diff options
Diffstat (limited to 'programs/ssl/dtls_server.c')
| -rw-r--r-- | programs/ssl/dtls_server.c | 408 |
1 files changed, 408 insertions, 0 deletions
diff --git a/programs/ssl/dtls_server.c b/programs/ssl/dtls_server.c new file mode 100644 index 00000000000..732625e7fbc --- /dev/null +++ b/programs/ssl/dtls_server.c @@ -0,0 +1,408 @@ +/* + * Simple DTLS server demonstration program + * + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#include "mbedtls/build_info.h" + +#include "mbedtls/platform.h" + +/* Uncomment out the following line to default to IPv4 and disable IPv6 */ +//#define FORCE_IPV4 + +#ifdef FORCE_IPV4 +#define BIND_IP "0.0.0.0" /* Forces IPv4 */ +#else +#define BIND_IP "::" +#endif + +#if !defined(MBEDTLS_SSL_SRV_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) || \ + !defined(MBEDTLS_SSL_COOKIE_C) || !defined(MBEDTLS_NET_C) || \ + !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_CTR_DRBG_C) || \ + !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_RSA_C) || \ + !defined(MBEDTLS_PEM_PARSE_C) || !defined(MBEDTLS_TIMING_C) + +int main(void) +{ + printf("MBEDTLS_SSL_SRV_C and/or MBEDTLS_SSL_PROTO_DTLS and/or " + "MBEDTLS_SSL_COOKIE_C and/or MBEDTLS_NET_C and/or " + "MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C and/or " + "MBEDTLS_X509_CRT_PARSE_C and/or MBEDTLS_RSA_C and/or " + "MBEDTLS_PEM_PARSE_C and/or MBEDTLS_TIMING_C not defined.\n"); + mbedtls_exit(0); +} +#else + +#if defined(_WIN32) +#include <windows.h> +#endif + +#include <string.h> +#include <stdlib.h> +#include <stdio.h> + +#include "mbedtls/entropy.h" +#include "mbedtls/ctr_drbg.h" +#include "mbedtls/x509.h" +#include "mbedtls/ssl.h" +#include "mbedtls/ssl_cookie.h" +#include "mbedtls/net_sockets.h" +#include "mbedtls/error.h" +#include "mbedtls/debug.h" +#include "mbedtls/timing.h" + +#include "test/certs.h" + +#if defined(MBEDTLS_SSL_CACHE_C) +#include "mbedtls/ssl_cache.h" +#endif + +#define READ_TIMEOUT_MS 10000 /* 10 seconds */ +#define DEBUG_LEVEL 0 + + +static void my_debug(void *ctx, int level, + const char *file, int line, + const char *str) +{ + ((void) level); + + mbedtls_fprintf((FILE *) ctx, "%s:%04d: %s", file, line, str); + fflush((FILE *) ctx); +} + +int main(void) +{ + int ret, len; + mbedtls_net_context listen_fd, client_fd; + unsigned char buf[1024]; + const char *pers = "dtls_server"; + unsigned char client_ip[16] = { 0 }; + size_t cliip_len; + mbedtls_ssl_cookie_ctx cookie_ctx; + + mbedtls_entropy_context entropy; + mbedtls_ctr_drbg_context ctr_drbg; + mbedtls_ssl_context ssl; + mbedtls_ssl_config conf; + mbedtls_x509_crt srvcert; + mbedtls_pk_context pkey; + mbedtls_timing_delay_context timer; +#if defined(MBEDTLS_SSL_CACHE_C) + mbedtls_ssl_cache_context cache; +#endif + + mbedtls_net_init(&listen_fd); + mbedtls_net_init(&client_fd); + mbedtls_ssl_init(&ssl); + mbedtls_ssl_config_init(&conf); + mbedtls_ssl_cookie_init(&cookie_ctx); +#if defined(MBEDTLS_SSL_CACHE_C) + mbedtls_ssl_cache_init(&cache); +#endif + mbedtls_x509_crt_init(&srvcert); + mbedtls_pk_init(&pkey); + mbedtls_entropy_init(&entropy); + mbedtls_ctr_drbg_init(&ctr_drbg); + +#if defined(MBEDTLS_USE_PSA_CRYPTO) + psa_status_t status = psa_crypto_init(); + if (status != PSA_SUCCESS) { + mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n", + (int) status); + ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; + goto exit; + } +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + +#if defined(MBEDTLS_DEBUG_C) + mbedtls_debug_set_threshold(DEBUG_LEVEL); +#endif + + /* + * 1. Seed the RNG + */ + printf(" . Seeding the random number generator..."); + fflush(stdout); + + if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, + (const unsigned char *) pers, + strlen(pers))) != 0) { + printf(" failed\n ! mbedtls_ctr_drbg_seed returned %d\n", ret); + goto exit; + } + + printf(" ok\n"); + + /* + * 2. Load the certificates and private RSA key + */ + printf("\n . Loading the server cert. and key..."); + fflush(stdout); + + /* + * This demonstration program uses embedded test certificates. + * Instead, you may want to use mbedtls_x509_crt_parse_file() to read the + * server and CA certificates, as well as mbedtls_pk_parse_keyfile(). + */ + ret = mbedtls_x509_crt_parse(&srvcert, (const unsigned char *) mbedtls_test_srv_crt, + mbedtls_test_srv_crt_len); + if (ret != 0) { + printf(" failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret); + goto exit; + } + + ret = mbedtls_x509_crt_parse(&srvcert, (const unsigned char *) mbedtls_test_cas_pem, + mbedtls_test_cas_pem_len); + if (ret != 0) { + printf(" failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret); + goto exit; + } + + ret = mbedtls_pk_parse_key(&pkey, + (const unsigned char *) mbedtls_test_srv_key, + mbedtls_test_srv_key_len, + NULL, + 0, + mbedtls_ctr_drbg_random, + &ctr_drbg); + if (ret != 0) { + printf(" failed\n ! mbedtls_pk_parse_key returned %d\n\n", ret); + goto exit; + } + + printf(" ok\n"); + + /* + * 3. Setup the "listening" UDP socket + */ + printf(" . Bind on udp/*/4433 ..."); + fflush(stdout); + + if ((ret = mbedtls_net_bind(&listen_fd, BIND_IP, "4433", MBEDTLS_NET_PROTO_UDP)) != 0) { + printf(" failed\n ! mbedtls_net_bind returned %d\n\n", ret); + goto exit; + } + + printf(" ok\n"); + + /* + * 4. Setup stuff + */ + printf(" . Setting up the DTLS data..."); + fflush(stdout); + + if ((ret = mbedtls_ssl_config_defaults(&conf, + MBEDTLS_SSL_IS_SERVER, + MBEDTLS_SSL_TRANSPORT_DATAGRAM, + MBEDTLS_SSL_PRESET_DEFAULT)) != 0) { + mbedtls_printf(" failed\n ! mbedtls_ssl_config_defaults returned %d\n\n", ret); + goto exit; + } + + mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg); + mbedtls_ssl_conf_dbg(&conf, my_debug, stdout); + mbedtls_ssl_conf_read_timeout(&conf, READ_TIMEOUT_MS); + +#if defined(MBEDTLS_SSL_CACHE_C) + mbedtls_ssl_conf_session_cache(&conf, &cache, + mbedtls_ssl_cache_get, + mbedtls_ssl_cache_set); +#endif + + mbedtls_ssl_conf_ca_chain(&conf, srvcert.next, NULL); + if ((ret = mbedtls_ssl_conf_own_cert(&conf, &srvcert, &pkey)) != 0) { + printf(" failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret); + goto exit; + } + + if ((ret = mbedtls_ssl_cookie_setup(&cookie_ctx, + mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) { + printf(" failed\n ! mbedtls_ssl_cookie_setup returned %d\n\n", ret); + goto exit; + } + + mbedtls_ssl_conf_dtls_cookies(&conf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, + &cookie_ctx); + + if ((ret = mbedtls_ssl_setup(&ssl, &conf)) != 0) { + printf(" failed\n ! mbedtls_ssl_setup returned %d\n\n", ret); + goto exit; + } + + mbedtls_ssl_set_timer_cb(&ssl, &timer, mbedtls_timing_set_delay, + mbedtls_timing_get_delay); + + printf(" ok\n"); + +reset: +#ifdef MBEDTLS_ERROR_C + if (ret != 0) { + char error_buf[100]; + mbedtls_strerror(ret, error_buf, 100); + printf("Last error was: %d - %s\n\n", ret, error_buf); + } +#endif + + mbedtls_net_free(&client_fd); + + mbedtls_ssl_session_reset(&ssl); + + /* + * 5. Wait until a client connects + */ + printf(" . Waiting for a remote connection ..."); + fflush(stdout); + + if ((ret = mbedtls_net_accept(&listen_fd, &client_fd, + client_ip, sizeof(client_ip), &cliip_len)) != 0) { + printf(" failed\n ! mbedtls_net_accept returned %d\n\n", ret); + goto exit; + } + + /* For HelloVerifyRequest cookies */ + if ((ret = mbedtls_ssl_set_client_transport_id(&ssl, + client_ip, cliip_len)) != 0) { + printf(" failed\n ! " + "mbedtls_ssl_set_client_transport_id() returned -0x%x\n\n", (unsigned int) -ret); + goto exit; + } + + mbedtls_ssl_set_bio(&ssl, &client_fd, + mbedtls_net_send, mbedtls_net_recv, mbedtls_net_recv_timeout); + + printf(" ok\n"); + + /* + * 6. Handshake + */ + printf(" . Performing the DTLS handshake..."); + fflush(stdout); + + do { + ret = mbedtls_ssl_handshake(&ssl); + } while (ret == MBEDTLS_ERR_SSL_WANT_READ || + ret == MBEDTLS_ERR_SSL_WANT_WRITE); + + if (ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED) { + printf(" hello verification requested\n"); + ret = 0; + goto reset; + } else if (ret != 0) { + printf(" failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", (unsigned int) -ret); + goto reset; + } + + printf(" ok\n"); + + /* + * 7. Read the echo Request + */ + printf(" < Read from client:"); + fflush(stdout); + + len = sizeof(buf) - 1; + memset(buf, 0, sizeof(buf)); + + do { + ret = mbedtls_ssl_read(&ssl, buf, len); + } while (ret == MBEDTLS_ERR_SSL_WANT_READ || + ret == MBEDTLS_ERR_SSL_WANT_WRITE); + + if (ret <= 0) { + switch (ret) { + case MBEDTLS_ERR_SSL_TIMEOUT: + printf(" timeout\n\n"); + goto reset; + + case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: + printf(" connection was closed gracefully\n"); + goto close_notify; + + default: + printf(" mbedtls_ssl_read returned -0x%x\n\n", (unsigned int) -ret); + goto reset; + } + } + + len = ret; + printf(" %d bytes read\n\n%s\n\n", len, buf); + + /* + * 8. Write the 200 Response + */ + printf(" > Write to client:"); + fflush(stdout); + + do { + ret = mbedtls_ssl_write(&ssl, buf, len); + } while (ret == MBEDTLS_ERR_SSL_WANT_READ || + ret == MBEDTLS_ERR_SSL_WANT_WRITE); + + if (ret < 0) { + printf(" failed\n ! mbedtls_ssl_write returned %d\n\n", ret); + goto exit; + } + + len = ret; + printf(" %d bytes written\n\n%s\n\n", len, buf); + + /* + * 9. Done, cleanly close the connection + */ +close_notify: + printf(" . Closing the connection..."); + + /* No error checking, the connection might be closed already */ + do { + ret = mbedtls_ssl_close_notify(&ssl); + } while (ret == MBEDTLS_ERR_SSL_WANT_WRITE); + ret = 0; + + printf(" done\n"); + + goto reset; + + /* + * Final clean-ups and exit + */ +exit: + +#ifdef MBEDTLS_ERROR_C + if (ret != 0) { + char error_buf[100]; + mbedtls_strerror(ret, error_buf, 100); + printf("Last error was: %d - %s\n\n", ret, error_buf); + } +#endif + + mbedtls_net_free(&client_fd); + mbedtls_net_free(&listen_fd); + + mbedtls_x509_crt_free(&srvcert); + mbedtls_pk_free(&pkey); + mbedtls_ssl_free(&ssl); + mbedtls_ssl_config_free(&conf); + mbedtls_ssl_cookie_free(&cookie_ctx); +#if defined(MBEDTLS_SSL_CACHE_C) + mbedtls_ssl_cache_free(&cache); +#endif + mbedtls_ctr_drbg_free(&ctr_drbg); + mbedtls_entropy_free(&entropy); +#if defined(MBEDTLS_USE_PSA_CRYPTO) + mbedtls_psa_crypto_free(); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ + + /* Shell can not handle large exit numbers -> 1 for errors */ + if (ret < 0) { + ret = 1; + } + + mbedtls_exit(ret); +} +#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_DTLS && + MBEDTLS_SSL_COOKIE_C && MBEDTLS_NET_C && MBEDTLS_ENTROPY_C && + MBEDTLS_CTR_DRBG_C && MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_RSA_C + && MBEDTLS_PEM_PARSE_C && MBEDTLS_TIMING_C */ |