS)) wsi->redirect_to_https = 1; goto accepted; } if (!n) /* * connection is gone, or nothing to read * if it's gone, we will timeout on * PENDING_TIMEOUT_SSL_ACCEPT */ break; if (n < 0 && (LWS_ERRNO == LWS_EAGAIN || LWS_ERRNO == LWS_EWOULDBLOCK)) { /* * well, we get no way to know ssl or not * so go around again waiting for something * to come and give us a hint, or timeout the * connection. */ m = SSL_ERROR_WANT_READ; goto go_again; } } /* normal SSL connection processing path */ #if defined(LWS_USE_POLARSSL) n = ssl_handshake(wsi->ssl); #else #if defined(LWS_USE_MBEDTLS) #else n = SSL_accept(wsi->ssl); #endif #endif lws_latency(context, wsi, "SSL_accept LWSCM_SSL_ACK_PENDING\n", n, n == 1); if (n == 1) goto accepted; m = lws_ssl_get_error(wsi, n); lwsl_debug("SSL_accept failed %d / %s\n", m, ERR_error_string(m, NULL)); go_again: if (m == SSL_ERROR_WANT_READ) { if (lws_change_pollfd(wsi, 0, LWS_POLLIN)) { lwsl_err("%s: WANT_READ change_pollfd failed\n", __func__); goto fail; } lwsl_info("SSL_ERROR_WANT_READ\n"); break; } if (m == SSL_ERROR_WANT_WRITE) { if (lws_change_pollfd(wsi, 0, LWS_POLLOUT)) { lwsl_err("%s: WANT_WRITE change_pollfd failed\n", __func__); goto fail; } break; } lwsl_err("SSL_accept failed skt %u: %s\n", wsi->sock, ERR_error_string(m, NULL)); lws_ssl_elaborate_error(); goto fail; accepted: /* OK, we are accepted... give him some time to negotiate */ lws_set_timeout(wsi, PENDING_TIMEOUT_ESTABLISH_WITH_SERVER, context->timeout_secs); wsi->mode = LWSCM_HTTP_SERVING; lws_http2_configure_if_upgraded(wsi); lwsl_debug("accepted new SSL conn\n"); break; } return 0; fail: return 1; }
tcpcon_t * tcp_connect(const char *hostname, int port, char *errbuf, size_t errbufsize, int timeout, int ssl) { struct hostent *hp; char *tmphstbuf; int fd, val, r, err, herr; const char *errtxt; #if !defined(__APPLE__) struct hostent hostbuf; size_t hstbuflen; int res; #endif struct sockaddr_in6 in6; struct sockaddr_in in; socklen_t errlen = sizeof(int); if(!strcmp(hostname, "localhost")) { if((fd = getstreamsocket(AF_INET, errbuf, errbufsize)) == -1) return NULL; memset(&in, 0, sizeof(in)); in.sin_family = AF_INET; in.sin_port = htons(port); in.sin_addr.s_addr = htonl(INADDR_LOOPBACK); r = connect(fd, (struct sockaddr *)&in, sizeof(struct sockaddr_in)); } else { #if defined(__APPLE__) herr = 0; tmphstbuf = NULL; /* free NULL is a nop */ /* TODO: AF_INET6 */ hp = gethostbyname(hostname); if(hp == NULL) herr = h_errno; #else hstbuflen = 1024; tmphstbuf = malloc(hstbuflen); while((res = gethostbyname_r(hostname, &hostbuf, tmphstbuf, hstbuflen, &hp, &herr)) == ERANGE) { hstbuflen *= 2; tmphstbuf = realloc(tmphstbuf, hstbuflen); } #endif if(herr != 0) { switch(herr) { case HOST_NOT_FOUND: errtxt = "Unknown host"; break; case NO_ADDRESS: errtxt = "The requested name is valid but does not have an IP address"; break; case NO_RECOVERY: errtxt = "A non-recoverable name server error occurred"; break; case TRY_AGAIN: errtxt = "A temporary error occurred on an authoritative name server"; break; default: errtxt = "Unknown error"; break; } snprintf(errbuf, errbufsize, "%s", errtxt); free(tmphstbuf); return NULL; } else if(hp == NULL) { snprintf(errbuf, errbufsize, "Resolver internal error"); free(tmphstbuf); return NULL; } if((fd = getstreamsocket(hp->h_addrtype, errbuf, errbufsize)) == -1) { free(tmphstbuf); return NULL; } switch(hp->h_addrtype) { case AF_INET: memset(&in, 0, sizeof(in)); in.sin_family = AF_INET; in.sin_port = htons(port); memcpy(&in.sin_addr, hp->h_addr_list[0], sizeof(struct in_addr)); r = connect(fd, (struct sockaddr *)&in, sizeof(struct sockaddr_in)); break; case AF_INET6: memset(&in6, 0, sizeof(in6)); in6.sin6_family = AF_INET6; in6.sin6_port = htons(port); memcpy(&in6.sin6_addr, hp->h_addr_list[0], sizeof(struct in6_addr)); r = connect(fd, (struct sockaddr *)&in, sizeof(struct sockaddr_in6)); break; default: snprintf(errbuf, errbufsize, "Invalid protocol family"); free(tmphstbuf); return NULL; } free(tmphstbuf); } if(r == -1) { if(errno == EINPROGRESS) { struct pollfd pfd; pfd.fd = fd; pfd.events = POLLOUT; pfd.revents = 0; r = poll(&pfd, 1, timeout); if(r == 0) { /* Timeout */ snprintf(errbuf, errbufsize, "Connection attempt timed out"); close(fd); return NULL; } if(r == -1) { snprintf(errbuf, errbufsize, "poll() error: %s", strerror(errno)); close(fd); return NULL; } getsockopt(fd, SOL_SOCKET, SO_ERROR, (void *)&err, &errlen); } else { err = errno; } } else { err = 0; } if(err != 0) { snprintf(errbuf, errbufsize, "%s", strerror(err)); close(fd); return NULL; } fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) & ~O_NONBLOCK); val = 1; setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &val, sizeof(val)); tcpcon_t *tc = calloc(1, sizeof(tcpcon_t)); tc->fd = fd; htsbuf_queue_init(&tc->spill, 0); if(ssl) { #if ENABLE_OPENSSL if(showtime_ssl_ctx != NULL) { char errmsg[120]; if((tc->ssl = SSL_new(showtime_ssl_ctx)) == NULL) { ERR_error_string(ERR_get_error(), errmsg); snprintf(errbuf, errlen, "SSL: %s", errmsg); tcp_close(tc); return NULL; } if(SSL_set_fd(tc->ssl, tc->fd) == 0) { ERR_error_string(ERR_get_error(), errmsg); snprintf(errbuf, errlen, "SSL fd: %s", errmsg); tcp_close(tc); return NULL; } if(SSL_connect(tc->ssl) <= 0) { ERR_error_string(ERR_get_error(), errmsg); snprintf(errbuf, errlen, "SSL connect: %s", errmsg); tcp_close(tc); return NULL; } SSL_set_mode(tc->ssl, SSL_MODE_AUTO_RETRY); tc->read = ssl_read; tc->write = ssl_write; } else #elif ENABLE_POLARSSL if(1) { tc->ssl = malloc(sizeof(ssl_context)); if(ssl_init(tc->ssl)) { snprintf(errbuf, errlen, "SSL failed to initialize"); close(fd); free(tc->ssl); free(tc); return NULL; } tc->ssn = malloc(sizeof(ssl_session)); tc->hs = malloc(sizeof(havege_state)); havege_init(tc->hs); memset(tc->ssn, 0, sizeof(ssl_session)); ssl_set_endpoint(tc->ssl, SSL_IS_CLIENT ); ssl_set_authmode(tc->ssl, SSL_VERIFY_NONE ); ssl_set_rng(tc->ssl, havege_rand, tc->hs ); ssl_set_bio(tc->ssl, net_recv, &tc->fd, net_send, &tc->fd); ssl_set_ciphers(tc->ssl, ssl_default_ciphers ); ssl_set_session(tc->ssl, 1, 600, tc->ssn ); tc->read = polarssl_read; tc->write = polarssl_write; } else #endif { snprintf(errbuf, errlen, "SSL not supported"); tcp_close(tc); return NULL; } } else { tc->read = tcp_read; tc->write = tcp_write; } return tc; }
/** * @brief SSL client task. * @param pvParameters not used * @retval None */ void ssl_client(void const * argument) { int ret, len, server_fd; unsigned char buf[1024]; ssl_context ssl; x509_cert cacert; memset( &ssl, 0, sizeof( ssl_context ) ); memset( &cacert, 0, sizeof( x509_cert ) ); /* * Initialize certificates */ printf( " . Loading the CA root certificate ..." ); #if defined(POLARSSL_CERTS_C) ret = x509parse_crt( &cacert, (const unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); #else ret = 1; printf("POLARSSL_CERTS_C not defined."); #endif if( ret < 0 ) { printf( " failed\n ! x509parse_crt returned -0x%x\n\n", -ret ); goto exit; } printf( " ok (%d skipped)\n", ret ); /* Start the connection */ do { printf(( "\n\rSSL : Start the connection \n\r")); printf("\n\rConnecting to tcp/%s/ Port:%4d...", SSL_SERVER_NAME, SSL_SERVER_PORT); /* Bint the connection to SSL server port */ ret = net_connect(&server_fd, SSL_SERVER_NAME, SSL_SERVER_PORT); if(ret != 0) { /* Connection to SSL server failed */ printf(" failed \n\r ! net_connect returned %d\n\r", -ret); /* Wait 500 ms until next retry */ vTaskDelay(500); } }while(ret!=0); printf( " ok\n\r" ); /* * 2. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n\r", ret ); goto exit; } printf( " ok\n\r" ); ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_authmode( &ssl, SSL_VERIFY_OPTIONAL ); ssl_set_ca_chain( &ssl, &cacert, NULL, "PolarSSL Server 1" ); ssl_set_rng( &ssl, RandVal , NULL ); ssl_set_dbg( &ssl, my_debug, NULL); ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); /* Set max ssl version to TLS v1.1 because TLS v1.2 needs SHA-256 for HASH which is not supported by STM32F417xx Hardware*/ ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_2); /* * Handshake */ printf( " . Performing the SSL/TLS handshake..." ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n\r", -ret ); goto exit; } } printf( " ok\n\r" ); /* * Verify the server certificate */ printf( "\n\r . Verifying peer X.509 certificate..." ); if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( " failed\n\r" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! server certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! server certificate has been revoked\n" ); if( ( ret & BADCERT_CN_MISMATCH ) != 0 ) printf( " ! CN mismatch (expected CN=%s)\n", "PolarSSL Server 1" ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n\r" ); } else printf( " ok\n\r" ); /* * Write the GET request */ printf( " > Write to server:" ); len = sprintf( (char *) buf, GET_REQUEST ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n\r", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n\r%s", len, (char *) buf ); /* * Read the HTTP response */ printf( " < Read from server:" ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY ) break; if( ret < 0 ) { printf( "failed\n\r ! ssl_read returned %d\n\n\r", ret ); break; } if( ret == 0 ) { printf( "\n\nEOF\n\n\r" ); break; } len = ret; printf( " %d bytes read\n\n\r%s", len, (char *) buf ); } while( 1 ); exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; error_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n\r", ret, error_buf ); } #endif x509_free( &cacert ); net_close( server_fd ); ssl_free( &ssl ); memset( &ssl, 0, sizeof( ssl ) ); /* Infinite loop */ for( ;; ) { /* Toggle LED1 */ BSP_LED_Toggle(LED1); /* Insert 400 ms delay */ osDelay(400); } }
int main( void ) { int ret, len; int listen_fd; int client_fd = -1; unsigned char buf[1024]; const char *pers = "dtls_server"; unsigned char client_ip[16] = { 0 }; ssl_cookie_ctx cookie_ctx; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_crt srvcert; pk_context pkey; #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_context cache; #endif memset( &ssl, 0, sizeof(ssl_context) ); ssl_cookie_init( &cookie_ctx ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_init( &cache ); #endif x509_crt_init( &srvcert ); pk_init( &pkey ); entropy_init( &entropy ); #if defined(POLARSSL_DEBUG_C) debug_set_threshold( DEBUG_LEVEL ); #endif /* * 1. Load the certificates and private RSA key */ printf( "\n . Loading the server cert. and key..." ); fflush( stdout ); /* * This demonstration program uses embedded test certificates. * Instead, you may want to use x509_crt_parse_file() to read the * server and CA certificates, as well as pk_parse_keyfile(). */ ret = x509_crt_parse( &srvcert, (const unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509_crt_parse returned %d\n\n", ret ); goto exit; } ret = x509_crt_parse( &srvcert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); if( ret != 0 ) { printf( " failed\n ! x509_crt_parse returned %d\n\n", ret ); goto exit; } ret = pk_parse_key( &pkey, (const unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! pk_parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup the "listening" UDP socket */ printf( " . Bind on udp/*/4433 ..." ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, 4433, NET_PROTO_UDP ) ) != 0 ) { printf( " failed\n ! net_bind returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 3. Seed the RNG */ printf( " . Seeding the random number generator..." ); fflush( stdout ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n" ); /* * 4. Setup stuff */ printf( " . Setting up the DTLS data..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_transport( &ssl, SSL_TRANSPORT_DATAGRAM ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); #if defined(POLARSSL_SSL_CACHE_C) ssl_set_session_cache( &ssl, ssl_cache_get, &cache, ssl_cache_set, &cache ); #endif ssl_set_ca_chain( &ssl, srvcert.next, NULL, NULL ); if( ( ret = ssl_set_own_cert( &ssl, &srvcert, &pkey ) ) != 0 ) { printf( " failed\n ! ssl_set_own_cert returned %d\n\n", ret ); goto exit; } if( ( ret = ssl_cookie_setup( &cookie_ctx, ctr_drbg_random, &ctr_drbg ) ) != 0 ) { printf( " failed\n ! ssl_cookie_setup returned %d\n\n", ret ); goto exit; } ssl_set_dtls_cookies( &ssl, ssl_cookie_write, ssl_cookie_check, &cookie_ctx ); printf( " ok\n" ); reset: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( client_fd != -1 ) net_close( client_fd ); ssl_session_reset( &ssl ); /* * 3. Wait until a client connects */ client_fd = -1; printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, client_ip ) ) != 0 ) { printf( " failed\n ! net_accept returned %d\n\n", ret ); goto exit; } /* With UDP, bind_fd is hijacked by client_fd, so bind a new one */ if( ( ret = net_bind( &listen_fd, NULL, 4433, NET_PROTO_UDP ) ) != 0 ) { printf( " failed\n ! net_bind returned -0x%x\n\n", -ret ); goto exit; } /* For HelloVerifyRequest cookies */ if( ( ret = ssl_set_client_transport_id( &ssl, client_ip, sizeof( client_ip ) ) ) != 0 ) { printf( " failed\n ! " "ssl_set_client_tranport_id() returned -0x%x\n\n", -ret ); goto exit; } ssl_set_bio_timeout( &ssl, &client_fd, net_send, net_recv, net_recv_timeout, READ_TIMEOUT_MS ); printf( " ok\n" ); /* * 5. Handshake */ printf( " . Performing the DTLS handshake..." ); fflush( stdout ); do ret = ssl_handshake( &ssl ); while( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ); if( ret == POLARSSL_ERR_SSL_HELLO_VERIFY_REQUIRED ) { printf( " hello verification requested\n" ); ret = 0; goto reset; } else if( ret != 0 ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto reset; } printf( " ok\n" ); /* * 6. Read the echo Request */ printf( " < Read from client:" ); fflush( stdout ); len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); do ret = ssl_read( &ssl, buf, len ); while( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ); if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_NET_TIMEOUT: printf( " timeout\n\n" ); goto reset; case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); ret = 0; goto close_notify; default: printf( " ssl_read returned -0x%x\n\n", -ret ); goto reset; } } len = ret; printf( " %d bytes read\n\n%s\n\n", len, buf ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); do ret = ssl_write( &ssl, buf, len ); while( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ); if( ret < 0 ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } len = ret; printf( " %d bytes written\n\n%s\n\n", len, buf ); /* * 8. Done, cleanly close the connection */ close_notify: printf( " . Closing the connection..." ); /* No error checking, the connection might be closed already */ do ret = ssl_close_notify( &ssl ); while( ret == POLARSSL_ERR_NET_WANT_WRITE ); ret = 0; printf( " done\n" ); goto reset; /* * Final clean-ups and exit */ exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf( "Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( client_fd != -1 ) net_close( client_fd ); x509_crt_free( &srvcert ); pk_free( &pkey ); ssl_free( &ssl ); ssl_cookie_free( &cookie_ctx ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_free( &cache ); #endif ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif /* Shell can not handle large exit numbers -> 1 for errors */ if( ret < 0 ) ret = 1; return( ret ); }
int main( int argc, char *argv[] ) { int ret = 0, len, written, frags; int listen_fd; int client_fd = -1; unsigned char buf[1024]; #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) unsigned char psk[256]; size_t psk_len = 0; #endif const char *pers = "ssl_server2"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt cacert; x509_crt srvcert; pk_context pkey; x509_crt srvcert2; pk_context pkey2; int key_cert_init = 0, key_cert_init2 = 0; #endif #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_context cache; #endif #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) unsigned char alloc_buf[100000]; #endif int i; char *p, *q; const int *list; #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) memory_buffer_alloc_init( alloc_buf, sizeof(alloc_buf) ); #endif /* * Make sure memory references are valid in case we exit early. */ listen_fd = 0; memset( &ssl, 0, sizeof( ssl_context ) ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_init( &cacert ); x509_crt_init( &srvcert ); pk_init( &pkey ); x509_crt_init( &srvcert2 ); pk_init( &pkey2 ); #endif #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_init( &cache ); #endif if( argc == 0 ) { usage: if( ret == 0 ) ret = 1; printf( USAGE ); list = ssl_list_ciphersuites(); while( *list ) { printf(" %-42s", ssl_get_ciphersuite_name( *list ) ); list++; if( !*list ) break; printf(" %s\n", ssl_get_ciphersuite_name( *list ) ); list++; } printf("\n"); goto exit; } opt.server_port = DFL_SERVER_PORT; opt.debug_level = DFL_DEBUG_LEVEL; opt.ca_file = DFL_CA_FILE; opt.ca_path = DFL_CA_PATH; opt.crt_file = DFL_CRT_FILE; opt.key_file = DFL_KEY_FILE; opt.crt_file2 = DFL_CRT_FILE2; opt.key_file2 = DFL_KEY_FILE2; opt.psk = DFL_PSK; opt.psk_identity = DFL_PSK_IDENTITY; opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; opt.renegotiation = DFL_RENEGOTIATION; opt.allow_legacy = DFL_ALLOW_LEGACY; opt.min_version = DFL_MIN_VERSION; opt.max_version = DFL_MAX_VERSION; opt.auth_mode = DFL_AUTH_MODE; opt.mfl_code = DFL_MFL_CODE; opt.tickets = DFL_TICKETS; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "server_port" ) == 0 ) { opt.server_port = atoi( q ); if( opt.server_port < 1 || opt.server_port > 65535 ) goto usage; } else if( strcmp( p, "debug_level" ) == 0 ) { opt.debug_level = atoi( q ); if( opt.debug_level < 0 || opt.debug_level > 65535 ) goto usage; } else if( strcmp( p, "ca_file" ) == 0 ) opt.ca_file = q; else if( strcmp( p, "ca_path" ) == 0 ) opt.ca_path = q; else if( strcmp( p, "crt_file" ) == 0 ) opt.crt_file = q; else if( strcmp( p, "key_file" ) == 0 ) opt.key_file = q; else if( strcmp( p, "crt_file2" ) == 0 ) opt.crt_file2 = q; else if( strcmp( p, "key_file2" ) == 0 ) opt.key_file2 = q; else if( strcmp( p, "psk" ) == 0 ) opt.psk = q; else if( strcmp( p, "psk_identity" ) == 0 ) opt.psk_identity = q; else if( strcmp( p, "force_ciphersuite" ) == 0 ) { opt.force_ciphersuite[0] = -1; opt.force_ciphersuite[0] = ssl_get_ciphersuite_id( q ); if( opt.force_ciphersuite[0] <= 0 ) { ret = 2; goto usage; } opt.force_ciphersuite[1] = 0; } else if( strcmp( p, "renegotiation" ) == 0 ) { opt.renegotiation = (atoi( q )) ? SSL_RENEGOTIATION_ENABLED : SSL_RENEGOTIATION_DISABLED; } else if( strcmp( p, "allow_legacy" ) == 0 ) { opt.allow_legacy = atoi( q ); if( opt.allow_legacy < 0 || opt.allow_legacy > 1 ) goto usage; } else if( strcmp( p, "min_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "max_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "force_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_0; opt.max_version = SSL_MINOR_VERSION_0; } else if( strcmp( q, "tls1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_1; opt.max_version = SSL_MINOR_VERSION_1; } else if( strcmp( q, "tls1_1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_2; opt.max_version = SSL_MINOR_VERSION_2; } else if( strcmp( q, "tls1_2" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_3; opt.max_version = SSL_MINOR_VERSION_3; } else goto usage; } else if( strcmp( p, "auth_mode" ) == 0 ) { if( strcmp( q, "none" ) == 0 ) opt.auth_mode = SSL_VERIFY_NONE; else if( strcmp( q, "optional" ) == 0 ) opt.auth_mode = SSL_VERIFY_OPTIONAL; else if( strcmp( q, "required" ) == 0 ) opt.auth_mode = SSL_VERIFY_REQUIRED; else goto usage; } else if( strcmp( p, "max_frag_len" ) == 0 ) { if( strcmp( q, "512" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_512; else if( strcmp( q, "1024" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_1024; else if( strcmp( q, "2048" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_2048; else if( strcmp( q, "4096" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_4096; else goto usage; } else if( strcmp( p, "tickets" ) == 0 ) { opt.tickets = atoi( q ); if( opt.tickets < 0 || opt.tickets > 1 ) goto usage; } else goto usage; } if( opt.force_ciphersuite[0] > 0 ) { const ssl_ciphersuite_t *ciphersuite_info; ciphersuite_info = ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); if( opt.max_version != -1 && ciphersuite_info->min_minor_ver > opt.max_version ) { printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } if( opt.min_version != -1 && ciphersuite_info->max_minor_ver < opt.min_version ) { printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } if( opt.max_version > ciphersuite_info->max_minor_ver ) opt.max_version = ciphersuite_info->max_minor_ver; if( opt.min_version < ciphersuite_info->min_minor_ver ) opt.min_version = ciphersuite_info->min_minor_ver; } #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) /* * Unhexify the pre-shared key if any is given */ if( strlen( opt.psk ) ) { unsigned char c; size_t j; if( strlen( opt.psk ) % 2 != 0 ) { printf("pre-shared key not valid hex\n"); goto exit; } psk_len = strlen( opt.psk ) / 2; for( j = 0; j < strlen( opt.psk ); j += 2 ) { c = opt.psk[j]; if( c >= '0' && c <= '9' ) c -= '0'; else if( c >= 'a' && c <= 'f' ) c -= 'a' - 10; else if( c >= 'A' && c <= 'F' ) c -= 'A' - 10; else { printf("pre-shared key not valid hex\n"); goto exit; } psk[ j / 2 ] = c << 4; c = opt.psk[j + 1]; if( c >= '0' && c <= '9' ) c -= '0'; else if( c >= 'a' && c <= 'f' ) c -= 'a' - 10; else if( c >= 'A' && c <= 'F' ) c -= 'A' - 10; else { printf("pre-shared key not valid hex\n"); goto exit; } psk[ j / 2 ] |= c; } } #endif /* POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED */ /* * 0. Initialize the RNG and the session data */ printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned -0x%x\n", -ret ); goto exit; } printf( " ok\n" ); #if defined(POLARSSL_X509_CRT_PARSE_C) /* * 1.1. Load the trusted CA */ printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.ca_path ) ) ret = x509_crt_parse_path( &cacert, opt.ca_path ); else if( strlen( opt.ca_file ) ) ret = x509_crt_parse_file( &cacert, opt.ca_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509_crt_parse( &cacert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); #else { ret = 1; printf("POLARSSL_CERTS_C not defined."); } #endif if( ret < 0 ) { printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } printf( " ok (%d skipped)\n", ret ); /* * 1.2. Load own certificate and private key */ printf( " . Loading the server cert. and key..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.crt_file ) ) { key_cert_init++; if( ( ret = x509_crt_parse_file( &srvcert, opt.crt_file ) ) != 0 ) { printf( " failed\n ! x509_crt_parse_file returned -0x%x\n\n", -ret ); goto exit; } } if( strlen( opt.key_file ) ) { key_cert_init++; if( ( ret = pk_parse_keyfile( &pkey, opt.key_file, "" ) ) != 0 ) { printf( " failed\n ! pk_parse_keyfile returned -0x%x\n\n", -ret ); goto exit; } } if( key_cert_init == 1 ) { printf( " failed\n ! crt_file without key_file or vice-versa\n\n" ); goto exit; } if( strlen( opt.crt_file2 ) ) { key_cert_init2++; if( ( ret = x509_crt_parse_file( &srvcert2, opt.crt_file2 ) ) != 0 ) { printf( " failed\n ! x509_crt_parse_file(2) returned -0x%x\n\n", -ret ); goto exit; } } if( strlen( opt.key_file2 ) ) { key_cert_init2++; if( ( ret = pk_parse_keyfile( &pkey2, opt.key_file2, "" ) ) != 0 ) { printf( " failed\n ! pk_parse_keyfile(2) returned -0x%x\n\n", -ret ); goto exit; } } if( key_cert_init2 == 1 ) { printf( " failed\n ! crt_file2 without key_file2 or vice-versa\n\n" ); goto exit; } #endif if( key_cert_init == 0 && key_cert_init2 == 0 ) { #if !defined(POLARSSL_CERTS_C) printf( "Not certificated or key provided, and \n" "POLARSSL_CERTS_C not defined!\n" ); goto exit; #else #if defined(POLARSSL_RSA_C) if( ( ret = x509_crt_parse( &srvcert, (const unsigned char *) test_srv_crt_rsa, strlen( test_srv_crt_rsa ) ) ) != 0 ) { printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } if( ( ret = pk_parse_key( &pkey, (const unsigned char *) test_srv_key_rsa, strlen( test_srv_key_rsa ), NULL, 0 ) ) != 0 ) { printf( " failed\n ! pk_parse_key returned -0x%x\n\n", -ret ); goto exit; } key_cert_init = 2; #endif /* POLARSSL_RSA_C */ #if defined(POLARSSL_ECDSA_C) if( ( ret = x509_crt_parse( &srvcert2, (const unsigned char *) test_srv_crt_ec, strlen( test_srv_crt_ec ) ) ) != 0 ) { printf( " failed\n ! x509_crt_parse2 returned -0x%x\n\n", -ret ); goto exit; } if( ( ret = pk_parse_key( &pkey2, (const unsigned char *) test_srv_key_ec, strlen( test_srv_key_ec ), NULL, 0 ) ) != 0 ) { printf( " failed\n ! pk_parse_key2 returned -0x%x\n\n", -ret ); goto exit; } key_cert_init2 = 2; #endif /* POLARSSL_ECDSA_C */ #endif /* POLARSSL_CERTS_C */ } printf( " ok\n" ); #endif /* POLARSSL_X509_CRT_PARSE_C */ /* * 2. Setup the listening TCP socket */ printf( " . Bind on tcp://localhost:%-4d/ ...", opt.server_port ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, opt.server_port ) ) != 0 ) { printf( " failed\n ! net_bind returned -0x%x\n\n", -ret ); goto exit; } printf( " ok\n" ); /* * 3. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned -0x%x\n\n", -ret ); goto exit; } ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, opt.auth_mode ); #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH) ssl_set_max_frag_len( &ssl, opt.mfl_code ); #endif ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); #if defined(POLARSSL_SSL_CACHE_C) ssl_set_session_cache( &ssl, ssl_cache_get, &cache, ssl_cache_set, &cache ); #endif #if defined(POLARSSL_SSL_SESSION_TICKETS) ssl_set_session_tickets( &ssl, opt.tickets ); #endif if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER ) ssl_set_ciphersuites( &ssl, opt.force_ciphersuite ); ssl_set_renegotiation( &ssl, opt.renegotiation ); ssl_legacy_renegotiation( &ssl, opt.allow_legacy ); #if defined(POLARSSL_X509_CRT_PARSE_C) ssl_set_ca_chain( &ssl, &cacert, NULL, NULL ); if( key_cert_init ) ssl_set_own_cert( &ssl, &srvcert, &pkey ); if( key_cert_init2 ) ssl_set_own_cert( &ssl, &srvcert2, &pkey2 ); #endif #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) ssl_set_psk( &ssl, psk, psk_len, (const unsigned char *) opt.psk_identity, strlen( opt.psk_identity ) ); #endif #if defined(POLARSSL_DHM_C) /* * Use different group than default DHM group */ ssl_set_dh_param( &ssl, POLARSSL_DHM_RFC5114_MODP_2048_P, POLARSSL_DHM_RFC5114_MODP_2048_G ); #endif if( opt.min_version != -1 ) ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version ); if( opt.max_version != -1 ) ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version ); printf( " ok\n" ); reset: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( client_fd != -1 ) net_close( client_fd ); ssl_session_reset( &ssl ); /* * 3. Wait until a client connects */ #if defined(_WIN32_WCE) { SHELLEXECUTEINFO sei; ZeroMemory( &sei, sizeof( SHELLEXECUTEINFO ) ); sei.cbSize = sizeof( SHELLEXECUTEINFO ); sei.fMask = 0; sei.hwnd = 0; sei.lpVerb = _T( "open" ); sei.lpFile = _T( "https://localhost:4433/" ); sei.lpParameters = NULL; sei.lpDirectory = NULL; sei.nShow = SW_SHOWNORMAL; ShellExecuteEx( &sei ); } #elif defined(_WIN32) ShellExecute( NULL, "open", "https://localhost:4433/", NULL, NULL, SW_SHOWNORMAL ); #endif client_fd = -1; printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned -0x%x\n\n", -ret ); goto exit; } ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); printf( " ok\n" ); /* * 4. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto reset; } } printf( " ok\n [ Ciphersuite is %s ]\n", ssl_get_ciphersuite( &ssl ) ); #if defined(POLARSSL_X509_CRT_PARSE_C) /* * 5. Verify the server certificate */ printf( " . Verifying peer X.509 certificate..." ); if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( " failed\n" ); if( !ssl_get_peer_cert( &ssl ) ) printf( " ! no client certificate sent\n" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! client certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! client certificate has been revoked\n" ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n" ); } else printf( " ok\n" ); if( ssl_get_peer_cert( &ssl ) ) { printf( " . Peer certificate information ...\n" ); x509_crt_info( (char *) buf, sizeof( buf ) - 1, " ", ssl_get_peer_cert( &ssl ) ); printf( "%s\n", buf ); } #endif /* POLARSSL_X509_CRT_PARSE_C */ /* * 6. Read the HTTP Request */ printf( " < Read from client:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned -0x%x\n", -ret ); break; } break; } len = ret; printf( " %d bytes read\n\n%s\n", len, (char *) buf ); if( memcmp( buf, "SERVERQUIT", 10 ) == 0 ) { ret = 0; goto exit; } if( ret > 0 ) break; } while( 1 ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_ciphersuite( &ssl ) ); for( written = 0, frags = 0; written < len; written += ret, frags++ ) { while( ( ret = ssl_write( &ssl, buf + written, len - written ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " failed\n ! peer closed the connection\n\n" ); goto reset; } if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } } buf[written] = '\0'; printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf ); #ifdef TEST_RENEGO /* * Request renegotiation (this must be done when the client is still * waiting for input from our side). */ printf( " . Requestion renegotiation..." ); fflush( stdout ); while( ( ret = ssl_renegotiate( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_renegotiate returned %d\n\n", ret ); goto exit; } } /* * Should be a while loop, not an if, but here we're not actually * expecting data from the client, and since we're running tests locally, * we can just hope the handshake will finish the during the first call. */ if( ( ret = ssl_read( &ssl, buf, 0 ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_read returned %d\n\n", ret ); /* Unexpected message probably means client didn't renegotiate */ if( ret == POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE ) goto reset; else goto exit; } } printf( " ok\n" ); #endif ret = 0; goto reset; exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf("Last error was: -0x%X - %s\n\n", -ret, error_buf ); } #endif net_close( client_fd ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_free( &cacert ); x509_crt_free( &srvcert ); pk_free( &pkey ); x509_crt_free( &srvcert2 ); pk_free( &pkey2 ); #endif ssl_free( &ssl ); entropy_free( &entropy ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_free( &cache ); #endif #if defined(POLARSSL_MEMORY_BUFFER_ALLOC_C) #if defined(POLARSSL_MEMORY_DEBUG) memory_buffer_alloc_status(); #endif memory_buffer_alloc_free(); #endif #if defined(_WIN32) printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif // Shell can not handle large exit numbers -> 1 for errors if( ret < 0 ) ret = 1; return( ret ); }
int main( void ) { int ret, len, server_fd; unsigned char buf[1024]; havege_state hs; ssl_context ssl; ssl_session ssn; x509_cert cacert; x509_cert clicert; rsa_context rsa; /* * 0. Initialize the RNG and the session data */ havege_init( &hs ); memset( &ssn, 0, sizeof( ssl_session ) ); /* * 1.1. Load the trusted CA */ printf( "\n . Loading the CA root certificate ..." ); fflush( stdout ); memset( &cacert, 0, sizeof( x509_cert ) ); /* * Alternatively, you may load the CA certificates from a .pem or * .crt file by calling x509parse_crtfile( &cacert, "myca.crt" ). */ ret = x509parse_crt( &cacert, (unsigned char *) xyssl_ca_crt, strlen( xyssl_ca_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 1.2. Load own certificate and private key * * (can be skipped if client authentication is not required) */ printf( " . Loading the client cert. and key..." ); fflush( stdout ); memset( &clicert, 0, sizeof( x509_cert ) ); ret = x509parse_crt( &clicert, (unsigned char *) test_cli_crt, strlen( test_cli_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } ret = x509parse_key( &rsa, (unsigned char *) test_cli_key, strlen( test_cli_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! x509parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Start the connection */ printf( " . Connecting to tcp/%s/%-4d...", SERVER_NAME, SERVER_PORT ); fflush( stdout ); if( ( ret = net_connect( &server_fd, SERVER_NAME, SERVER_PORT ) ) != 0 ) { printf( " failed\n ! net_connect returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 3. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); havege_init( &hs ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_authmode( &ssl, SSL_VERIFY_OPTIONAL ); ssl_set_rng( &ssl, havege_rand, &hs ); ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); ssl_set_ciphers( &ssl, ssl_default_ciphers ); ssl_set_session( &ssl, 1, 600, &ssn ); ssl_set_ca_chain( &ssl, &cacert, SERVER_NAME ); ssl_set_own_cert( &ssl, &clicert, &rsa ); ssl_set_hostname( &ssl, SERVER_NAME ); /* * 4. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_TRY_AGAIN ) { printf( " failed\n ! ssl_handshake returned %d\n\n", ret ); goto exit; } } printf( " ok\n [ Cipher is %s ]\n", ssl_get_cipher( &ssl ) ); /* * 5. Verify the server certificate */ printf( " . Verifying peer X.509 certificate..." ); if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( " failed\n" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! server certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! server certificate has been revoked\n" ); if( ( ret & BADCERT_CN_MISMATCH ) != 0 ) printf( " ! CN mismatch (expected CN=%s)\n", SERVER_NAME ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n" ); } else printf( " ok\n" ); printf( " . Peer certificate information ...\n" ); printf( "%s", x509parse_cert_info( " ", ssl.peer_cert ) ); /* * 6. Write the GET request */ printf( " > Write to server:" ); fflush( stdout ); len = sprintf( (char *) buf, GET_REQUEST ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret != POLARSSL_ERR_NET_TRY_AGAIN ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s", len, (char *) buf ); /* * 7. Read the HTTP response */ printf( " < Read from server:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_TRY_AGAIN ) continue; if( ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY ) break; if( ret <= 0 ) { printf( "failed\n ! ssl_read returned %d\n\n", ret ); break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); } while( 0 ); ssl_close_notify( &ssl ); exit: net_close( server_fd ); x509_free( &clicert ); x509_free( &cacert ); rsa_free( &rsa ); ssl_free( &ssl ); memset( &ssl, 0, sizeof( ssl ) ); #ifdef WIN32 printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
static void *handle_ssl_connection( void *data ) { int ret, len; thread_info_t *thread_info = (thread_info_t *) data; int client_fd = thread_info->client_fd; int thread_id = (int) pthread_self(); unsigned char buf[1024]; char pers[50]; ssl_context ssl; ctr_drbg_context ctr_drbg; snprintf( pers, sizeof(pers), "SSL Pthread Thread %d", thread_id ); printf( " [ #%d ] Client FD %d\n", thread_id, client_fd ); printf( " [ #%d ] Seeding the random number generator...\n", thread_id ); /* entropy_func() is thread-safe if POLARSSL_THREADING_C is set */ if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, thread_info->entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " [ #%d ] failed: ctr_drbg_init returned -0x%04x\n", thread_id, -ret ); goto thread_exit; } printf( " [ #%d ] ok\n", thread_id ); /* * 4. Setup stuff */ printf( " [ #%d ] Setting up the SSL data....\n", thread_id ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " [ #%d ] failed: ssl_init returned -0x%04x\n", thread_id, -ret ); goto thread_exit; } ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_mutexed_debug, stdout ); /* ssl_cache_get() and ssl_cache_set() are thread-safe if * POLARSSL_THREADING_C is set. */ #if defined(POLARSSL_SSL_CACHE_C) ssl_set_session_cache( &ssl, ssl_cache_get, thread_info->cache, ssl_cache_set, thread_info->cache ); #endif ssl_set_ca_chain( &ssl, thread_info->ca_chain, NULL, NULL ); if( ( ret = ssl_set_own_cert( &ssl, thread_info->server_cert, thread_info->server_key ) ) != 0 ) { printf( " failed\n ! ssl_set_own_cert returned %d\n\n", ret ); goto exit; } printf( " [ #%d ] ok\n", thread_id ); ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); printf( " [ #%d ] ok\n", thread_id ); /* * 5. Handshake */ printf( " [ #%d ] Performing the SSL/TLS handshake\n", thread_id ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " [ #%d ] failed: ssl_handshake returned -0x%04x\n", thread_id, -ret ); goto thread_exit; } } printf( " [ #%d ] ok\n", thread_id ); /* * 6. Read the HTTP Request */ printf( " [ #%d ] < Read from client\n", thread_id ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " [ #%d ] connection was closed gracefully\n", thread_id ); goto thread_exit; case POLARSSL_ERR_NET_CONN_RESET: printf( " [ #%d ] connection was reset by peer\n", thread_id ); goto thread_exit; default: printf( " [ #%d ] ssl_read returned -0x%04x\n", thread_id, -ret ); goto thread_exit; } break; } len = ret; printf( " [ #%d ] %d bytes read\n=====\n%s\n=====\n", thread_id, len, (char *) buf ); if( ret > 0 ) break; } while( 1 ); /* * 7. Write the 200 Response */ printf( " [ #%d ] > Write to client:\n", thread_id ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_ciphersuite( &ssl ) ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " [ #%d ] failed: peer closed the connection\n", thread_id ); goto thread_exit; } if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " [ #%d ] failed: ssl_write returned -0x%04x\n", thread_id, ret ); goto thread_exit; } } len = ret; printf( " [ #%d ] %d bytes written\n=====\n%s\n=====\n", thread_id, len, (char *) buf ); printf( " [ #%d ] . Closing the connection...", thread_id ); while( ( ret = ssl_close_notify( &ssl ) ) < 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " [ #%d ] failed: ssl_close_notify returned -0x%04x\n", thread_id, ret ); goto thread_exit; } } printf( " ok\n" ); ret = 0; thread_exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); printf(" [ #%d ] Last error was: -0x%04x - %s\n\n", thread_id, -ret, error_buf ); } #endif net_close( client_fd ); ssl_free( &ssl ); thread_info->thread_complete = 1; return( NULL ); }
char *http_process_request(char *url, int method, char **type, int *code, int *size, const char *contype, char *post) { struct sockaddr_in serv_addr; int sockfd = 0, bytes = 0; int has_code = 0, has_type = 0; int pos = 0; size_t bufsize = BUFFER_SIZE; char ip[INET_ADDRSTRLEN+1], *content = NULL, *host = NULL, *auth = NULL, *auth64 = NULL; char *page = NULL, *tok = NULL; char recvBuff[BUFFER_SIZE+1], *header = MALLOC(bufsize); unsigned short port = 0, sslfree = 0, entropyfree = 0; size_t len = 0, tlen = 0, plen = 0; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; *size = 0; if(header == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } memset(header, '\0', bufsize); memset(recvBuff, '\0', BUFFER_SIZE+1); memset(&serv_addr, '\0', sizeof(struct sockaddr_in)); /* Check which port we need to use based on the http(s) protocol */ if(strncmp(url, "http://", 7) == 0) { port = 80; plen = 8; } else if(strncmp(url, "https://", 8) == 0) { port = 443; plen = 9; } else { logprintf(LOG_ERR, "an url should start with either http:// or https://", url); *code = -1; goto exit; } /* Split the url into a host and page part */ len = strlen(url); if((tok = strstr(&url[plen], "/"))) { tlen = (size_t)(tok-url)-plen+1; if((host = MALLOC(tlen+1)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strncpy(host, &url[plen-1], tlen); host[tlen] = '\0'; if((page = MALLOC(len-tlen)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strcpy(page, &url[tlen+(plen-1)]); } else { tlen = strlen(url)-(plen-1); if((host = MALLOC(tlen+1)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strncpy(host, &url[(plen-1)], tlen); host[tlen] = '\0'; if((page = MALLOC(2)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strcpy(page, "/"); } if((tok = strstr(host, "@"))) { size_t pglen = strlen(page); if(strcmp(page, "/") == 0) { pglen -= 1; } tlen = (size_t)(tok-host); if((auth = MALLOC(tlen+1)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } strncpy(auth, &host[0], tlen); auth[tlen] = '\0'; strncpy(&host[0], &url[plen+tlen], len-(plen+tlen+pglen)); host[len-(plen+tlen+pglen)] = '\0'; auth64 = base64encode(auth, strlen(auth)); } #ifdef _WIN32 WSADATA wsa; if(WSAStartup(0x202, &wsa) != 0) { logprintf(LOG_ERR, "could not initialize new socket"); *code = -1; goto exit; } #endif if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0){ logprintf(LOG_ERR, "could not http create socket"); *code = -1; goto exit; } setsockopt(sockfd, SOL_SOCKET, SO_KEEPALIVE, 0, 0); char *w = ip; if(host2ip(host, w) == -1) { *code = -1; goto exit; } serv_addr.sin_family = AF_INET; if(inet_pton(AF_INET, ip, (void *)(&(serv_addr.sin_addr.s_addr))) <= 0) { logprintf(LOG_ERR, "%s is not a valid ip address", ip); *code = -1; goto exit; } serv_addr.sin_port = htons(port); /* Proper socket timeout testing */ switch(socket_timeout_connect(sockfd, (struct sockaddr *)&serv_addr, 3)) { case -1: logprintf(LOG_ERR, "could not connect to http socket (%s)", url); *code = -1; goto exit; case -2: logprintf(LOG_ERR, "http socket connection timeout (%s)", url); *code = -1; goto exit; case -3: logprintf(LOG_ERR, "error in http socket connection", url); *code = -1; goto exit; default: break; } if(method == HTTP_POST) { len = (size_t)snprintf(&header[0], bufsize, "POST %s HTTP/1.0\r\n", page); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Host: %s\r\n", host); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } if(auth64 != NULL) { len += (size_t)snprintf(&header[len], bufsize - len, "Authorization: Basic %s\r\n", auth64); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } } len += (size_t)snprintf(&header[len], bufsize - len, "User-Agent: %s\r\n", USERAGENT); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Content-Type: %s\r\n", contype); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Content-Length: %d\r\n\r\n", (int)strlen(post)); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "%s", post); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } } else if(method == HTTP_GET) { len = (size_t)snprintf(&header[0], bufsize, "GET %s HTTP/1.0\r\n", page); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Host: %s\r\n", host); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } if(auth64 != NULL) { len += (size_t)snprintf(&header[len], bufsize - len, "Authorization: Basic %s\r\n", auth64); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } } len += (size_t)snprintf(&header[len], bufsize - len, "User-Agent: %s\r\n", USERAGENT); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } len += (size_t)snprintf(&header[len], bufsize - len, "Connection: close\r\n\r\n"); if(len >= bufsize) { bufsize += BUFFER_SIZE; if((header = REALLOC(header, bufsize)) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } } } if(port == 443) { memset(&ssl, '\0', sizeof(ssl_context)); entropy_init(&entropy); entropyfree = 1; if((ctr_drbg_init(&ctr_drbg, entropy_func, &entropy, (const unsigned char *)USERAGENT, 6)) != 0) { logprintf(LOG_ERR, "ctr_drbg_init failed"); *code = -1; goto exit; } if((ssl_init(&ssl)) != 0) { logprintf(LOG_ERR, "ssl_init failed"); *code = -1; goto exit; } sslfree = 1; ssl_set_endpoint(&ssl, SSL_IS_CLIENT); ssl_set_rng(&ssl, ctr_drbg_random, &ctr_drbg); ssl_set_bio(&ssl, net_recv, &sockfd, net_send, &sockfd); int ret = 0; while((ret = ssl_handshake(&ssl)) != 0) { if(ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE) { logprintf(LOG_ERR, "ssl_handshake failed"); *code = -1; goto exit; } } while((ret = ssl_write(&ssl, (const unsigned char *)header, len)) <= 0) { if(ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE) { if(ret == -76) { logprintf(LOG_ERR, "ssl_write timed out"); } else { logprintf(LOG_ERR, "ssl_write failed"); } *code = -1; goto exit; } } } else { if((bytes = send(sockfd, header, len, 0)) <= 0) { logprintf(LOG_ERR, "sending header to http server failed"); *code = -1; goto exit; } } char *nl = NULL; char *tp = *type; memset(recvBuff, '\0', sizeof(recvBuff)); while(1) { if(port == 443) { bytes = ssl_read(&ssl, (unsigned char *)recvBuff, BUFFER_SIZE); if(bytes == POLARSSL_ERR_NET_WANT_READ || bytes == POLARSSL_ERR_NET_WANT_WRITE) { continue; } if(bytes == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY) { break; } } else { bytes = recv(sockfd, recvBuff, BUFFER_SIZE, 0); } if(bytes <= 0) { if(*size == 0) { logprintf(LOG_ERR, "http(s) read failed (%s)", url); } break; } if((content = REALLOC(content, (size_t)(*size+bytes+1))) == NULL) { fprintf(stderr, "out of memory\n"); exit(EXIT_FAILURE); } memset(&content[*size], '\0', (size_t)(bytes+1)); strncpy(&content[*size], recvBuff, (size_t)(bytes)); *size += bytes; char **array = NULL; char *p = recvBuff; /* Let's first normalize the HEADER terminator */ str_replace("\r\n", "\n\r", &p); unsigned int n = explode(recvBuff, "\n\r", &array), q = 0; int z = 0; for(q=0;q<n;q++) { if(has_code == 0 && sscanf(array[q], "HTTP/1.%d%*[ ]%d%*s%*[ \n\r]", &z, code)) { has_code = 1; } // ;%*[ A-Za-z0-9\\/=+- \n\r] if(has_type == 0 && sscanf(array[q], "Content-%*[tT]ype:%*[ ]%[A-Za-z\\/+-]", tp)) { has_type = 1; } } array_free(&array, n); memset(recvBuff, '\0', sizeof(recvBuff)); } if(content != NULL) { /* Remove the header */ if((nl = strstr(content, "\r\n\r\n"))) { pos = (nl-content)+4; memmove(&content[0], &content[pos], (size_t)(*size-pos)); *size-=pos; } /* Remove the footer */ if((nl = strstr(content, "0\r\n\r\n"))) { *size -= 5; } } exit: if(port == 443) { if(sslfree == 1) { ssl_free(&ssl); } if(entropyfree == 1) { entropy_free(&entropy); } } if(header) FREE(header); if(auth) FREE(auth); if(auth64) FREE(auth64); if(page) FREE(page); if(host) FREE(host); if(sockfd > 0) { close(sockfd); } if(*size > 0) { content[*size] = '\0'; return content; } else { return NULL; } return NULL; }
int main( int argc, char *argv[] ) { int ret, len; int listen_fd; int client_fd = -1; unsigned char buf[1024]; const char *pers = "ssl_server"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_cert srvcert; rsa_context rsa; #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_context cache; #endif ((void) argc); ((void) argv); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_init( &cache ); #endif /* * 1. Load the certificates and private RSA key */ printf( "\n . Loading the server cert. and key..." ); fflush( stdout ); memset( &srvcert, 0, sizeof( x509_cert ) ); /* * This demonstration program uses embedded test certificates. * Instead, you may want to use x509parse_crtfile() to read the * server and CA certificates, as well as x509parse_keyfile(). */ ret = x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } ret = x509parse_crt( &srvcert, (const unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } rsa_init( &rsa, RSA_PKCS_V15, 0 ); ret = x509parse_key( &rsa, (const unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! x509parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup the listening TCP socket */ printf( " . Bind on https://localhost:4433/ ..." ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 ) { printf( " failed\n ! net_bind returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 3. Seed the RNG */ printf( " . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n" ); /* * 4. Setup stuff */ printf( " . Setting up the SSL data...." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); #if defined(POLARSSL_SSL_CACHE_C) ssl_set_session_cache( &ssl, ssl_cache_get, &cache, ssl_cache_set, &cache ); #endif ssl_set_ca_chain( &ssl, srvcert.next, NULL, NULL ); ssl_set_own_cert( &ssl, &srvcert, &rsa ); printf( " ok\n" ); reset: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; error_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif if( client_fd != -1 ) net_close( client_fd ); ssl_session_reset( &ssl ); /* * 3. Wait until a client connects */ #if defined(_WIN32_WCE) { SHELLEXECUTEINFO sei; ZeroMemory( &sei, sizeof( SHELLEXECUTEINFO ) ); sei.cbSize = sizeof( SHELLEXECUTEINFO ); sei.fMask = 0; sei.hwnd = 0; sei.lpVerb = _T( "open" ); sei.lpFile = _T( "https://localhost:4433/" ); sei.lpParameters = NULL; sei.lpDirectory = NULL; sei.nShow = SW_SHOWNORMAL; ShellExecuteEx( &sei ); } #elif defined(_WIN32) ShellExecute( NULL, "open", "https://localhost:4433/", NULL, NULL, SW_SHOWNORMAL ); #endif client_fd = -1; printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned %d\n\n", ret ); goto exit; } ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); printf( " ok\n" ); /* * 5. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned %d\n\n", ret ); goto reset; } } printf( " ok\n" ); /* * 6. Read the HTTP Request */ printf( " < Read from client:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned -0x%x\n", -ret ); break; } break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); if( ret > 0 ) break; } while( 1 ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_ciphersuite( &ssl ) ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " failed\n ! peer closed the connection\n\n" ); goto reset; } if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s\n", len, (char *) buf ); ret = 0; goto reset; exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; error_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif net_close( client_fd ); x509_free( &srvcert ); rsa_free( &rsa ); ssl_free( &ssl ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_free( &cache ); #endif #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
/* * This function loads all the client/CA certificates and CRLs. Setup the TLS * layer and do all necessary magic. */ CURLcode Curl_polarssl_connect(struct connectdata *conn, int sockindex) { struct SessionHandle *data = conn->data; bool sni = TRUE; /* default is SNI enabled */ int ret = -1; #ifdef ENABLE_IPV6 struct in6_addr addr; #else struct in_addr addr; #endif void *old_session = NULL; size_t old_session_size = 0; char buffer[1024]; if(conn->ssl[sockindex].state == ssl_connection_complete) return CURLE_OK; /* PolarSSL only supports SSLv3 and TLSv1 */ if(data->set.ssl.version == CURL_SSLVERSION_SSLv2) { failf(data, "PolarSSL does not support SSLv2"); return CURLE_SSL_CONNECT_ERROR; } else if(data->set.ssl.version == CURL_SSLVERSION_SSLv3) sni = FALSE; /* SSLv3 has no SNI */ havege_init(&conn->ssl[sockindex].hs); /* Load the trusted CA */ memset(&conn->ssl[sockindex].cacert, 0, sizeof(x509_cert)); if(data->set.str[STRING_SSL_CAFILE]) { ret = x509parse_crtfile(&conn->ssl[sockindex].cacert, data->set.str[STRING_SSL_CAFILE]); if(ret) { failf(data, "Error reading ca cert file %s: -0x%04X", data->set.str[STRING_SSL_CAFILE], -ret); if(data->set.ssl.verifypeer) return CURLE_SSL_CACERT_BADFILE; } } /* Load the client certificate */ memset(&conn->ssl[sockindex].clicert, 0, sizeof(x509_cert)); if(data->set.str[STRING_CERT]) { ret = x509parse_crtfile(&conn->ssl[sockindex].clicert, data->set.str[STRING_CERT]); if(ret) { failf(data, "Error reading client cert file %s: -0x%04X", data->set.str[STRING_CERT], -ret); return CURLE_SSL_CERTPROBLEM; } } /* Load the client private key */ if(data->set.str[STRING_KEY]) { ret = x509parse_keyfile(&conn->ssl[sockindex].rsa, data->set.str[STRING_KEY], data->set.str[STRING_KEY_PASSWD]); if(ret) { failf(data, "Error reading private key %s: -0x%04X", data->set.str[STRING_KEY], -ret); return CURLE_SSL_CERTPROBLEM; } } /* Load the CRL */ memset(&conn->ssl[sockindex].crl, 0, sizeof(x509_crl)); if(data->set.str[STRING_SSL_CRLFILE]) { ret = x509parse_crlfile(&conn->ssl[sockindex].crl, data->set.str[STRING_SSL_CRLFILE]); if(ret) { failf(data, "Error reading CRL file %s: -0x%04X", data->set.str[STRING_SSL_CRLFILE], -ret); return CURLE_SSL_CRL_BADFILE; } } infof(data, "PolarSSL: Connected to %s:%d\n", conn->host.name, conn->remote_port); havege_init(&conn->ssl[sockindex].hs); if(ssl_init(&conn->ssl[sockindex].ssl)) { failf(data, "PolarSSL: ssl_init failed"); return CURLE_SSL_CONNECT_ERROR; } ssl_set_endpoint(&conn->ssl[sockindex].ssl, SSL_IS_CLIENT); ssl_set_authmode(&conn->ssl[sockindex].ssl, SSL_VERIFY_OPTIONAL); ssl_set_rng(&conn->ssl[sockindex].ssl, havege_rand, &conn->ssl[sockindex].hs); ssl_set_bio(&conn->ssl[sockindex].ssl, net_recv, &conn->sock[sockindex], net_send, &conn->sock[sockindex]); ssl_set_ciphers(&conn->ssl[sockindex].ssl, ssl_default_ciphers); if(!Curl_ssl_getsessionid(conn, &old_session, &old_session_size)) { memcpy(&conn->ssl[sockindex].ssn, old_session, old_session_size); infof(data, "PolarSSL re-using session\n"); } ssl_set_session(&conn->ssl[sockindex].ssl, 1, 600, &conn->ssl[sockindex].ssn); ssl_set_ca_chain(&conn->ssl[sockindex].ssl, &conn->ssl[sockindex].cacert, &conn->ssl[sockindex].crl, conn->host.name); ssl_set_own_cert(&conn->ssl[sockindex].ssl, &conn->ssl[sockindex].clicert, &conn->ssl[sockindex].rsa); if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) && #ifdef ENABLE_IPV6 !Curl_inet_pton(AF_INET6, conn->host.name, &addr) && #endif sni && ssl_set_hostname(&conn->ssl[sockindex].ssl, conn->host.name)) { infof(data, "WARNING: failed to configure " "server name indication (SNI) TLS extension\n"); } infof(data, "PolarSSL: performing SSL/TLS handshake...\n"); #ifdef POLARSSL_DEBUG ssl_set_dbg(&conn->ssl[sockindex].ssl, polarssl_debug, data); #endif for(;;) { if(!(ret = ssl_handshake(&conn->ssl[sockindex].ssl))) break; else if(ret != POLARSSL_ERR_NET_TRY_AGAIN) { failf(data, "ssl_handshake returned -0x%04X", -ret); return CURLE_SSL_CONNECT_ERROR; } else { /* wait for data from server... */ long timeout_ms = Curl_timeleft(data, NULL, TRUE); if(timeout_ms < 0) { failf(data, "SSL connection timeout"); return CURLE_OPERATION_TIMEDOUT; } switch(Curl_socket_ready(conn->sock[sockindex], CURL_SOCKET_BAD, timeout_ms)) { case 0: failf(data, "SSL handshake timeout"); return CURLE_OPERATION_TIMEDOUT; break; case CURL_CSELECT_IN: continue; break; default: return CURLE_SSL_CONNECT_ERROR; break; } } } infof(data, "PolarSSL: Handshake complete, cipher is %s\n", ssl_get_cipher(&conn->ssl[sockindex].ssl)); ret = ssl_get_verify_result(&conn->ssl[sockindex].ssl); if(ret && data->set.ssl.verifypeer) { if(ret & BADCERT_EXPIRED) failf(data, "Cert verify failed: BADCERT_EXPIRED\n"); if(ret & BADCERT_REVOKED) failf(data, "Cert verify failed: BADCERT_REVOKED"); if(ret & BADCERT_CN_MISMATCH) failf(data, "Cert verify failed: BADCERT_CN_MISMATCH"); if(ret & BADCERT_NOT_TRUSTED) failf(data, "Cert verify failed: BADCERT_NOT_TRUSTED"); return CURLE_SSL_CACERT; } if(conn->ssl[sockindex].ssl.peer_cert) { /* If the session was resumed, there will be no peer certs */ memset(buffer, 0, sizeof(buffer)); if(x509parse_cert_info(buffer, sizeof(buffer), (char *)"* ", conn->ssl[sockindex].ssl.peer_cert) != -1) infof(data, "Dumping cert info:\n%s\n", buffer); } conn->ssl[sockindex].state = ssl_connection_complete; conn->recv[sockindex] = polarssl_recv; conn->send[sockindex] = polarssl_send; /* Save the current session data for possible re-use */ { void *new_session = malloc(sizeof(conn->ssl[sockindex].ssn)); if(new_session) { memcpy(new_session, &conn->ssl[sockindex].ssn, sizeof(conn->ssl[sockindex].ssn)); if(old_session) Curl_ssl_delsessionid(conn, old_session); return Curl_ssl_addsessionid(conn, new_session, sizeof(conn->ssl[sockindex].ssn)); } } return CURLE_OK; }
/** * @brief SSL Server task. * @param pvParameters not used * @retval None */ void ssl_server(void const * argument) { int ret, len; int listen_fd; int client_fd = -1; unsigned char buf[1524]; ssl_context ssl; x509_cert srvcert; rsa_context rsa; #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_context cache; ssl_cache_init( &cache ); #endif /* * Load the certificates and private RSA key */ printf( "\n . Loading the server cert. and key..." ); memset( &srvcert, 0, sizeof( x509_cert ) ); /* * This demonstration program uses embedded test certificates. * Instead, you may want to use x509parse_crtfile() to read the * server and CA certificates, as well as x509parse_keyfile(). */ ret = x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } ret = x509parse_crt( &srvcert, (const unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } rsa_init( &rsa, RSA_PKCS_V15, 0 ); ret = x509parse_key( &rsa, (const unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! x509parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n\r" ); /* * Setup the listening TCP socket */ printf( " . Bind on https://localhost:443/ ..." ); if( ( ret = net_bind( &listen_fd, NULL, 443) ) != 0 ) { printf( " failed\n ! net_bind returned %d\n\n", ret ); goto exit; } printf( " ok\n\r" ); /* * Setup stuff */ printf( " . Setting up the SSL data...." ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto reset; } ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, RandVal , NULL ); ssl_set_dbg( &ssl, my_debug, stdout ); #if defined(POLARSSL_SSL_CACHE_C) ssl_set_session_cache( &ssl, ssl_cache_get, &cache, ssl_cache_set, &cache ); #endif ssl_set_ca_chain( &ssl, srvcert.next, NULL, NULL ); ssl_set_own_cert( &ssl, &srvcert, &rsa ); ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); printf( " ok\n\r" ); for(;;) { /* * Wait until a client connects */ client_fd = -1; printf( " . Waiting for a remote connection ..." ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned %d\n\n", ret ); goto exit; } printf( " ok\n\r" ); /* * Handshake */ printf( " . Performing the SSL/TLS handshake..." ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto reset; } } printf( " ok\n\r" ); /* * Read the HTTP Request */ printf( " < Read from client:" ); memset( buf, 0, sizeof( buf ) ); len = 0; do { ret = ssl_read( &ssl, buf + len, 1523 - len); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned -0x%x\n", -ret ); break; } break; } len += ret; if( ret > 1 ) break; } while( 1 ); printf( " %d bytes read\n\r", len); /* * Write the 200 Response */ printf( " > Write to client:" ); /* Send the dynamic html page */ ssl_DynPage(&ssl); goto reset; exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; error_strerror( ret, error_buf, 100 ); printf("Last error was: %d - %s\n\n", ret, error_buf ); } #endif x509_free( &srvcert ); rsa_free( &rsa ); ssl_free( &ssl ); #if defined(POLARSSL_SSL_CACHE_C) ssl_cache_free( &cache ); #endif reset: if (client_fd != -1) net_close(client_fd); ssl_session_reset( &ssl ); } }
int main( void ) { int ret, len; int listen_fd; int client_fd; unsigned char buf[1024]; havege_state hs; ssl_context ssl; ssl_session ssn; x509_cert srvcert; rsa_context rsa; /* * 1. Load the certificates and private RSA key */ printf( "\n . Loading the server cert. and key..." ); fflush( stdout ); memset( &srvcert, 0, sizeof( x509_cert ) ); /* * This demonstration program uses embedded test certificates. * Instead, you may want to use x509parse_crtfile() to read the * server and CA certificates, as well as x509parse_keyfile(). */ ret = x509parse_crt( &srvcert, (unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } ret = x509parse_crt( &srvcert, (unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } ret = x509parse_key( &rsa, (unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! x509parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup the listening TCP socket */ printf( " . Bind on https://localhost:4433/ ..." ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 ) { printf( " failed\n ! net_bind returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 3. Wait until a client connects */ #ifdef WIN32 ShellExecute( NULL, "open", "https://localhost:4433/", NULL, NULL, SW_SHOWNORMAL ); #endif client_fd = -1; memset( &ssl, 0, sizeof( ssl ) ); accept: net_close( client_fd ); ssl_free( &ssl ); printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 4. Setup stuff */ printf( " . Setting up the RNG and SSL data...." ); fflush( stdout ); havege_init( &hs ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto accept; } printf( " ok\n" ); ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, havege_rand, &hs ); ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); ssl_set_scb( &ssl, my_get_session, my_set_session ); ssl_set_ciphers( &ssl, my_ciphers ); ssl_set_session( &ssl, 1, 0, &ssn ); memset( &ssn, 0, sizeof( ssl_session ) ); ssl_set_ca_chain( &ssl, srvcert.next, NULL ); ssl_set_own_cert( &ssl, &srvcert, &rsa ); ssl_set_dh_param( &ssl, my_dhm_P, my_dhm_G ); /* * 5. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_TRY_AGAIN ) { printf( " failed\n ! ssl_handshake returned %d\n\n", ret ); goto accept; } } printf( " ok\n" ); /* * 6. Read the HTTP Request */ printf( " < Read from client:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_TRY_AGAIN ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned %d\n", ret ); break; } break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); } while( 0 ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_cipher( &ssl ) ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " failed\n ! peer closed the connection\n\n" ); goto accept; } if( ret != POLARSSL_ERR_NET_TRY_AGAIN ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s\n", len, (char *) buf ); ssl_close_notify( &ssl ); goto accept; exit: net_close( client_fd ); x509_free( &srvcert ); rsa_free( &rsa ); ssl_free( &ssl ); cur = s_list_1st; while( cur != NULL ) { prv = cur; cur = cur->next; memset( prv, 0, sizeof( ssl_session ) ); free( prv ); } memset( &ssl, 0, sizeof( ssl_context ) ); #ifdef WIN32 printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
int main( int argc, char *argv[] ) { int ret, len, server_fd; unsigned char buf[2]; havege_state hs; ssl_context ssl; ssl_session ssn; x509_cert cacert; x509_cert clicert; rsa_context rsa; char *SERVER_NAME = argv[1]; char GET_REQUEST[128]; sprintf( GET_REQUEST, "GET %s HTTP/1.1\r\nHost: %s\r\n\r\n", argv[2], argv[1] ); /* * 0. Initialize the RNG and the session data */ havege_init( &hs ); memset( &ssn, 0, sizeof( ssl_session ) ); memset( &cacert, 0, sizeof( x509_cert ) ); /* * Alternatively, you may load the CA certificates from a .pem or * .crt file by calling x509parse_crtfile( &cacert, "myca.crt" ). */ ret = x509parse_crt( &cacert, ( unsigned char * )xyssl_ca_crt, strlen( xyssl_ca_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } /* * 1.2. Load own certificate and private key * * (can be skipped if client authentication is not required) */ memset( &clicert, 0, sizeof( x509_cert ) ); ret = x509parse_crt( &clicert, ( unsigned char * )test_cli_crt, strlen( test_cli_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } ret = x509parse_key( &rsa, ( unsigned char * )test_cli_key, strlen( test_cli_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! x509parse_key returned %d\n\n", ret ); goto exit; } if( ( ret = net_connect( &server_fd, SERVER_NAME, SERVER_PORT ) ) != 0 ) { printf( " failed\n ! net_connect returned %d\n\n", ret ); goto exit; } havege_init( &hs ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_authmode( &ssl, SSL_VERIFY_OPTIONAL ); ssl_set_rng( &ssl, havege_rand, &hs ); ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); ssl_set_ciphers( &ssl, ssl_default_ciphers ); ssl_set_session( &ssl, 1, 600, &ssn ); ssl_set_ca_chain( &ssl, &cacert, SERVER_NAME ); ssl_set_own_cert( &ssl, &clicert, &rsa ); ssl_set_hostname( &ssl, SERVER_NAME ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != XYSSL_ERR_NET_TRY_AGAIN ) { printf( " failed\n ! ssl_handshake returned %d\n\n", ret ); goto exit; } } if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { printf( "certificate check failed\n" ); if( ( ret & BADCERT_EXPIRED ) != 0 ) printf( " ! server certificate has expired\n" ); if( ( ret & BADCERT_REVOKED ) != 0 ) printf( " ! server certificate has been revoked\n" ); if( ( ret & BADCERT_CN_MISMATCH ) != 0 ) printf( " ! CN mismatch (expected CN=%s)\n", SERVER_NAME ); if( ( ret & BADCERT_NOT_TRUSTED ) != 0 ) printf( " ! self-signed or not signed by a trusted CA\n" ); printf( "\n" ); } len = sprintf( ( char * )buf, GET_REQUEST ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret != XYSSL_ERR_NET_TRY_AGAIN ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; /* * 7. Read the HTTP response */ fflush( stdout ); FILE *out = fopen( argv[3], "wb" ); int found = 0; int offset = 0; do { offset = 0; len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == XYSSL_ERR_NET_TRY_AGAIN ) continue; if( ret == XYSSL_ERR_SSL_PEER_CLOSE_NOTIFY ) break; if( ret <= 0 ) { printf( "failed\n ! ssl_read returned %d\n\n", ret ); break; } if( found < 4 ) { if( found == 0 || found == 2 ) if( buf[0] == '\r' ) { found++; continue; } else found = 0; if( found == 1 || found == 3 ) if( buf[0] == '\n' ) { found++; continue; } else found = 0; } else putc( buf[0], out ); len = ret; } while( 1 ); ssl_close_notify( &ssl ); exit: fclose( out ); net_close( server_fd ); x509_free( &clicert ); x509_free( &cacert ); rsa_free( &rsa ); ssl_free( &ssl ); memset( &ssl, 0, sizeof( ssl ) ); return ( ret ); }
/* int ctr_drbg_randomx( void *p_rng, unsigned char *output, size_t output_len ){ char *getEntropyFromZRTP_tmp(unsigned char *p, int iBytes); getEntropyFromZRTP_tmp(output,(int)output_len); return 0; } */ int CTTLS::_connect(ADDR *address) { addrConnected=*address; // int server_fd=((T_SSL*)pSSL)->sock; ssl_context *ssl=&((T_SSL*)pSSL)->ssl; x509_cert *ca=&((T_SSL*)pSSL)->cacert; #if 0 static int ssl_default_ciphersuitesz[] = { #if defined(POLARSSL_DHM_C) #if defined(POLARSSL_AES_C) // SSL_EDH_RSA_AES_128_SHA, SSL_EDH_RSA_AES_256_SHA, #endif #if defined(POLARSSL_CAMELLIA_C) SSL_EDH_RSA_CAMELLIA_128_SHA, SSL_EDH_RSA_CAMELLIA_256_SHA, #endif #if defined(POLARSSL_DES_C) SSL_EDH_RSA_DES_168_SHA, #endif #endif #if defined(POLARSSL_AES_C) SSL_RSA_AES_256_SHA, #endif #if defined(POLARSSL_CAMELLIA_C) SSL_RSA_CAMELLIA_256_SHA, #endif #if defined(POLARSSL_AES_C) // SSL_RSA_AES_128_SHA, #endif #if defined(POLARSSL_CAMELLIA_C) // SSL_RSA_CAMELLIA_128_SHA, #endif #if defined(POLARSSL_DES_C) SSL_RSA_DES_168_SHA, #endif #if defined(POLARSSL_ARC4_C) SSL_RSA_RC4_128_SHA, SSL_RSA_RC4_128_MD5, #endif 0 }; #else const int ssl_default_ciphersuitesz[] = { #if defined(POLARSSL_DHM_C) #if defined(POLARSSL_AES_C) #if defined(POLARSSL_SHA2_C) TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, #endif /* POLARSSL_SHA2_C */ #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA4_C) TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, #endif TLS_DHE_RSA_WITH_AES_256_CBC_SHA, #if defined(POLARSSL_SHA2_C) TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, #endif #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C) TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, #endif TLS_DHE_RSA_WITH_AES_128_CBC_SHA, #endif #if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_SHA2_C) TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256, #endif /* POLARSSL_SHA2_C */ TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, #if defined(POLARSSL_SHA2_C) TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, #endif /* POLARSSL_SHA2_C */ TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, #endif #if defined(POLARSSL_DES_C) TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, #endif #endif #if defined(POLARSSL_AES_C) #if defined(POLARSSL_SHA2_C) TLS_RSA_WITH_AES_256_CBC_SHA256, #endif /* POLARSSL_SHA2_C */ #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA4_C) TLS_RSA_WITH_AES_256_GCM_SHA384, #endif /* POLARSSL_SHA2_C */ TLS_RSA_WITH_AES_256_CBC_SHA, #endif #if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_SHA2_C) TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256, #endif /* POLARSSL_SHA2_C */ TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, #endif #if defined(POLARSSL_AES_C) #if defined(POLARSSL_SHA2_C) TLS_RSA_WITH_AES_128_CBC_SHA256, #endif /* POLARSSL_SHA2_C */ #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C) TLS_RSA_WITH_AES_128_GCM_SHA256, #endif /* POLARSSL_SHA2_C */ TLS_RSA_WITH_AES_128_CBC_SHA, #endif #if defined(POLARSSL_CAMELLIA_C) #if defined(POLARSSL_SHA2_C) TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256, #endif /* POLARSSL_SHA2_C */ TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, #endif #if defined(POLARSSL_DES_C) TLS_RSA_WITH_3DES_EDE_CBC_SHA, #endif #if defined(POLARSSL_ARC4_C) // TLS_RSA_WITH_RC4_128_SHA, // TLS_RSA_WITH_RC4_128_MD5, #endif 0 }; #endif if(iCallingConnect)return 0; CTAutoIntUnlock _a(&iCallingConnect); if(!iClosed) { puts("destr tls"); closeSocket(); Sleep(100); puts("destr tls ok"); } char bufX[64]; address->toStr(&bufX[0],0); int iIncPort=0; if(address->getPort()==5060)iIncPort++;//TODO fix iConnected=0; int ret; memset( ca, 0, sizeof( x509_cert ) ); do { #define CERT_VERIFY int iCertErr=1; #ifdef CERT_VERIFY char *p=cert; if(cert) { iCertErr = x509parse_crt( ca, (unsigned char *) p, strlen( p ) ); } #endif puts(&bufX[0]); if(net_connect(&(((T_SSL*)pSSL)->sock),&bufX[0],address->getPort()+iIncPort)) break; iLastTLSSOCK_TEST=(((T_SSL*)pSSL)->sock); iNeedCallCloseSocket=1; #ifndef _WIN32 int on=1; setsockopt((((T_SSL*)pSSL)->sock), SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on));//new 05052012 //TODO set this if need backgr only #endif relTcpBGSock(((T_SSL*)pSSL)->voipBCKGR); ((T_SSL*)pSSL)->voipBCKGR=prepareTcpSocketForBg(((T_SSL*)pSSL)->sock); initEntropy(); if( ( ret = ssl_init( ssl ) ) != 0 ) { error_strerror(ret,&bufErr[0],sizeof(bufErr)-1); tivi_slog("ssl_init[%s]",&bufErr[0]); break; } ssl_set_endpoint( ssl, SSL_IS_CLIENT ); ssl_set_authmode( ssl,iCertErr==0?SSL_VERIFY_OPTIONAL:SSL_VERIFY_NONE ); ssl_set_rng( ssl, ctr_drbg_random, &((T_SSL*)pSSL)->ctr_drbg ); ssl_set_dbg( ssl, my_debug, stdout ); ssl_set_bio( ssl, net_recv, (void*)&(((T_SSL*)pSSL)->sock), net_send, (void*)&(((T_SSL*)pSSL)->sock) ); ssl_set_ciphersuites( ssl, ssl_default_ciphersuitesz ); //ssl_set_session( ssl, 1, 600, &((T_SSL*)pSSL)->ssn );//will timeout after 600, and will be resumed // ssl_set_session( ssl, 1, 0, &((T_SSL*)pSSL)->ssn );//will never timeout, and will be resumed iCertFailed=0; #ifdef CERT_VERIFY if(iCertErr==0) { ssl_set_ca_chain( ssl, ca, NULL, &bufCertHost[0] ); ssl_set_hostname( ssl, &bufCertHost[0] ); checkCert(); } #endif iClosed=0; iConnected=1; addrConnected=*address; } while(0); return 0; }
int main( void ) { int ret, len, server_fd; unsigned char buf[1024]; havege_state hs; ssl_context ssl; ssl_session ssn; /* * 0. Initialize the RNG and the session data */ havege_init( &hs ); memset( &ssn, 0, sizeof( ssl_session ) ); /* * 1. Start the connection */ printf( "\n . Connecting to tcp/%s/%4d...", SERVER_NAME, SERVER_PORT ); fflush( stdout ); if( ( ret = net_connect( &server_fd, SERVER_NAME, SERVER_PORT ) ) != 0 ) { printf( " failed\n ! net_connect returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup stuff */ printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, havege_rand, &hs ); ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); ssl_set_ciphers( &ssl, ssl_default_ciphers ); ssl_set_session( &ssl, 1, 600, &ssn ); /* * 3. Write the GET request */ printf( " > Write to server:" ); fflush( stdout ); len = sprintf( (char *) buf, GET_REQUEST ); while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret != POLARSSL_ERR_NET_TRY_AGAIN ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s", len, (char *) buf ); /* * 7. Read the HTTP response */ printf( " < Read from server:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_TRY_AGAIN ) continue; if( ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY ) break; if( ret <= 0 ) { printf( "failed\n ! ssl_read returned %d\n\n", ret ); break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); } while( 0 ); ssl_close_notify( &ssl ); exit: net_close( server_fd ); ssl_free( &ssl ); memset( &ssl, 0, sizeof( ssl ) ); #ifdef WIN32 printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
ngx_int_t ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags) { ngx_ssl_connection_t *sc; ngx_ssl_conn_t *ssl_ctx; ngx_ssl_session_cache_t *cache; int sslerr; sc = ngx_pcalloc(c->pool, sizeof(ngx_ssl_connection_t)); if (sc == NULL) { return NGX_ERROR; } sc->buffer = ((flags % NGX_SSL_BUFFER) != 0); /* Allocate the PolarSSL context */ ssl_ctx = ngx_pcalloc(c->pool, sizeof(ngx_ssl_conn_t)); if (sc == NULL) { return NGX_ERROR; } /* * Initialize this PolarSSL context * * Note: We also setup the options traditionally set in ngx_ssl_create * here since each ssl_ctx is unique to each fd. */ sslerr = ssl_init(ssl_ctx); if (sslerr != 0) { ngx_mbedtls_error(NGX_LOG_ALERT, ssl->log, 0, sslerr, "ssl_init failed"); return NGX_ERROR; } if (flags & NGX_SSL_CLIENT) { ssl_set_endpoint(ssl_ctx, SSL_IS_CLIENT); if (ssl->have_own_cert) { ssl_set_own_cert(ssl_ctx, &ssl->own_cert, &ssl->own_key); } } else { ssl_set_endpoint(ssl_ctx, SSL_IS_SERVER); ssl_set_own_cert(ssl_ctx, &ssl->own_cert, &ssl->own_key); } if (ssl->have_ca_cert) { if (ssl->have_ca_crl) { ssl_set_ca_chain(ssl_ctx, &ssl->ca_cert, &ssl->ca_crl, NULL); } else { ssl_set_ca_chain(ssl_ctx, &ssl->ca_cert, NULL, NULL); } /* * ngx_event_openssl has the callback rigged to allow the handshake * to continue even if verification fails. We shall do the same. */ ssl_set_authmode(ssl_ctx, SSL_VERIFY_OPTIONAL); } else { ssl_set_authmode(ssl_ctx, SSL_VERIFY_NONE); } ssl_set_min_version(ssl_ctx, SSL_MAJOR_VERSION_3, ssl->minor_min); ssl_set_max_version(ssl_ctx, SSL_MAJOR_VERSION_3, ssl->minor_max); ssl_set_renegotiation(ssl_ctx, SSL_RENEGOTIATION_ENABLED); ssl_legacy_renegotiation(ssl_ctx, SSL_LEGACY_NO_RENEGOTIATION); ssl_set_rng(ssl_ctx, ngx_mbedtls_rng, &ngx_ctr_drbg); ssl_set_bio(ssl_ctx, net_recv, &c->fd, net_send, &c->fd); ssl_set_dh_param_ctx(ssl_ctx, &ssl->dhm_ctx); ssl_set_ciphersuites(ssl_ctx, ssl->ciphersuites); if (ssl->builtin_session_cache == NGX_SSL_NONE_SCACHE) { ssl_set_session_cache(ssl_ctx, ngx_mbedtls_get_cache, NULL, ngx_mbedtls_set_cache, NULL); } if (ssl->builtin_session_cache != NGX_SSL_NO_SCACHE) { cache = ssl->cache_shm_zone->data; cache->ttl = ssl->cache_ttl; ssl_set_session_cache(ssl_ctx, ngx_mbedtls_get_cache, ssl->cache_shm_zone, ngx_mbedtls_set_cache, ssl->cache_shm_zone); } if (ssl->sni_fn) { ssl_set_sni(ssl_ctx, ssl->sni_fn, c); } /* All done, the connection is good to go now */ sc->connection = ssl_ctx; c->ssl = sc; return NGX_OK; }
int main( int argc, char *argv[] ) { int ret = 0, len, tail_len, server_fd, i, written, frags; unsigned char buf[SSL_MAX_CONTENT_LEN + 1]; #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) unsigned char psk[POLARSSL_PSK_MAX_LEN]; size_t psk_len = 0; #endif #if defined(POLARSSL_SSL_ALPN) const char *alpn_list[10]; #endif const char *pers = "ssl_client2"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; ssl_session saved_session; #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt cacert; x509_crt clicert; pk_context pkey; #endif char *p, *q; const int *list; /* * Make sure memory references are valid. */ server_fd = 0; memset( &ssl, 0, sizeof( ssl_context ) ); memset( &saved_session, 0, sizeof( ssl_session ) ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_init( &cacert ); x509_crt_init( &clicert ); pk_init( &pkey ); #endif #if defined(POLARSSL_SSL_ALPN) memset( (void * ) alpn_list, 0, sizeof( alpn_list ) ); #endif if( argc == 0 ) { usage: if( ret == 0 ) ret = 1; polarssl_printf( USAGE ); list = ssl_list_ciphersuites(); while( *list ) { polarssl_printf(" %-42s", ssl_get_ciphersuite_name( *list ) ); list++; if( !*list ) break; polarssl_printf(" %s\n", ssl_get_ciphersuite_name( *list ) ); list++; } polarssl_printf("\n"); goto exit; } opt.server_name = DFL_SERVER_NAME; opt.server_addr = DFL_SERVER_ADDR; opt.server_port = DFL_SERVER_PORT; opt.debug_level = DFL_DEBUG_LEVEL; opt.nbio = DFL_NBIO; opt.request_page = DFL_REQUEST_PAGE; opt.request_size = DFL_REQUEST_SIZE; opt.ca_file = DFL_CA_FILE; opt.ca_path = DFL_CA_PATH; opt.crt_file = DFL_CRT_FILE; opt.key_file = DFL_KEY_FILE; opt.psk = DFL_PSK; opt.psk_identity = DFL_PSK_IDENTITY; opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; opt.renegotiation = DFL_RENEGOTIATION; opt.allow_legacy = DFL_ALLOW_LEGACY; opt.renegotiate = DFL_RENEGOTIATE; opt.exchanges = DFL_EXCHANGES; opt.min_version = DFL_MIN_VERSION; opt.max_version = DFL_MAX_VERSION; opt.arc4 = DFL_ARC4; opt.auth_mode = DFL_AUTH_MODE; opt.mfl_code = DFL_MFL_CODE; opt.trunc_hmac = DFL_TRUNC_HMAC; opt.recsplit = DFL_RECSPLIT; opt.reconnect = DFL_RECONNECT; opt.reco_delay = DFL_RECO_DELAY; opt.tickets = DFL_TICKETS; opt.alpn_string = DFL_ALPN_STRING; opt.fallback = DFL_FALLBACK; opt.extended_ms = DFL_EXTENDED_MS; opt.etm = DFL_ETM; for( i = 1; i < argc; i++ ) { p = argv[i]; if( ( q = strchr( p, '=' ) ) == NULL ) goto usage; *q++ = '\0'; if( strcmp( p, "server_name" ) == 0 ) opt.server_name = q; else if( strcmp( p, "server_addr" ) == 0 ) opt.server_addr = q; else if( strcmp( p, "server_port" ) == 0 ) { opt.server_port = atoi( q ); if( opt.server_port < 1 || opt.server_port > 65535 ) goto usage; } else if( strcmp( p, "debug_level" ) == 0 ) { opt.debug_level = atoi( q ); if( opt.debug_level < 0 || opt.debug_level > 65535 ) goto usage; } else if( strcmp( p, "nbio" ) == 0 ) { opt.nbio = atoi( q ); if( opt.nbio < 0 || opt.nbio > 2 ) goto usage; } else if( strcmp( p, "request_page" ) == 0 ) opt.request_page = q; else if( strcmp( p, "request_size" ) == 0 ) { opt.request_size = atoi( q ); if( opt.request_size < 0 || opt.request_size > SSL_MAX_CONTENT_LEN ) goto usage; } else if( strcmp( p, "ca_file" ) == 0 ) opt.ca_file = q; else if( strcmp( p, "ca_path" ) == 0 ) opt.ca_path = q; else if( strcmp( p, "crt_file" ) == 0 ) opt.crt_file = q; else if( strcmp( p, "key_file" ) == 0 ) opt.key_file = q; else if( strcmp( p, "psk" ) == 0 ) opt.psk = q; else if( strcmp( p, "psk_identity" ) == 0 ) opt.psk_identity = q; else if( strcmp( p, "force_ciphersuite" ) == 0 ) { opt.force_ciphersuite[0] = ssl_get_ciphersuite_id( q ); if( opt.force_ciphersuite[0] == 0 ) { ret = 2; goto usage; } opt.force_ciphersuite[1] = 0; } else if( strcmp( p, "renegotiation" ) == 0 ) { opt.renegotiation = (atoi( q )) ? SSL_RENEGOTIATION_ENABLED : SSL_RENEGOTIATION_DISABLED; } else if( strcmp( p, "allow_legacy" ) == 0 ) { switch( atoi( q ) ) { case -1: opt.allow_legacy = SSL_LEGACY_BREAK_HANDSHAKE; break; case 0: opt.allow_legacy = SSL_LEGACY_NO_RENEGOTIATION; break; case 1: opt.allow_legacy = SSL_LEGACY_ALLOW_RENEGOTIATION; break; default: goto usage; } } else if( strcmp( p, "renegotiate" ) == 0 ) { opt.renegotiate = atoi( q ); if( opt.renegotiate < 0 || opt.renegotiate > 1 ) goto usage; } else if( strcmp( p, "exchanges" ) == 0 ) { opt.exchanges = atoi( q ); if( opt.exchanges < 1 ) goto usage; } else if( strcmp( p, "reconnect" ) == 0 ) { opt.reconnect = atoi( q ); if( opt.reconnect < 0 || opt.reconnect > 2 ) goto usage; } else if( strcmp( p, "reco_delay" ) == 0 ) { opt.reco_delay = atoi( q ); if( opt.reco_delay < 0 ) goto usage; } else if( strcmp( p, "tickets" ) == 0 ) { opt.tickets = atoi( q ); if( opt.tickets < 0 || opt.tickets > 2 ) goto usage; } else if( strcmp( p, "alpn" ) == 0 ) { opt.alpn_string = q; } else if( strcmp( p, "fallback" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.fallback = SSL_IS_NOT_FALLBACK; break; case 1: opt.fallback = SSL_IS_FALLBACK; break; default: goto usage; } } else if( strcmp( p, "extended_ms" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.extended_ms = SSL_EXTENDED_MS_DISABLED; break; case 1: opt.extended_ms = SSL_EXTENDED_MS_ENABLED; break; default: goto usage; } } else if( strcmp( p, "etm" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.etm = SSL_ETM_DISABLED; break; case 1: opt.etm = SSL_ETM_ENABLED; break; default: goto usage; } } else if( strcmp( p, "min_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.min_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "max_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_0; else if( strcmp( q, "tls1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_1; else if( strcmp( q, "tls1_1" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_2; else if( strcmp( q, "tls1_2" ) == 0 ) opt.max_version = SSL_MINOR_VERSION_3; else goto usage; } else if( strcmp( p, "arc4" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.arc4 = SSL_ARC4_DISABLED; break; case 1: opt.arc4 = SSL_ARC4_ENABLED; break; default: goto usage; } } else if( strcmp( p, "force_version" ) == 0 ) { if( strcmp( q, "ssl3" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_0; opt.max_version = SSL_MINOR_VERSION_0; } else if( strcmp( q, "tls1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_1; opt.max_version = SSL_MINOR_VERSION_1; } else if( strcmp( q, "tls1_1" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_2; opt.max_version = SSL_MINOR_VERSION_2; } else if( strcmp( q, "tls1_2" ) == 0 ) { opt.min_version = SSL_MINOR_VERSION_3; opt.max_version = SSL_MINOR_VERSION_3; } else goto usage; } else if( strcmp( p, "auth_mode" ) == 0 ) { if( strcmp( q, "none" ) == 0 ) opt.auth_mode = SSL_VERIFY_NONE; else if( strcmp( q, "optional" ) == 0 ) opt.auth_mode = SSL_VERIFY_OPTIONAL; else if( strcmp( q, "required" ) == 0 ) opt.auth_mode = SSL_VERIFY_REQUIRED; else goto usage; } else if( strcmp( p, "max_frag_len" ) == 0 ) { if( strcmp( q, "512" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_512; else if( strcmp( q, "1024" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_1024; else if( strcmp( q, "2048" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_2048; else if( strcmp( q, "4096" ) == 0 ) opt.mfl_code = SSL_MAX_FRAG_LEN_4096; else goto usage; } else if( strcmp( p, "trunc_hmac" ) == 0 ) { switch( atoi( q ) ) { case 0: opt.trunc_hmac = SSL_TRUNC_HMAC_DISABLED; break; case 1: opt.trunc_hmac = SSL_TRUNC_HMAC_ENABLED; break; default: goto usage; } } else if( strcmp( p, "recsplit" ) == 0 ) { opt.recsplit = atoi( q ); if( opt.recsplit < 0 || opt.recsplit > 1 ) goto usage; } else goto usage; } #if defined(POLARSSL_DEBUG_C) debug_set_threshold( opt.debug_level ); #endif if( opt.force_ciphersuite[0] > 0 ) { const ssl_ciphersuite_t *ciphersuite_info; ciphersuite_info = ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); if( opt.max_version != -1 && ciphersuite_info->min_minor_ver > opt.max_version ) { polarssl_printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } if( opt.min_version != -1 && ciphersuite_info->max_minor_ver < opt.min_version ) { polarssl_printf("forced ciphersuite not allowed with this protocol version\n"); ret = 2; goto usage; } if( opt.max_version > ciphersuite_info->max_minor_ver ) opt.max_version = ciphersuite_info->max_minor_ver; if( opt.min_version < ciphersuite_info->min_minor_ver ) opt.min_version = ciphersuite_info->min_minor_ver; } #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) /* * Unhexify the pre-shared key if any is given */ if( strlen( opt.psk ) ) { unsigned char c; size_t j; if( strlen( opt.psk ) % 2 != 0 ) { polarssl_printf("pre-shared key not valid hex\n"); goto exit; } psk_len = strlen( opt.psk ) / 2; for( j = 0; j < strlen( opt.psk ); j += 2 ) { c = opt.psk[j]; if( c >= '0' && c <= '9' ) c -= '0'; else if( c >= 'a' && c <= 'f' ) c -= 'a' - 10; else if( c >= 'A' && c <= 'F' ) c -= 'A' - 10; else { polarssl_printf("pre-shared key not valid hex\n"); goto exit; } psk[ j / 2 ] = c << 4; c = opt.psk[j + 1]; if( c >= '0' && c <= '9' ) c -= '0'; else if( c >= 'a' && c <= 'f' ) c -= 'a' - 10; else if( c >= 'A' && c <= 'F' ) c -= 'A' - 10; else { polarssl_printf("pre-shared key not valid hex\n"); goto exit; } psk[ j / 2 ] |= c; } } #endif /* POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED */ #if defined(POLARSSL_SSL_ALPN) if( opt.alpn_string != NULL ) { p = (char *) opt.alpn_string; i = 0; /* Leave room for a final NULL in alpn_list */ while( i < (int) sizeof alpn_list - 1 && *p != '\0' ) { alpn_list[i++] = p; /* Terminate the current string and move on to next one */ while( *p != ',' && *p != '\0' ) p++; if( *p == ',' ) *p++ = '\0'; } } #endif /* POLARSSL_SSL_ALPN */ /* * 0. Initialize the RNG and the session data */ polarssl_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { polarssl_printf( " failed\n ! ctr_drbg_init returned -0x%x\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); #if defined(POLARSSL_X509_CRT_PARSE_C) /* * 1.1. Load the trusted CA */ polarssl_printf( " . Loading the CA root certificate ..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.ca_path ) ) if( strcmp( opt.ca_path, "none" ) == 0 ) ret = 0; else ret = x509_crt_parse_path( &cacert, opt.ca_path ); else if( strlen( opt.ca_file ) ) if( strcmp( opt.ca_file, "none" ) == 0 ) ret = 0; else ret = x509_crt_parse_file( &cacert, opt.ca_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509_crt_parse( &cacert, (const unsigned char *) test_ca_list, strlen( test_ca_list ) ); #else { ret = 1; polarssl_printf("POLARSSL_CERTS_C not defined."); } #endif if( ret < 0 ) { polarssl_printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok (%d skipped)\n", ret ); /* * 1.2. Load own certificate and private key * * (can be skipped if client authentication is not required) */ polarssl_printf( " . Loading the client cert. and key..." ); fflush( stdout ); #if defined(POLARSSL_FS_IO) if( strlen( opt.crt_file ) ) if( strcmp( opt.crt_file, "none" ) == 0 ) ret = 0; else ret = x509_crt_parse_file( &clicert, opt.crt_file ); else #endif #if defined(POLARSSL_CERTS_C) ret = x509_crt_parse( &clicert, (const unsigned char *) test_cli_crt, strlen( test_cli_crt ) ); #else { ret = 1; polarssl_printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { polarssl_printf( " failed\n ! x509_crt_parse returned -0x%x\n\n", -ret ); goto exit; } #if defined(POLARSSL_FS_IO) if( strlen( opt.key_file ) ) if( strcmp( opt.key_file, "none" ) == 0 ) ret = 0; else ret = pk_parse_keyfile( &pkey, opt.key_file, "" ); else #endif #if defined(POLARSSL_CERTS_C) ret = pk_parse_key( &pkey, (const unsigned char *) test_cli_key, strlen( test_cli_key ), NULL, 0 ); #else { ret = 1; polarssl_printf("POLARSSL_CERTS_C not defined."); } #endif if( ret != 0 ) { polarssl_printf( " failed\n ! pk_parse_key returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); #endif /* POLARSSL_X509_CRT_PARSE_C */ /* * 2. Start the connection */ if( opt.server_addr == NULL) opt.server_addr = opt.server_name; polarssl_printf( " . Connecting to tcp/%s/%-4d...", opt.server_addr, opt.server_port ); fflush( stdout ); if( ( ret = net_connect( &server_fd, opt.server_addr, opt.server_port ) ) != 0 ) { polarssl_printf( " failed\n ! net_connect returned -0x%x\n\n", -ret ); goto exit; } if( opt.nbio > 0 ) ret = net_set_nonblock( server_fd ); else ret = net_set_block( server_fd ); if( ret != 0 ) { polarssl_printf( " failed\n ! net_set_(non)block() returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); /* * 3. Setup stuff */ polarssl_printf( " . Setting up the SSL/TLS structure..." ); fflush( stdout ); if( ( ret = ssl_init( &ssl ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_init returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); #if defined(POLARSSL_X509_CRT_PARSE_C) if( opt.debug_level > 0 ) ssl_set_verify( &ssl, my_verify, NULL ); #endif ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_authmode( &ssl, opt.auth_mode ); #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH) if( ( ret = ssl_set_max_frag_len( &ssl, opt.mfl_code ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_max_frag_len returned %d\n\n", ret ); goto exit; } #endif #if defined(POLARSSL_SSL_TRUNCATED_HMAC) if( opt.trunc_hmac != DFL_TRUNC_HMAC ) ssl_set_truncated_hmac( &ssl, opt.trunc_hmac ); #endif #if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET) if( opt.extended_ms != DFL_EXTENDED_MS ) ssl_set_extended_master_secret( &ssl, opt.extended_ms ); #endif #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC) if( opt.etm != DFL_ETM ) ssl_set_encrypt_then_mac( &ssl, opt.etm ); #endif #if defined(POLARSSL_SSL_CBC_RECORD_SPLITTING) if( opt.recsplit != DFL_RECSPLIT ) ssl_set_cbc_record_splitting( &ssl, opt.recsplit ? SSL_CBC_RECORD_SPLITTING_ENABLED : SSL_CBC_RECORD_SPLITTING_DISABLED ); #endif #if defined(POLARSSL_SSL_ALPN) if( opt.alpn_string != NULL ) if( ( ret = ssl_set_alpn_protocols( &ssl, alpn_list ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_alpn_protocols returned %d\n\n", ret ); goto exit; } #endif ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); if( opt.nbio == 2 ) ssl_set_bio( &ssl, my_recv, &server_fd, my_send, &server_fd ); else ssl_set_bio( &ssl, net_recv, &server_fd, net_send, &server_fd ); #if defined(POLARSSL_SSL_SESSION_TICKETS) if( ( ret = ssl_set_session_tickets( &ssl, opt.tickets ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_session_tickets returned %d\n\n", ret ); goto exit; } #endif /* RC4 setting is redundant if we use only one ciphersuite */ if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER ) ssl_set_ciphersuites( &ssl, opt.force_ciphersuite ); else ssl_set_arc4_support( &ssl, opt.arc4 ); if( opt.allow_legacy != DFL_ALLOW_LEGACY ) ssl_legacy_renegotiation( &ssl, opt.allow_legacy ); #if defined(POLARSSL_SSL_RENEGOTIATION) ssl_set_renegotiation( &ssl, opt.renegotiation ); #endif #if defined(POLARSSL_X509_CRT_PARSE_C) if( strcmp( opt.ca_path, "none" ) != 0 && strcmp( opt.ca_file, "none" ) != 0 ) { ssl_set_ca_chain( &ssl, &cacert, NULL, opt.server_name ); } if( strcmp( opt.crt_file, "none" ) != 0 && strcmp( opt.key_file, "none" ) != 0 ) { if( ( ret = ssl_set_own_cert( &ssl, &clicert, &pkey ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_own_cert returned %d\n\n", ret ); goto exit; } } #endif #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED) if( ( ret = ssl_set_psk( &ssl, psk, psk_len, (const unsigned char *) opt.psk_identity, strlen( opt.psk_identity ) ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_psk returned %d\n\n", ret ); goto exit; } #endif #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION) if( ( ret = ssl_set_hostname( &ssl, opt.server_name ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_hostname returned %d\n\n", ret ); goto exit; } #endif if( opt.min_version != -1 ) ssl_set_min_version( &ssl, SSL_MAJOR_VERSION_3, opt.min_version ); if( opt.max_version != -1 ) ssl_set_max_version( &ssl, SSL_MAJOR_VERSION_3, opt.max_version ); #if defined(POLARSSL_SSL_FALLBACK_SCSV) if( opt.fallback != DFL_FALLBACK ) ssl_set_fallback( &ssl, opt.fallback ); #endif /* * 4. Handshake */ polarssl_printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { polarssl_printf( " failed\n ! ssl_handshake returned -0x%x\n", -ret ); if( ret == POLARSSL_ERR_X509_CERT_VERIFY_FAILED ) polarssl_printf( " Unable to verify the server's certificate. " "Either it is invalid,\n" " or you didn't set ca_file or ca_path " "to an appropriate value.\n" " Alternatively, you may want to use " "auth_mode=optional for testing purposes.\n" ); polarssl_printf( "\n" ); goto exit; } } polarssl_printf( " ok\n [ Protocol is %s ]\n [ Ciphersuite is %s ]\n", ssl_get_version( &ssl ), ssl_get_ciphersuite( &ssl ) ); #if defined(POLARSSL_SSL_ALPN) if( opt.alpn_string != NULL ) { const char *alp = ssl_get_alpn_protocol( &ssl ); polarssl_printf( " [ Application Layer Protocol is %s ]\n", alp ? alp : "(none)" ); } #endif if( opt.reconnect != 0 ) { polarssl_printf(" . Saving session for reuse..." ); fflush( stdout ); if( ( ret = ssl_get_session( &ssl, &saved_session ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_get_session returned -0x%x\n\n", -ret ); goto exit; } polarssl_printf( " ok\n" ); } #if defined(POLARSSL_X509_CRT_PARSE_C) /* * 5. Verify the server certificate */ polarssl_printf( " . Verifying peer X.509 certificate..." ); if( ( ret = ssl_get_verify_result( &ssl ) ) != 0 ) { char vrfy_buf[512]; polarssl_printf( " failed\n" ); x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", ret ); polarssl_printf( "%s\n", vrfy_buf ); } else polarssl_printf( " ok\n" ); if( ssl_get_peer_cert( &ssl ) != NULL ) { polarssl_printf( " . Peer certificate information ...\n" ); x509_crt_info( (char *) buf, sizeof( buf ) - 1, " ", ssl_get_peer_cert( &ssl ) ); polarssl_printf( "%s\n", buf ); } #endif /* POLARSSL_X509_CRT_PARSE_C */ #if defined(POLARSSL_SSL_RENEGOTIATION) if( opt.renegotiate ) { /* * Perform renegotiation (this must be done when the server is waiting * for input from our side). */ polarssl_printf( " . Performing renegotiation..." ); fflush( stdout ); while( ( ret = ssl_renegotiate( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { polarssl_printf( " failed\n ! ssl_renegotiate returned %d\n\n", ret ); goto exit; } } polarssl_printf( " ok\n" ); } #endif /* POLARSSL_SSL_RENEGOTIATION */ /* * 6. Write the GET request */ send_request: polarssl_printf( " > Write to server:" ); fflush( stdout ); len = polarssl_snprintf( (char *) buf, sizeof(buf) - 1, GET_REQUEST, opt.request_page ); tail_len = strlen( GET_REQUEST_END ); /* Add padding to GET request to reach opt.request_size in length */ if( opt.request_size != DFL_REQUEST_SIZE && len + tail_len < opt.request_size ) { memset( buf + len, 'A', opt.request_size - len - tail_len ); len += opt.request_size - len - tail_len; } strncpy( (char *) buf + len, GET_REQUEST_END, sizeof(buf) - len - 1 ); len += tail_len; /* Truncate if request size is smaller than the "natural" size */ if( opt.request_size != DFL_REQUEST_SIZE && len > opt.request_size ) { len = opt.request_size; /* Still end with \r\n unless that's really not possible */ if( len >= 2 ) buf[len - 2] = '\r'; if( len >= 1 ) buf[len - 1] = '\n'; } for( written = 0, frags = 0; written < len; written += ret, frags++ ) { while( ( ret = ssl_write( &ssl, buf + written, len - written ) ) <= 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { polarssl_printf( " failed\n ! ssl_write returned -0x%x\n\n", -ret ); goto exit; } } } buf[written] = '\0'; polarssl_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf ); /* * 7. Read the HTTP response */ polarssl_printf( " < Read from server:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: polarssl_printf( " connection was closed gracefully\n" ); ret = 0; goto close_notify; case 0: case POLARSSL_ERR_NET_CONN_RESET: polarssl_printf( " connection was reset by peer\n" ); ret = 0; goto reconnect; default: polarssl_printf( " ssl_read returned -0x%x\n", -ret ); goto exit; } } len = ret; buf[len] = '\0'; polarssl_printf( " %d bytes read\n\n%s", len, (char *) buf ); /* End of message should be detected according to the syntax of the * application protocol (eg HTTP), just use a dummy test here. */ if( ret > 0 && buf[len-1] == '\n' ) { ret = 0; break; } } while( 1 ); /* * 7b. Continue doing data exchanges? */ if( --opt.exchanges > 0 ) goto send_request; /* * 8. Done, cleanly close the connection */ close_notify: polarssl_printf( " . Closing the connection..." ); /* No error checking, the connection might be closed already */ do ret = ssl_close_notify( &ssl ); while( ret == POLARSSL_ERR_NET_WANT_WRITE ); ret = 0; polarssl_printf( " done\n" ); /* * 9. Reconnect? */ reconnect: if( opt.reconnect != 0 ) { --opt.reconnect; net_close( server_fd ); #if defined(POLARSSL_TIMING_C) if( opt.reco_delay > 0 ) m_sleep( 1000 * opt.reco_delay ); #endif polarssl_printf( " . Reconnecting with saved session..." ); fflush( stdout ); if( ( ret = ssl_session_reset( &ssl ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_session_reset returned -0x%x\n\n", -ret ); goto exit; } if( ( ret = ssl_set_session( &ssl, &saved_session ) ) != 0 ) { polarssl_printf( " failed\n ! ssl_set_session returned %d\n\n", ret ); goto exit; } if( ( ret = net_connect( &server_fd, opt.server_addr, opt.server_port ) ) != 0 ) { polarssl_printf( " failed\n ! net_connect returned -0x%x\n\n", -ret ); goto exit; } while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { polarssl_printf( " failed\n ! ssl_handshake returned -0x%x\n\n", -ret ); goto exit; } } polarssl_printf( " ok\n" ); goto send_request; } /* * Cleanup and exit */ exit: #ifdef POLARSSL_ERROR_C if( ret != 0 ) { char error_buf[100]; polarssl_strerror( ret, error_buf, 100 ); polarssl_printf("Last error was: -0x%X - %s\n\n", -ret, error_buf ); } #endif if( server_fd ) net_close( server_fd ); #if defined(POLARSSL_X509_CRT_PARSE_C) x509_crt_free( &clicert ); x509_crt_free( &cacert ); pk_free( &pkey ); #endif ssl_session_free( &saved_session ); ssl_free( &ssl ); ctr_drbg_free( &ctr_drbg ); entropy_free( &entropy ); #if defined(_WIN32) polarssl_printf( " + Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif // Shell can not handle large exit numbers -> 1 for errors if( ret < 0 ) ret = 1; return( ret ); }
int main( int argc, char *argv[] ) { int ret, len, cnt = 0, pid; int listen_fd; int client_fd; unsigned char buf[1024]; const char *pers = "ssl_fork_server"; entropy_context entropy; ctr_drbg_context ctr_drbg; ssl_context ssl; x509_cert srvcert; rsa_context rsa; ((void) argc); ((void) argv); signal( SIGCHLD, SIG_IGN ); /* * 0. Initial seeding of the RNG */ printf( "\n . Initial seeding of the random generator..." ); fflush( stdout ); entropy_init( &entropy ); if( ( ret = ctr_drbg_init( &ctr_drbg, entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { printf( " failed\n ! ctr_drbg_init returned %d\n", ret ); goto exit; } printf( " ok\n" ); /* * 1. Load the certificates and private RSA key */ printf( " . Loading the server cert. and key..." ); fflush( stdout ); memset( &srvcert, 0, sizeof( x509_cert ) ); /* * This demonstration program uses embedded test certificates. * Instead, you may want to use x509parse_crtfile() to read the * server and CA certificates, as well as x509parse_keyfile(). */ ret = x509parse_crt( &srvcert, (const unsigned char *) test_srv_crt, strlen( test_srv_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } ret = x509parse_crt( &srvcert, (const unsigned char *) test_ca_crt, strlen( test_ca_crt ) ); if( ret != 0 ) { printf( " failed\n ! x509parse_crt returned %d\n\n", ret ); goto exit; } rsa_init( &rsa, RSA_PKCS_V15, 0 ); ret = x509parse_key( &rsa, (const unsigned char *) test_srv_key, strlen( test_srv_key ), NULL, 0 ); if( ret != 0 ) { printf( " failed\n ! x509parse_key returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 2. Setup the listening TCP socket */ printf( " . Bind on https://localhost:4433/ ..." ); fflush( stdout ); if( ( ret = net_bind( &listen_fd, NULL, 4433 ) ) != 0 ) { printf( " failed\n ! net_bind returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); while( 1 ) { /* * 3. Wait until a client connects */ client_fd = -1; memset( &ssl, 0, sizeof( ssl ) ); printf( " . Waiting for a remote connection ..." ); fflush( stdout ); if( ( ret = net_accept( listen_fd, &client_fd, NULL ) ) != 0 ) { printf( " failed\n ! net_accept returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); /* * 3.5. Forking server thread */ pid = fork(); printf( " . Forking to handle connection ..." ); fflush( stdout ); if( pid < 0 ) { printf(" failed\n ! fork returned %d\n\n", pid ); goto exit; } printf( " ok\n" ); if( pid != 0 ) { if( ( ret = ctr_drbg_reseed( &ctr_drbg, (const unsigned char *) "parent", 6 ) ) != 0 ) { printf( " failed\n ! ctr_drbg_reseed returned %d\n", ret ); goto exit; } close( client_fd ); continue; } close( listen_fd ); /* * 4. Setup stuff */ printf( " . Setting up the SSL data...." ); fflush( stdout ); if( ( ret = ctr_drbg_reseed( &ctr_drbg, (const unsigned char *) "child", 5 ) ) != 0 ) { printf( " failed\n ! ctr_drbg_reseed returned %d\n", ret ); goto exit; } if( ( ret = ssl_init( &ssl ) ) != 0 ) { printf( " failed\n ! ssl_init returned %d\n\n", ret ); goto exit; } printf( " ok\n" ); ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_authmode( &ssl, SSL_VERIFY_NONE ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_bio( &ssl, net_recv, &client_fd, net_send, &client_fd ); ssl_set_ca_chain( &ssl, srvcert.next, NULL, NULL ); ssl_set_own_cert( &ssl, &srvcert, &rsa ); /* * 5. Handshake */ printf( " . Performing the SSL/TLS handshake..." ); fflush( stdout ); while( ( ret = ssl_handshake( &ssl ) ) != 0 ) { if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_handshake returned %d\n\n", ret ); goto exit; } } printf( " ok\n" ); /* * 6. Read the HTTP Request */ printf( " < Read from client:" ); fflush( stdout ); do { len = sizeof( buf ) - 1; memset( buf, 0, sizeof( buf ) ); ret = ssl_read( &ssl, buf, len ); if( ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE ) continue; if( ret <= 0 ) { switch( ret ) { case POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY: printf( " connection was closed gracefully\n" ); break; case POLARSSL_ERR_NET_CONN_RESET: printf( " connection was reset by peer\n" ); break; default: printf( " ssl_read returned %d\n", ret ); break; } break; } len = ret; printf( " %d bytes read\n\n%s", len, (char *) buf ); } while( 0 ); /* * 7. Write the 200 Response */ printf( " > Write to client:" ); fflush( stdout ); len = sprintf( (char *) buf, HTTP_RESPONSE, ssl_get_ciphersuite( &ssl ) ); while( cnt < 100 ) { while( ( ret = ssl_write( &ssl, buf, len ) ) <= 0 ) { if( ret == POLARSSL_ERR_NET_CONN_RESET ) { printf( " failed\n ! peer closed the connection\n\n" ); goto exit; } if( ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE ) { printf( " failed\n ! ssl_write returned %d\n\n", ret ); goto exit; } } len = ret; printf( " %d bytes written\n\n%s\n", len, (char *) buf ); m_sleep( 1000 ); } ssl_close_notify( &ssl ); goto exit; } exit: net_close( client_fd ); x509_free( &srvcert ); rsa_free( &rsa ); ssl_free( &ssl ); #if defined(_WIN32) printf( " Press Enter to exit this program.\n" ); fflush( stdout ); getchar(); #endif return( ret ); }
static int belle_sip_tls_channel_load_root_ca(belle_sip_tls_channel_t *obj, const char *path){ struct stat statbuf; if (stat(path,&statbuf)==0){ if (statbuf.st_mode & S_IFDIR){ #if POLARSSL_VERSION_NUMBER < 0x01030000 if (x509parse_crtpath(&obj->root_ca,path)<0){ #else if (x509_crt_parse_path(&obj->root_ca,path)<0){ #endif belle_sip_error("Failed to load root ca from directory %s",path); return -1; } }else{ #if POLARSSL_VERSION_NUMBER < 0x01030000 if (x509parse_crtfile(&obj->root_ca,path)<0){ #else if (x509_crt_parse_file(&obj->root_ca,path)<0){ #endif belle_sip_error("Failed to load root ca from file %s",path); return -1; } } return 0; } belle_sip_error("Could not load root ca from %s: %s",path,strerror(errno)); return -1; } #ifdef ENABLE_POLARSSL_LOGS /* * polarssl does a lot of logs, some with newline, some without. * We need to concatenate logs without new line until a new line is found. */ static void ssl_debug_to_belle_sip(void *context, int level, const char *str){ belle_sip_tls_channel_t *chan=(belle_sip_tls_channel_t*)context; int len=strlen(str); if (len>0 && (str[len-1]=='\n' || str[len-1]=='\r')){ /*eliminate the newline*/ char *tmp=belle_sip_strdup(str); tmp[len-1]=0; if (chan->cur_debug_msg){ belle_sip_message("ssl: %s%s",chan->cur_debug_msg,tmp); belle_sip_free(chan->cur_debug_msg); chan->cur_debug_msg=NULL; }else belle_sip_message("ssl: %s",tmp); belle_sip_free(tmp); }else{ if (chan->cur_debug_msg){ char *tmp=belle_sip_strdup_printf("%s%s",chan->cur_debug_msg,str); belle_sip_free(chan->cur_debug_msg); chan->cur_debug_msg=tmp; }else chan->cur_debug_msg=belle_sip_strdup(str); } } #endif belle_sip_channel_t * belle_sip_channel_new_tls(belle_sip_stack_t *stack, belle_tls_verify_policy_t *verify_ctx,const char *bindip, int localport, const char *peer_cname, const char *dest, int port){ belle_sip_tls_channel_t *obj=belle_sip_object_new(belle_sip_tls_channel_t); belle_sip_stream_channel_t* super=(belle_sip_stream_channel_t*)obj; belle_sip_stream_channel_init_client(super ,stack ,bindip,localport,peer_cname,dest,port); ssl_init(&obj->sslctx); #ifdef ENABLE_POLARSSL_LOGS ssl_set_dbg(&obj->sslctx,ssl_debug_to_belle_sip,obj); #endif ssl_set_endpoint(&obj->sslctx,SSL_IS_CLIENT); ssl_set_authmode(&obj->sslctx,SSL_VERIFY_REQUIRED); ssl_set_bio(&obj->sslctx,polarssl_read,obj,polarssl_write,obj); if (verify_ctx->root_ca && belle_sip_tls_channel_load_root_ca(obj,verify_ctx->root_ca)==0){ ssl_set_ca_chain(&obj->sslctx,&obj->root_ca,NULL,super->base.peer_cname ? super->base.peer_cname : super->base.peer_name ); } ssl_set_rng(&obj->sslctx,random_generator,NULL); ssl_set_verify(&obj->sslctx,belle_sip_ssl_verify,verify_ctx); obj->verify_ctx=(belle_tls_verify_policy_t*)belle_sip_object_ref(verify_ctx); return (belle_sip_channel_t*)obj; }