ssl_fork_server.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424
  1. /*
  2. * SSL server demonstration program using fork() for handling multiple clients
  3. *
  4. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. *
  19. * This file is part of mbed TLS (https://tls.mbed.org)
  20. */
  21. #if !defined(MBEDTLS_CONFIG_FILE)
  22. #include "mbedtls/config.h"
  23. #else
  24. #include MBEDTLS_CONFIG_FILE
  25. #endif
  26. #if defined(MBEDTLS_PLATFORM_C)
  27. #include "mbedtls/platform.h"
  28. #else
  29. #include <stdio.h>
  30. #include <stdlib.h>
  31. #define mbedtls_fprintf fprintf
  32. #define mbedtls_printf printf
  33. #define mbedtls_time_t time_t
  34. #define mbedtls_exit exit
  35. #define MBEDTLS_EXIT_SUCCESS EXIT_SUCCESS
  36. #define MBEDTLS_EXIT_FAILURE EXIT_FAILURE
  37. #endif /* MBEDTLS_PLATFORM_C */
  38. #if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_CERTS_C) || \
  39. !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_SSL_TLS_C) || \
  40. !defined(MBEDTLS_SSL_SRV_C) || !defined(MBEDTLS_NET_C) || \
  41. !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_CTR_DRBG_C) || \
  42. !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_TIMING_C) || \
  43. !defined(MBEDTLS_FS_IO) || !defined(MBEDTLS_PEM_PARSE_C)
  44. int main( int argc, char *argv[] )
  45. {
  46. ((void) argc);
  47. ((void) argv);
  48. mbedtls_printf("MBEDTLS_BIGNUM_C and/or MBEDTLS_CERTS_C and/or MBEDTLS_ENTROPY_C "
  49. "and/or MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_SRV_C and/or "
  50. "MBEDTLS_NET_C and/or MBEDTLS_RSA_C and/or "
  51. "MBEDTLS_CTR_DRBG_C and/or MBEDTLS_X509_CRT_PARSE_C and/or "
  52. "MBEDTLS_TIMING_C and/or MBEDTLS_PEM_PARSE_C not defined.\n");
  53. return( 0 );
  54. }
  55. #elif defined(_WIN32)
  56. int main( void )
  57. {
  58. mbedtls_printf("_WIN32 defined. This application requires fork() and signals "
  59. "to work correctly.\n");
  60. return( 0 );
  61. }
  62. #else
  63. #include "mbedtls/entropy.h"
  64. #include "mbedtls/ctr_drbg.h"
  65. #include "mbedtls/certs.h"
  66. #include "mbedtls/x509.h"
  67. #include "mbedtls/ssl.h"
  68. #include "mbedtls/net_sockets.h"
  69. #include "mbedtls/timing.h"
  70. #include <string.h>
  71. #include <signal.h>
  72. #if !defined(_MSC_VER) || defined(EFIX64) || defined(EFI32)
  73. #include <unistd.h>
  74. #endif
  75. #define HTTP_RESPONSE \
  76. "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \
  77. "<h2>mbed TLS Test Server</h2>\r\n" \
  78. "<p>Successful connection using: %s</p>\r\n"
  79. #define DEBUG_LEVEL 0
  80. static void my_debug( void *ctx, int level,
  81. const char *file, int line,
  82. const char *str )
  83. {
  84. ((void) level);
  85. mbedtls_fprintf( (FILE *) ctx, "%s:%04d: %s", file, line, str );
  86. fflush( (FILE *) ctx );
  87. }
  88. int main( void )
  89. {
  90. int ret = 1, len, cnt = 0, pid;
  91. int exit_code = MBEDTLS_EXIT_FAILURE;
  92. mbedtls_net_context listen_fd, client_fd;
  93. unsigned char buf[1024];
  94. const char *pers = "ssl_fork_server";
  95. mbedtls_entropy_context entropy;
  96. mbedtls_ctr_drbg_context ctr_drbg;
  97. mbedtls_ssl_context ssl;
  98. mbedtls_ssl_config conf;
  99. mbedtls_x509_crt srvcert;
  100. mbedtls_pk_context pkey;
  101. mbedtls_net_init( &listen_fd );
  102. mbedtls_net_init( &client_fd );
  103. mbedtls_ssl_init( &ssl );
  104. mbedtls_ssl_config_init( &conf );
  105. mbedtls_entropy_init( &entropy );
  106. mbedtls_pk_init( &pkey );
  107. mbedtls_x509_crt_init( &srvcert );
  108. mbedtls_ctr_drbg_init( &ctr_drbg );
  109. signal( SIGCHLD, SIG_IGN );
  110. /*
  111. * 0. Initial seeding of the RNG
  112. */
  113. mbedtls_printf( "\n . Initial seeding of the random generator..." );
  114. fflush( stdout );
  115. if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
  116. (const unsigned char *) pers,
  117. strlen( pers ) ) ) != 0 )
  118. {
  119. mbedtls_printf( " failed! mbedtls_ctr_drbg_seed returned %d\n\n", ret );
  120. goto exit;
  121. }
  122. mbedtls_printf( " ok\n" );
  123. /*
  124. * 1. Load the certificates and private RSA key
  125. */
  126. mbedtls_printf( " . Loading the server cert. and key..." );
  127. fflush( stdout );
  128. /*
  129. * This demonstration program uses embedded test certificates.
  130. * Instead, you may want to use mbedtls_x509_crt_parse_file() to read the
  131. * server and CA certificates, as well as mbedtls_pk_parse_keyfile().
  132. */
  133. ret = mbedtls_x509_crt_parse( &srvcert, (const unsigned char *) mbedtls_test_srv_crt,
  134. mbedtls_test_srv_crt_len );
  135. if( ret != 0 )
  136. {
  137. mbedtls_printf( " failed! mbedtls_x509_crt_parse returned %d\n\n", ret );
  138. goto exit;
  139. }
  140. ret = mbedtls_x509_crt_parse( &srvcert, (const unsigned char *) mbedtls_test_cas_pem,
  141. mbedtls_test_cas_pem_len );
  142. if( ret != 0 )
  143. {
  144. mbedtls_printf( " failed! mbedtls_x509_crt_parse returned %d\n\n", ret );
  145. goto exit;
  146. }
  147. ret = mbedtls_pk_parse_key( &pkey, (const unsigned char *) mbedtls_test_srv_key,
  148. mbedtls_test_srv_key_len, NULL, 0 );
  149. if( ret != 0 )
  150. {
  151. mbedtls_printf( " failed! mbedtls_pk_parse_key returned %d\n\n", ret );
  152. goto exit;
  153. }
  154. mbedtls_printf( " ok\n" );
  155. /*
  156. * 1b. Prepare SSL configuration
  157. */
  158. mbedtls_printf( " . Configuring SSL..." );
  159. fflush( stdout );
  160. if( ( ret = mbedtls_ssl_config_defaults( &conf,
  161. MBEDTLS_SSL_IS_SERVER,
  162. MBEDTLS_SSL_TRANSPORT_STREAM,
  163. MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
  164. {
  165. mbedtls_printf( " failed! mbedtls_ssl_config_defaults returned %d\n\n", ret );
  166. goto exit;
  167. }
  168. mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
  169. mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );
  170. mbedtls_ssl_conf_ca_chain( &conf, srvcert.next, NULL );
  171. if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &srvcert, &pkey ) ) != 0 )
  172. {
  173. mbedtls_printf( " failed! mbedtls_ssl_conf_own_cert returned %d\n\n", ret );
  174. goto exit;
  175. }
  176. mbedtls_printf( " ok\n" );
  177. /*
  178. * 2. Setup the listening TCP socket
  179. */
  180. mbedtls_printf( " . Bind on https://localhost:4433/ ..." );
  181. fflush( stdout );
  182. if( ( ret = mbedtls_net_bind( &listen_fd, NULL, "4433", MBEDTLS_NET_PROTO_TCP ) ) != 0 )
  183. {
  184. mbedtls_printf( " failed! mbedtls_net_bind returned %d\n\n", ret );
  185. goto exit;
  186. }
  187. mbedtls_printf( " ok\n" );
  188. while( 1 )
  189. {
  190. /*
  191. * 3. Wait until a client connects
  192. */
  193. mbedtls_net_init( &client_fd );
  194. mbedtls_ssl_init( &ssl );
  195. mbedtls_printf( " . Waiting for a remote connection ...\n" );
  196. fflush( stdout );
  197. if( ( ret = mbedtls_net_accept( &listen_fd, &client_fd,
  198. NULL, 0, NULL ) ) != 0 )
  199. {
  200. mbedtls_printf( " failed! mbedtls_net_accept returned %d\n\n", ret );
  201. goto exit;
  202. }
  203. /*
  204. * 3.5. Forking server thread
  205. */
  206. mbedtls_printf( " . Forking to handle connection ..." );
  207. fflush( stdout );
  208. pid = fork();
  209. if( pid < 0 )
  210. {
  211. mbedtls_printf(" failed! fork returned %d\n\n", pid );
  212. goto exit;
  213. }
  214. if( pid != 0 )
  215. {
  216. mbedtls_printf( " ok\n" );
  217. if( ( ret = mbedtls_ctr_drbg_reseed( &ctr_drbg,
  218. (const unsigned char *) "parent",
  219. 6 ) ) != 0 )
  220. {
  221. mbedtls_printf( " failed! mbedtls_ctr_drbg_reseed returned %d\n\n", ret );
  222. goto exit;
  223. }
  224. continue;
  225. }
  226. mbedtls_net_init( &listen_fd );
  227. pid = getpid();
  228. /*
  229. * 4. Setup stuff
  230. */
  231. mbedtls_printf( "pid %d: Setting up the SSL data.\n", pid );
  232. fflush( stdout );
  233. if( ( ret = mbedtls_ctr_drbg_reseed( &ctr_drbg,
  234. (const unsigned char *) "child",
  235. 5 ) ) != 0 )
  236. {
  237. mbedtls_printf(
  238. "pid %d: SSL setup failed! mbedtls_ctr_drbg_reseed returned %d\n\n",
  239. pid, ret );
  240. goto exit;
  241. }
  242. if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
  243. {
  244. mbedtls_printf(
  245. "pid %d: SSL setup failed! mbedtls_ssl_setup returned %d\n\n",
  246. pid, ret );
  247. goto exit;
  248. }
  249. mbedtls_ssl_set_bio( &ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
  250. mbedtls_printf( "pid %d: SSL setup ok\n", pid );
  251. /*
  252. * 5. Handshake
  253. */
  254. mbedtls_printf( "pid %d: Performing the SSL/TLS handshake.\n", pid );
  255. fflush( stdout );
  256. while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
  257. {
  258. if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
  259. {
  260. mbedtls_printf(
  261. "pid %d: SSL handshake failed! mbedtls_ssl_handshake returned %d\n\n",
  262. pid, ret );
  263. goto exit;
  264. }
  265. }
  266. mbedtls_printf( "pid %d: SSL handshake ok\n", pid );
  267. /*
  268. * 6. Read the HTTP Request
  269. */
  270. mbedtls_printf( "pid %d: Start reading from client.\n", pid );
  271. fflush( stdout );
  272. do
  273. {
  274. len = sizeof( buf ) - 1;
  275. memset( buf, 0, sizeof( buf ) );
  276. ret = mbedtls_ssl_read( &ssl, buf, len );
  277. if( ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE )
  278. continue;
  279. if( ret <= 0 )
  280. {
  281. switch( ret )
  282. {
  283. case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
  284. mbedtls_printf( "pid %d: connection was closed gracefully\n", pid );
  285. break;
  286. case MBEDTLS_ERR_NET_CONN_RESET:
  287. mbedtls_printf( "pid %d: connection was reset by peer\n", pid );
  288. break;
  289. default:
  290. mbedtls_printf( "pid %d: mbedtls_ssl_read returned %d\n", pid, ret );
  291. break;
  292. }
  293. break;
  294. }
  295. len = ret;
  296. mbedtls_printf( "pid %d: %d bytes read\n\n%s", pid, len, (char *) buf );
  297. if( ret > 0 )
  298. break;
  299. }
  300. while( 1 );
  301. /*
  302. * 7. Write the 200 Response
  303. */
  304. mbedtls_printf( "pid %d: Start writing to client.\n", pid );
  305. fflush( stdout );
  306. len = sprintf( (char *) buf, HTTP_RESPONSE,
  307. mbedtls_ssl_get_ciphersuite( &ssl ) );
  308. while( cnt++ < 100 )
  309. {
  310. while( ( ret = mbedtls_ssl_write( &ssl, buf, len ) ) <= 0 )
  311. {
  312. if( ret == MBEDTLS_ERR_NET_CONN_RESET )
  313. {
  314. mbedtls_printf(
  315. "pid %d: Write failed! peer closed the connection\n\n", pid );
  316. goto exit;
  317. }
  318. if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
  319. {
  320. mbedtls_printf(
  321. "pid %d: Write failed! mbedtls_ssl_write returned %d\n\n",
  322. pid, ret );
  323. goto exit;
  324. }
  325. }
  326. len = ret;
  327. mbedtls_printf( "pid %d: %d bytes written\n\n%s\n", pid, len, (char *) buf );
  328. mbedtls_net_usleep( 1000000 );
  329. }
  330. mbedtls_ssl_close_notify( &ssl );
  331. goto exit;
  332. }
  333. exit_code = MBEDTLS_EXIT_SUCCESS;
  334. exit:
  335. mbedtls_net_free( &client_fd );
  336. mbedtls_net_free( &listen_fd );
  337. mbedtls_x509_crt_free( &srvcert );
  338. mbedtls_pk_free( &pkey );
  339. mbedtls_ssl_free( &ssl );
  340. mbedtls_ssl_config_free( &conf );
  341. mbedtls_ctr_drbg_free( &ctr_drbg );
  342. mbedtls_entropy_free( &entropy );
  343. #if defined(_WIN32)
  344. mbedtls_printf( " Press Enter to exit this program.\n" );
  345. fflush( stdout ); getchar();
  346. #endif
  347. return( exit_code );
  348. }
  349. #endif /* MBEDTLS_BIGNUM_C && MBEDTLS_CERTS_C && MBEDTLS_ENTROPY_C &&
  350. MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_SRV_C && MBEDTLS_NET_C &&
  351. MBEDTLS_RSA_C && MBEDTLS_CTR_DRBG_C && MBEDTLS_PEM_PARSE_C &&
  352. ! _WIN32 */