mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-12-27 15:15:35 +00:00
a08652233d
This is done to account for platforms, for which we want custom behavior upon the program termination, hence we call `mbedtls_exit()` instead of returning from `main()`. For the sake of consistency, introduces the modifications have been made to the test and utility examples as well. These, while less likely to be used in the low level environments, won't suffer from such a change.
437 lines
12 KiB
C
437 lines
12 KiB
C
/*
|
|
* Simple DTLS server demonstration program
|
|
*
|
|
* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
* not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*
|
|
* This file is part of mbed TLS (https://tls.mbed.org)
|
|
*/
|
|
|
|
#if !defined(MBEDTLS_CONFIG_FILE)
|
|
#include "mbedtls/config.h"
|
|
#else
|
|
#include MBEDTLS_CONFIG_FILE
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_PLATFORM_C)
|
|
#include "mbedtls/platform.h"
|
|
#else
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#define mbedtls_printf printf
|
|
#define mbedtls_fprintf fprintf
|
|
#define mbedtls_time_t time_t
|
|
#define mbedtls_exit exit
|
|
#endif
|
|
|
|
/* Uncomment out the following line to default to IPv4 and disable IPv6 */
|
|
//#define FORCE_IPV4
|
|
|
|
#ifdef FORCE_IPV4
|
|
#define BIND_IP "0.0.0.0" /* Forces IPv4 */
|
|
#else
|
|
#define BIND_IP "::"
|
|
#endif
|
|
|
|
#if !defined(MBEDTLS_SSL_SRV_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) || \
|
|
!defined(MBEDTLS_SSL_COOKIE_C) || !defined(MBEDTLS_NET_C) || \
|
|
!defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_CTR_DRBG_C) || \
|
|
!defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_RSA_C) || \
|
|
!defined(MBEDTLS_CERTS_C) || !defined(MBEDTLS_PEM_PARSE_C) || \
|
|
!defined(MBEDTLS_TIMING_C)
|
|
|
|
int main( void )
|
|
{
|
|
printf( "MBEDTLS_SSL_SRV_C and/or MBEDTLS_SSL_PROTO_DTLS and/or "
|
|
"MBEDTLS_SSL_COOKIE_C and/or MBEDTLS_NET_C and/or "
|
|
"MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C and/or "
|
|
"MBEDTLS_X509_CRT_PARSE_C and/or MBEDTLS_RSA_C and/or "
|
|
"MBEDTLS_CERTS_C and/or MBEDTLS_PEM_PARSE_C and/or "
|
|
"MBEDTLS_TIMING_C not defined.\n" );
|
|
mbedtls_exit( 0 );
|
|
}
|
|
#else
|
|
|
|
#if defined(_WIN32)
|
|
#include <windows.h>
|
|
#endif
|
|
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
|
|
#include "mbedtls/entropy.h"
|
|
#include "mbedtls/ctr_drbg.h"
|
|
#include "mbedtls/certs.h"
|
|
#include "mbedtls/x509.h"
|
|
#include "mbedtls/ssl.h"
|
|
#include "mbedtls/ssl_cookie.h"
|
|
#include "mbedtls/net_sockets.h"
|
|
#include "mbedtls/error.h"
|
|
#include "mbedtls/debug.h"
|
|
#include "mbedtls/timing.h"
|
|
|
|
#if defined(MBEDTLS_SSL_CACHE_C)
|
|
#include "mbedtls/ssl_cache.h"
|
|
#endif
|
|
|
|
#define READ_TIMEOUT_MS 10000 /* 5 seconds */
|
|
#define DEBUG_LEVEL 0
|
|
|
|
static void my_debug( void *ctx, int level,
|
|
const char *file, int line,
|
|
const char *str )
|
|
{
|
|
((void) level);
|
|
|
|
mbedtls_fprintf( (FILE *) ctx, "%s:%04d: %s", file, line, str );
|
|
fflush( (FILE *) ctx );
|
|
}
|
|
|
|
int main( void )
|
|
{
|
|
int ret, len;
|
|
mbedtls_net_context listen_fd, client_fd;
|
|
unsigned char buf[1024];
|
|
const char *pers = "dtls_server";
|
|
unsigned char client_ip[16] = { 0 };
|
|
size_t cliip_len;
|
|
mbedtls_ssl_cookie_ctx cookie_ctx;
|
|
|
|
mbedtls_entropy_context entropy;
|
|
mbedtls_ctr_drbg_context ctr_drbg;
|
|
mbedtls_ssl_context ssl;
|
|
mbedtls_ssl_config conf;
|
|
mbedtls_x509_crt srvcert;
|
|
mbedtls_pk_context pkey;
|
|
mbedtls_timing_delay_context timer;
|
|
#if defined(MBEDTLS_SSL_CACHE_C)
|
|
mbedtls_ssl_cache_context cache;
|
|
#endif
|
|
|
|
mbedtls_net_init( &listen_fd );
|
|
mbedtls_net_init( &client_fd );
|
|
mbedtls_ssl_init( &ssl );
|
|
mbedtls_ssl_config_init( &conf );
|
|
mbedtls_ssl_cookie_init( &cookie_ctx );
|
|
#if defined(MBEDTLS_SSL_CACHE_C)
|
|
mbedtls_ssl_cache_init( &cache );
|
|
#endif
|
|
mbedtls_x509_crt_init( &srvcert );
|
|
mbedtls_pk_init( &pkey );
|
|
mbedtls_entropy_init( &entropy );
|
|
mbedtls_ctr_drbg_init( &ctr_drbg );
|
|
|
|
#if defined(MBEDTLS_DEBUG_C)
|
|
mbedtls_debug_set_threshold( DEBUG_LEVEL );
|
|
#endif
|
|
|
|
/*
|
|
* 1. Load the certificates and private RSA key
|
|
*/
|
|
printf( "\n . Loading the server cert. and key..." );
|
|
fflush( stdout );
|
|
|
|
/*
|
|
* This demonstration program uses embedded test certificates.
|
|
* Instead, you may want to use mbedtls_x509_crt_parse_file() to read the
|
|
* server and CA certificates, as well as mbedtls_pk_parse_keyfile().
|
|
*/
|
|
ret = mbedtls_x509_crt_parse( &srvcert, (const unsigned char *) mbedtls_test_srv_crt,
|
|
mbedtls_test_srv_crt_len );
|
|
if( ret != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
ret = mbedtls_x509_crt_parse( &srvcert, (const unsigned char *) mbedtls_test_cas_pem,
|
|
mbedtls_test_cas_pem_len );
|
|
if( ret != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
ret = mbedtls_pk_parse_key( &pkey, (const unsigned char *) mbedtls_test_srv_key,
|
|
mbedtls_test_srv_key_len, NULL, 0 );
|
|
if( ret != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_pk_parse_key returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
printf( " ok\n" );
|
|
|
|
/*
|
|
* 2. Setup the "listening" UDP socket
|
|
*/
|
|
printf( " . Bind on udp/*/4433 ..." );
|
|
fflush( stdout );
|
|
|
|
if( ( ret = mbedtls_net_bind( &listen_fd, BIND_IP, "4433", MBEDTLS_NET_PROTO_UDP ) ) != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_net_bind returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
printf( " ok\n" );
|
|
|
|
/*
|
|
* 3. Seed the RNG
|
|
*/
|
|
printf( " . Seeding the random number generator..." );
|
|
fflush( stdout );
|
|
|
|
if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
|
|
(const unsigned char *) pers,
|
|
strlen( pers ) ) ) != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
printf( " ok\n" );
|
|
|
|
/*
|
|
* 4. Setup stuff
|
|
*/
|
|
printf( " . Setting up the DTLS data..." );
|
|
fflush( stdout );
|
|
|
|
if( ( ret = mbedtls_ssl_config_defaults( &conf,
|
|
MBEDTLS_SSL_IS_SERVER,
|
|
MBEDTLS_SSL_TRANSPORT_DATAGRAM,
|
|
MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
|
|
{
|
|
mbedtls_printf( " failed\n ! mbedtls_ssl_config_defaults returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
|
|
mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );
|
|
|
|
#if defined(MBEDTLS_SSL_CACHE_C)
|
|
mbedtls_ssl_conf_session_cache( &conf, &cache,
|
|
mbedtls_ssl_cache_get,
|
|
mbedtls_ssl_cache_set );
|
|
#endif
|
|
|
|
mbedtls_ssl_conf_ca_chain( &conf, srvcert.next, NULL );
|
|
if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &srvcert, &pkey ) ) != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
if( ( ret = mbedtls_ssl_cookie_setup( &cookie_ctx,
|
|
mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_ssl_cookie_setup returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
mbedtls_ssl_conf_dtls_cookies( &conf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check,
|
|
&cookie_ctx );
|
|
|
|
if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_ssl_setup returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
mbedtls_ssl_set_timer_cb( &ssl, &timer, mbedtls_timing_set_delay,
|
|
mbedtls_timing_get_delay );
|
|
|
|
printf( " ok\n" );
|
|
|
|
reset:
|
|
#ifdef MBEDTLS_ERROR_C
|
|
if( ret != 0 )
|
|
{
|
|
char error_buf[100];
|
|
mbedtls_strerror( ret, error_buf, 100 );
|
|
printf("Last error was: %d - %s\n\n", ret, error_buf );
|
|
}
|
|
#endif
|
|
|
|
mbedtls_net_free( &client_fd );
|
|
|
|
mbedtls_ssl_session_reset( &ssl );
|
|
|
|
/*
|
|
* 3. Wait until a client connects
|
|
*/
|
|
printf( " . Waiting for a remote connection ..." );
|
|
fflush( stdout );
|
|
|
|
if( ( ret = mbedtls_net_accept( &listen_fd, &client_fd,
|
|
client_ip, sizeof( client_ip ), &cliip_len ) ) != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_net_accept returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
/* For HelloVerifyRequest cookies */
|
|
if( ( ret = mbedtls_ssl_set_client_transport_id( &ssl,
|
|
client_ip, cliip_len ) ) != 0 )
|
|
{
|
|
printf( " failed\n ! "
|
|
"mbedtls_ssl_set_client_transport_id() returned -0x%x\n\n", -ret );
|
|
goto exit;
|
|
}
|
|
|
|
mbedtls_ssl_set_bio( &ssl, &client_fd,
|
|
mbedtls_net_send, mbedtls_net_recv, mbedtls_net_recv_timeout );
|
|
|
|
printf( " ok\n" );
|
|
|
|
/*
|
|
* 5. Handshake
|
|
*/
|
|
printf( " . Performing the DTLS handshake..." );
|
|
fflush( stdout );
|
|
|
|
do ret = mbedtls_ssl_handshake( &ssl );
|
|
while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
|
|
ret == MBEDTLS_ERR_SSL_WANT_WRITE );
|
|
|
|
if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
|
|
{
|
|
printf( " hello verification requested\n" );
|
|
ret = 0;
|
|
goto reset;
|
|
}
|
|
else if( ret != 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret );
|
|
goto reset;
|
|
}
|
|
|
|
printf( " ok\n" );
|
|
|
|
/*
|
|
* 6. Read the echo Request
|
|
*/
|
|
printf( " < Read from client:" );
|
|
fflush( stdout );
|
|
|
|
len = sizeof( buf ) - 1;
|
|
memset( buf, 0, sizeof( buf ) );
|
|
|
|
do ret = mbedtls_ssl_read( &ssl, buf, len );
|
|
while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
|
|
ret == MBEDTLS_ERR_SSL_WANT_WRITE );
|
|
|
|
if( ret <= 0 )
|
|
{
|
|
switch( ret )
|
|
{
|
|
case MBEDTLS_ERR_SSL_TIMEOUT:
|
|
printf( " timeout\n\n" );
|
|
goto reset;
|
|
|
|
case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
|
|
printf( " connection was closed gracefully\n" );
|
|
ret = 0;
|
|
goto close_notify;
|
|
|
|
default:
|
|
printf( " mbedtls_ssl_read returned -0x%x\n\n", -ret );
|
|
goto reset;
|
|
}
|
|
}
|
|
|
|
len = ret;
|
|
printf( " %d bytes read\n\n%s\n\n", len, buf );
|
|
|
|
/*
|
|
* 7. Write the 200 Response
|
|
*/
|
|
printf( " > Write to client:" );
|
|
fflush( stdout );
|
|
|
|
do ret = mbedtls_ssl_write( &ssl, buf, len );
|
|
while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
|
|
ret == MBEDTLS_ERR_SSL_WANT_WRITE );
|
|
|
|
if( ret < 0 )
|
|
{
|
|
printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret );
|
|
goto exit;
|
|
}
|
|
|
|
len = ret;
|
|
printf( " %d bytes written\n\n%s\n\n", len, buf );
|
|
|
|
/*
|
|
* 8. Done, cleanly close the connection
|
|
*/
|
|
close_notify:
|
|
printf( " . Closing the connection..." );
|
|
|
|
/* No error checking, the connection might be closed already */
|
|
do ret = mbedtls_ssl_close_notify( &ssl );
|
|
while( ret == MBEDTLS_ERR_SSL_WANT_WRITE );
|
|
ret = 0;
|
|
|
|
printf( " done\n" );
|
|
|
|
goto reset;
|
|
|
|
/*
|
|
* Final clean-ups and exit
|
|
*/
|
|
exit:
|
|
|
|
#ifdef MBEDTLS_ERROR_C
|
|
if( ret != 0 )
|
|
{
|
|
char error_buf[100];
|
|
mbedtls_strerror( ret, error_buf, 100 );
|
|
printf( "Last error was: %d - %s\n\n", ret, error_buf );
|
|
}
|
|
#endif
|
|
|
|
mbedtls_net_free( &client_fd );
|
|
mbedtls_net_free( &listen_fd );
|
|
|
|
mbedtls_x509_crt_free( &srvcert );
|
|
mbedtls_pk_free( &pkey );
|
|
mbedtls_ssl_free( &ssl );
|
|
mbedtls_ssl_config_free( &conf );
|
|
mbedtls_ssl_cookie_free( &cookie_ctx );
|
|
#if defined(MBEDTLS_SSL_CACHE_C)
|
|
mbedtls_ssl_cache_free( &cache );
|
|
#endif
|
|
mbedtls_ctr_drbg_free( &ctr_drbg );
|
|
mbedtls_entropy_free( &entropy );
|
|
|
|
#if defined(_WIN32)
|
|
printf( " Press Enter to exit this program.\n" );
|
|
fflush( stdout ); getchar();
|
|
#endif
|
|
|
|
/* Shell can not handle large exit numbers -> 1 for errors */
|
|
if( ret < 0 )
|
|
ret = 1;
|
|
|
|
mbedtls_exit( ret );
|
|
}
|
|
#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_DTLS &&
|
|
MBEDTLS_SSL_COOKIE_C && MBEDTLS_NET_C && MBEDTLS_ENTROPY_C &&
|
|
MBEDTLS_CTR_DRBG_C && MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_RSA_C
|
|
&& MBEDTLS_CERTS_C && MBEDTLS_PEM_PARSE_C && MBEDTLS_TIMING_C */
|