Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1 | /* |
| 2 | * SSL client with options |
| 3 | * |
Manuel Pégourié-Gonnard | 6fb8187 | 2015-07-27 11:11:48 +0200 | [diff] [blame] | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 18 | * |
Manuel Pégourié-Gonnard | fe44643 | 2015-03-06 13:17:10 +0000 | [diff] [blame] | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 20 | */ |
| 21 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 22 | #if !defined(MBEDTLS_CONFIG_FILE) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 23 | #include "mbedtls/config.h" |
Manuel Pégourié-Gonnard | cef4ad2 | 2014-04-29 12:39:06 +0200 | [diff] [blame] | 24 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 25 | #include MBEDTLS_CONFIG_FILE |
Manuel Pégourié-Gonnard | cef4ad2 | 2014-04-29 12:39:06 +0200 | [diff] [blame] | 26 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 27 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 28 | #if defined(MBEDTLS_PLATFORM_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 29 | #include "mbedtls/platform.h" |
Rich Evans | f90016a | 2015-01-19 14:26:37 +0000 | [diff] [blame] | 30 | #else |
Manuel Pégourié-Gonnard | 8a4d571 | 2014-06-24 14:19:59 +0200 | [diff] [blame] | 31 | #include <stdio.h> |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 32 | #define mbedtls_free free |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 33 | #define mbedtls_calloc calloc |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 34 | #define mbedtls_fprintf fprintf |
| 35 | #define mbedtls_printf printf |
Rich Evans | 18b78c7 | 2015-02-11 14:06:19 +0000 | [diff] [blame] | 36 | #endif |
Manuel Pégourié-Gonnard | 8a4d571 | 2014-06-24 14:19:59 +0200 | [diff] [blame] | 37 | |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 38 | #if !defined(MBEDTLS_ENTROPY_C) || \ |
| 39 | !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_SRV_C) || \ |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 40 | !defined(MBEDTLS_NET_C) || !defined(MBEDTLS_CTR_DRBG_C) |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 41 | int main( void ) |
| 42 | { |
| 43 | mbedtls_printf("MBEDTLS_ENTROPY_C and/or " |
| 44 | "MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_SRV_C and/or " |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 45 | "MBEDTLS_NET_C and/or MBEDTLS_CTR_DRBG_C and/or not defined.\n"); |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 46 | return( 0 ); |
| 47 | } |
| 48 | #else |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 49 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 50 | #include "mbedtls/net.h" |
| 51 | #include "mbedtls/ssl.h" |
| 52 | #include "mbedtls/entropy.h" |
| 53 | #include "mbedtls/ctr_drbg.h" |
| 54 | #include "mbedtls/certs.h" |
| 55 | #include "mbedtls/x509.h" |
| 56 | #include "mbedtls/error.h" |
| 57 | #include "mbedtls/debug.h" |
Manuel Pégourié-Gonnard | 56273da | 2015-05-26 12:19:45 +0200 | [diff] [blame] | 58 | #include "mbedtls/timing.h" |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 59 | |
Rich Evans | 18b78c7 | 2015-02-11 14:06:19 +0000 | [diff] [blame] | 60 | #include <stdio.h> |
| 61 | #include <stdlib.h> |
| 62 | #include <string.h> |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 63 | #include <stdint.h> |
Andres AG | 0ac1392 | 2017-02-08 14:05:57 +0000 | [diff] [blame] | 64 | |
| 65 | #if !defined(_MSC_VER) |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 66 | #include <inttypes.h> |
Andres AG | 0ac1392 | 2017-02-08 14:05:57 +0000 | [diff] [blame] | 67 | #endif |
Rich Evans | 18b78c7 | 2015-02-11 14:06:19 +0000 | [diff] [blame] | 68 | |
| 69 | #if !defined(_WIN32) |
| 70 | #include <signal.h> |
| 71 | #endif |
| 72 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 73 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 74 | #include "mbedtls/ssl_cache.h" |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 75 | #endif |
| 76 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 77 | #if defined(MBEDTLS_SSL_TICKET_C) |
| 78 | #include "mbedtls/ssl_ticket.h" |
| 79 | #endif |
| 80 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 81 | #if defined(MBEDTLS_SSL_COOKIE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 82 | #include "mbedtls/ssl_cookie.h" |
Manuel Pégourié-Gonnard | 232edd4 | 2014-07-23 16:56:27 +0200 | [diff] [blame] | 83 | #endif |
| 84 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 85 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 86 | #include "mbedtls/memory_buffer_alloc.h" |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 87 | #endif |
| 88 | |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 89 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_FS_IO) |
| 90 | #define SNI_OPTION |
| 91 | #endif |
| 92 | |
| 93 | #if defined(_WIN32) |
| 94 | #include <windows.h> |
| 95 | #endif |
| 96 | |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 97 | #define DFL_SERVER_ADDR NULL |
Manuel Pégourié-Gonnard | c0d7494 | 2015-06-23 12:30:57 +0200 | [diff] [blame] | 98 | #define DFL_SERVER_PORT "4433" |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 99 | #define DFL_DEBUG_LEVEL 0 |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 100 | #define DFL_NBIO 0 |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 101 | #define DFL_READ_TIMEOUT 0 |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 102 | #define DFL_CA_FILE "" |
| 103 | #define DFL_CA_PATH "" |
| 104 | #define DFL_CRT_FILE "" |
| 105 | #define DFL_KEY_FILE "" |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 106 | #define DFL_CRT_FILE2 "" |
| 107 | #define DFL_KEY_FILE2 "" |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 108 | #define DFL_PSK "" |
| 109 | #define DFL_PSK_IDENTITY "Client_identity" |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 110 | #define DFL_PSK_LIST NULL |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 111 | #define DFL_FORCE_CIPHER 0 |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 112 | #define DFL_VERSION_SUITES NULL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 113 | #define DFL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION_DISABLED |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 114 | #define DFL_ALLOW_LEGACY -2 |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 115 | #define DFL_RENEGOTIATE 0 |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 116 | #define DFL_RENEGO_DELAY -2 |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 117 | #define DFL_RENEGO_PERIOD ( (uint64_t)-1 ) |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 118 | #define DFL_EXCHANGES 1 |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 119 | #define DFL_MIN_VERSION -1 |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 120 | #define DFL_MAX_VERSION -1 |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 121 | #define DFL_ARC4 -1 |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 122 | #define DFL_SHA1 -1 |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 123 | #define DFL_AUTH_MODE -1 |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 124 | #define DFL_MFL_CODE MBEDTLS_SSL_MAX_FRAG_LEN_NONE |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 125 | #define DFL_TRUNC_HMAC -1 |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 126 | #define DFL_TICKETS MBEDTLS_SSL_SESSION_TICKETS_ENABLED |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 127 | #define DFL_TICKET_TIMEOUT 86400 |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 128 | #define DFL_CACHE_MAX -1 |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 129 | #define DFL_CACHE_TIMEOUT -1 |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 130 | #define DFL_SNI NULL |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 131 | #define DFL_ALPN_STRING NULL |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 132 | #define DFL_DHM_FILE NULL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 133 | #define DFL_TRANSPORT MBEDTLS_SSL_TRANSPORT_STREAM |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 134 | #define DFL_COOKIES 1 |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 135 | #define DFL_ANTI_REPLAY -1 |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 136 | #define DFL_HS_TO_MIN 0 |
| 137 | #define DFL_HS_TO_MAX 0 |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 138 | #define DFL_BADMAC_LIMIT -1 |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 139 | #define DFL_EXTENDED_MS -1 |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 140 | #define DFL_ETM -1 |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 141 | |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 142 | #define LONG_RESPONSE "<p>01-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 143 | "02-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 144 | "03-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 145 | "04-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 146 | "05-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 147 | "06-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 148 | "07-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah</p>\r\n" |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 149 | |
Paul Bakker | 8e714d7 | 2013-07-18 11:05:13 +0200 | [diff] [blame] | 150 | /* Uncomment LONG_RESPONSE at the end of HTTP_RESPONSE to test sending longer |
| 151 | * packets (for fragmentation purposes) */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 152 | #define HTTP_RESPONSE \ |
| 153 | "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \ |
Manuel Pégourié-Gonnard | 9169921 | 2015-01-22 16:26:39 +0000 | [diff] [blame] | 154 | "<h2>mbed TLS Test Server</h2>\r\n" \ |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 155 | "<p>Successful connection using: %s</p>\r\n" // LONG_RESPONSE |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 156 | |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 157 | /* |
| 158 | * Size of the basic I/O buffer. Able to hold our default response. |
| 159 | * |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 160 | * You will need to adapt the mbedtls_ssl_get_bytes_avail() test in ssl-opt.sh |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 161 | * if you change this value to something outside the range <= 100 or > 500 |
| 162 | */ |
Manuel Pégourié-Gonnard | e7a3b10 | 2014-06-11 18:21:20 +0200 | [diff] [blame] | 163 | #define IO_BUF_LEN 200 |
| 164 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 165 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 166 | #if defined(MBEDTLS_FS_IO) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 167 | #define USAGE_IO \ |
Paul Bakker | 1f9d02d | 2012-11-20 10:30:55 +0100 | [diff] [blame] | 168 | " ca_file=%%s The single file containing the top-level CA(s) you fully trust\n" \ |
| 169 | " default: \"\" (pre-loaded)\n" \ |
| 170 | " ca_path=%%s The path containing the top-level CA(s) you fully trust\n" \ |
| 171 | " default: \"\" (pre-loaded) (overrides ca_file)\n" \ |
| 172 | " crt_file=%%s Your own cert and chain (in bottom to top order, top may be omitted)\n" \ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 173 | " default: see note after key_file2\n" \ |
| 174 | " key_file=%%s default: see note after key_file2\n" \ |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 175 | " crt_file2=%%s Your second cert and chain (in bottom to top order, top may be omitted)\n" \ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 176 | " default: see note after key_file2\n" \ |
| 177 | " key_file2=%%s default: see note below\n" \ |
| 178 | " note: if neither crt_file/key_file nor crt_file2/key_file2 are used,\n" \ |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 179 | " preloaded certificate(s) and key(s) are used if available\n" \ |
| 180 | " dhm_file=%%s File containing Diffie-Hellman parameters\n" \ |
| 181 | " default: preloaded parameters\n" |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 182 | #else |
| 183 | #define USAGE_IO \ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 184 | "\n" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 185 | " No file operations available (MBEDTLS_FS_IO not defined)\n" \ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 186 | "\n" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 187 | #endif /* MBEDTLS_FS_IO */ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 188 | #else |
| 189 | #define USAGE_IO "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 190 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 191 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 192 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 193 | #define USAGE_PSK \ |
| 194 | " psk=%%s default: \"\" (in hex, without 0x)\n" \ |
| 195 | " psk_identity=%%s default: \"Client_identity\"\n" |
| 196 | #else |
| 197 | #define USAGE_PSK "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 198 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 199 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 200 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 201 | #define USAGE_TICKETS \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 202 | " tickets=%%d default: 1 (enabled)\n" \ |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 203 | " ticket_timeout=%%d default: 86400 (one day)\n" |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 204 | #else |
| 205 | #define USAGE_TICKETS "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 206 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 207 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 208 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 209 | #define USAGE_CACHE \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 210 | " cache_max=%%d default: cache default (50)\n" \ |
| 211 | " cache_timeout=%%d default: cache default (1d)\n" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 212 | #else |
| 213 | #define USAGE_CACHE "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 214 | #endif /* MBEDTLS_SSL_CACHE_C */ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 215 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 216 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 217 | #define USAGE_SNI \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 218 | " sni=%%s name1,cert1,key1,ca1,crl1,auth1[,...]\n" \ |
| 219 | " default: disabled\n" |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 220 | #else |
| 221 | #define USAGE_SNI "" |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 222 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 223 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 224 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 225 | #define USAGE_MAX_FRAG_LEN \ |
| 226 | " max_frag_len=%%d default: 16384 (tls default)\n" \ |
| 227 | " options: 512, 1024, 2048, 4096\n" |
| 228 | #else |
| 229 | #define USAGE_MAX_FRAG_LEN "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 230 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 231 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 232 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 233 | #define USAGE_TRUNC_HMAC \ |
| 234 | " trunc_hmac=%%d default: library default\n" |
| 235 | #else |
| 236 | #define USAGE_TRUNC_HMAC "" |
| 237 | #endif |
| 238 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 239 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 240 | #define USAGE_ALPN \ |
| 241 | " alpn=%%s default: \"\" (disabled)\n" \ |
| 242 | " example: spdy/1,http/1.1\n" |
| 243 | #else |
| 244 | #define USAGE_ALPN "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 245 | #endif /* MBEDTLS_SSL_ALPN */ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 246 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 247 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 248 | #define USAGE_COOKIES \ |
| 249 | " cookies=0/1/-1 default: 1 (enabled)\n" \ |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 250 | " 0: disabled, -1: library default (broken)\n" |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 251 | #else |
| 252 | #define USAGE_COOKIES "" |
| 253 | #endif |
| 254 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 255 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 256 | #define USAGE_ANTI_REPLAY \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 257 | " anti_replay=0/1 default: (library default: enabled)\n" |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 258 | #else |
| 259 | #define USAGE_ANTI_REPLAY "" |
| 260 | #endif |
| 261 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 262 | #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 263 | #define USAGE_BADMAC_LIMIT \ |
| 264 | " badmac_limit=%%d default: (library default: disabled)\n" |
| 265 | #else |
| 266 | #define USAGE_BADMAC_LIMIT "" |
| 267 | #endif |
| 268 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 269 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 270 | #define USAGE_DTLS \ |
| 271 | " dtls=%%d default: 0 (TLS)\n" \ |
| 272 | " hs_timeout=%%d-%%d default: (library default: 1000-60000)\n" \ |
| 273 | " range of DTLS handshake timeouts in millisecs\n" |
| 274 | #else |
| 275 | #define USAGE_DTLS "" |
| 276 | #endif |
| 277 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 278 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 279 | #define USAGE_EMS \ |
| 280 | " extended_ms=0/1 default: (library default: on)\n" |
| 281 | #else |
| 282 | #define USAGE_EMS "" |
| 283 | #endif |
| 284 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 285 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 286 | #define USAGE_ETM \ |
| 287 | " etm=0/1 default: (library default: on)\n" |
| 288 | #else |
| 289 | #define USAGE_ETM "" |
| 290 | #endif |
| 291 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 292 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 293 | #define USAGE_RENEGO \ |
| 294 | " renegotiation=%%d default: 0 (disabled)\n" \ |
| 295 | " renegotiate=%%d default: 0 (disabled)\n" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 296 | " renego_delay=%%d default: -2 (library default)\n" \ |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 297 | " renego_period=%%d default: (2^64 - 1 for TLS, 2^48 - 1 for DTLS)\n" |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 298 | #else |
| 299 | #define USAGE_RENEGO "" |
| 300 | #endif |
| 301 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 302 | #define USAGE \ |
| 303 | "\n usage: ssl_server2 param=<>...\n" \ |
| 304 | "\n acceptable parameters:\n" \ |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 305 | " server_addr=%%d default: (all interfaces)\n" \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 306 | " server_port=%%d default: 4433\n" \ |
| 307 | " debug_level=%%d default: 0 (disabled)\n" \ |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 308 | " nbio=%%d default: 0 (blocking I/O)\n" \ |
| 309 | " options: 1 (non-blocking), 2 (added delays)\n" \ |
Manuel Pégourié-Gonnard | 22311ae | 2015-09-09 11:22:58 +0200 | [diff] [blame] | 310 | " read_timeout=%%d default: 0 ms (no timeout)\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 311 | "\n" \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 312 | USAGE_DTLS \ |
| 313 | USAGE_COOKIES \ |
| 314 | USAGE_ANTI_REPLAY \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 315 | USAGE_BADMAC_LIMIT \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 316 | "\n" \ |
Manuel Pégourié-Gonnard | ee6139c | 2015-05-07 10:18:26 +0100 | [diff] [blame] | 317 | " auth_mode=%%s default: (library default: none)\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 318 | " options: none, optional, required\n" \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 319 | USAGE_IO \ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 320 | USAGE_SNI \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 321 | "\n" \ |
| 322 | USAGE_PSK \ |
| 323 | "\n" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 324 | " allow_legacy=%%d default: (library default: no)\n" \ |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 325 | USAGE_RENEGO \ |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 326 | " exchanges=%%d default: 1\n" \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 327 | "\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 328 | USAGE_TICKETS \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 329 | USAGE_CACHE \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 330 | USAGE_MAX_FRAG_LEN \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 331 | USAGE_TRUNC_HMAC \ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 332 | USAGE_ALPN \ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 333 | USAGE_EMS \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 334 | USAGE_ETM \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 335 | "\n" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 336 | " arc4=%%d default: (library default: 0)\n" \ |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 337 | " allow_sha1=%%d default: 0\n" \ |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 338 | " min_version=%%s default: (library default: tls1)\n" \ |
| 339 | " max_version=%%s default: (library default: tls1_2)\n" \ |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 340 | " force_version=%%s default: \"\" (none)\n" \ |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 341 | " options: ssl3, tls1, tls1_1, tls1_2, dtls1, dtls1_2\n" \ |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 342 | "\n" \ |
| 343 | " version_suites=a,b,c,d per-version ciphersuites\n" \ |
| 344 | " in order from ssl3 to tls1_2\n" \ |
| 345 | " default: all enabled\n" \ |
| 346 | " force_ciphersuite=<name> default: all enabled\n" \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 347 | " acceptable ciphersuite names:\n" |
| 348 | |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 349 | |
| 350 | #define PUT_UINT64_BE(out_be,in_le,i) \ |
| 351 | { \ |
| 352 | (out_be)[(i) + 0] = (unsigned char)( ( (in_le) >> 56 ) & 0xFF ); \ |
| 353 | (out_be)[(i) + 1] = (unsigned char)( ( (in_le) >> 48 ) & 0xFF ); \ |
| 354 | (out_be)[(i) + 2] = (unsigned char)( ( (in_le) >> 40 ) & 0xFF ); \ |
| 355 | (out_be)[(i) + 3] = (unsigned char)( ( (in_le) >> 32 ) & 0xFF ); \ |
| 356 | (out_be)[(i) + 4] = (unsigned char)( ( (in_le) >> 24 ) & 0xFF ); \ |
| 357 | (out_be)[(i) + 5] = (unsigned char)( ( (in_le) >> 16 ) & 0xFF ); \ |
| 358 | (out_be)[(i) + 6] = (unsigned char)( ( (in_le) >> 8 ) & 0xFF ); \ |
| 359 | (out_be)[(i) + 7] = (unsigned char)( ( (in_le) >> 0 ) & 0xFF ); \ |
| 360 | } |
| 361 | |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 362 | /* |
| 363 | * global options |
| 364 | */ |
| 365 | struct options |
| 366 | { |
| 367 | const char *server_addr; /* address on which the ssl service runs */ |
Manuel Pégourié-Gonnard | c0d7494 | 2015-06-23 12:30:57 +0200 | [diff] [blame] | 368 | const char *server_port; /* port on which the ssl service runs */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 369 | int debug_level; /* level of debugging */ |
| 370 | int nbio; /* should I/O be blocking? */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 371 | uint32_t read_timeout; /* timeout on mbedtls_ssl_read() in milliseconds */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 372 | const char *ca_file; /* the file with the CA certificate(s) */ |
| 373 | const char *ca_path; /* the path with the CA certificate(s) reside */ |
| 374 | const char *crt_file; /* the file with the server certificate */ |
| 375 | const char *key_file; /* the file with the server key */ |
| 376 | const char *crt_file2; /* the file with the 2nd server certificate */ |
| 377 | const char *key_file2; /* the file with the 2nd server key */ |
| 378 | const char *psk; /* the pre-shared key */ |
| 379 | const char *psk_identity; /* the pre-shared key identity */ |
| 380 | char *psk_list; /* list of PSK id/key pairs for callback */ |
| 381 | int force_ciphersuite[2]; /* protocol/ciphersuite to use, or all */ |
| 382 | const char *version_suites; /* per-version ciphersuites */ |
| 383 | int renegotiation; /* enable / disable renegotiation */ |
| 384 | int allow_legacy; /* allow legacy renegotiation */ |
| 385 | int renegotiate; /* attempt renegotiation? */ |
| 386 | int renego_delay; /* delay before enforcing renegotiation */ |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 387 | uint64_t renego_period; /* period for automatic renegotiation */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 388 | int exchanges; /* number of data exchanges */ |
| 389 | int min_version; /* minimum protocol version accepted */ |
| 390 | int max_version; /* maximum protocol version accepted */ |
| 391 | int arc4; /* flag for arc4 suites support */ |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 392 | int allow_sha1; /* flag for SHA-1 support */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 393 | int auth_mode; /* verify mode for connection */ |
| 394 | unsigned char mfl_code; /* code for maximum fragment length */ |
| 395 | int trunc_hmac; /* accept truncated hmac? */ |
| 396 | int tickets; /* enable / disable session tickets */ |
| 397 | int ticket_timeout; /* session ticket lifetime */ |
| 398 | int cache_max; /* max number of session cache entries */ |
| 399 | int cache_timeout; /* expiration delay of session cache entries */ |
| 400 | char *sni; /* string describing sni information */ |
| 401 | const char *alpn_string; /* ALPN supported protocols */ |
| 402 | const char *dhm_file; /* the file with the DH parameters */ |
| 403 | int extended_ms; /* allow negotiation of extended MS? */ |
| 404 | int etm; /* allow negotiation of encrypt-then-MAC? */ |
Manuel Pégourié-Gonnard | d901d17 | 2015-02-16 18:37:53 +0000 | [diff] [blame] | 405 | int transport; /* TLS or DTLS? */ |
| 406 | int cookies; /* Use cookies for DTLS? -1 to break them */ |
| 407 | int anti_replay; /* Use anti-replay for DTLS? -1 for default */ |
| 408 | uint32_t hs_to_min; /* Initial value of DTLS handshake timer */ |
| 409 | uint32_t hs_to_max; /* Max value of DTLS handshake timer */ |
| 410 | int badmac_limit; /* Limit of records with bad MAC */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 411 | } opt; |
| 412 | |
Manuel Pégourié-Gonnard | 61ee351 | 2015-06-23 17:35:03 +0200 | [diff] [blame] | 413 | static void my_debug( void *ctx, int level, |
| 414 | const char *file, int line, |
| 415 | const char *str ) |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 416 | { |
Manuel Pégourié-Gonnard | 052f288 | 2015-07-01 11:50:23 +0200 | [diff] [blame] | 417 | const char *p, *basename; |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 418 | |
Manuel Pégourié-Gonnard | 052f288 | 2015-07-01 11:50:23 +0200 | [diff] [blame] | 419 | /* Extract basename from file */ |
| 420 | for( p = basename = file; *p != '\0'; p++ ) |
| 421 | if( *p == '/' || *p == '\\' ) |
| 422 | basename = p + 1; |
| 423 | |
| 424 | mbedtls_fprintf( (FILE *) ctx, "%s:%04d: |%d| %s", basename, line, level, str ); |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 425 | fflush( (FILE *) ctx ); |
| 426 | } |
| 427 | |
| 428 | /* |
| 429 | * Test recv/send functions that make sure each try returns |
| 430 | * WANT_READ/WANT_WRITE at least once before sucesseding |
| 431 | */ |
| 432 | static int my_recv( void *ctx, unsigned char *buf, size_t len ) |
| 433 | { |
| 434 | static int first_try = 1; |
| 435 | int ret; |
| 436 | |
| 437 | if( first_try ) |
| 438 | { |
| 439 | first_try = 0; |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 440 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 441 | } |
| 442 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 443 | ret = mbedtls_net_recv( ctx, buf, len ); |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 444 | if( ret != MBEDTLS_ERR_SSL_WANT_READ ) |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 445 | first_try = 1; /* Next call will be a new operation */ |
| 446 | return( ret ); |
| 447 | } |
| 448 | |
| 449 | static int my_send( void *ctx, const unsigned char *buf, size_t len ) |
| 450 | { |
| 451 | static int first_try = 1; |
| 452 | int ret; |
| 453 | |
| 454 | if( first_try ) |
| 455 | { |
| 456 | first_try = 0; |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 457 | return( MBEDTLS_ERR_SSL_WANT_WRITE ); |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 458 | } |
| 459 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 460 | ret = mbedtls_net_send( ctx, buf, len ); |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 461 | if( ret != MBEDTLS_ERR_SSL_WANT_WRITE ) |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 462 | first_try = 1; /* Next call will be a new operation */ |
| 463 | return( ret ); |
| 464 | } |
| 465 | |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 466 | /* |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 467 | * Return authmode from string, or -1 on error |
| 468 | */ |
| 469 | static int get_auth_mode( const char *s ) |
| 470 | { |
| 471 | if( strcmp( s, "none" ) == 0 ) |
| 472 | return( MBEDTLS_SSL_VERIFY_NONE ); |
| 473 | if( strcmp( s, "optional" ) == 0 ) |
| 474 | return( MBEDTLS_SSL_VERIFY_OPTIONAL ); |
| 475 | if( strcmp( s, "required" ) == 0 ) |
| 476 | return( MBEDTLS_SSL_VERIFY_REQUIRED ); |
| 477 | |
| 478 | return( -1 ); |
| 479 | } |
| 480 | |
| 481 | /* |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 482 | * Used by sni_parse and psk_parse to handle coma-separated lists |
| 483 | */ |
| 484 | #define GET_ITEM( dst ) \ |
| 485 | dst = p; \ |
| 486 | while( *p != ',' ) \ |
| 487 | if( ++p > end ) \ |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 488 | goto error; \ |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 489 | *p++ = '\0'; |
| 490 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 491 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 492 | typedef struct _sni_entry sni_entry; |
| 493 | |
| 494 | struct _sni_entry { |
| 495 | const char *name; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 496 | mbedtls_x509_crt *cert; |
| 497 | mbedtls_pk_context *key; |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 498 | mbedtls_x509_crt* ca; |
| 499 | mbedtls_x509_crl* crl; |
| 500 | int authmode; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 501 | sni_entry *next; |
| 502 | }; |
| 503 | |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 504 | void sni_free( sni_entry *head ) |
| 505 | { |
| 506 | sni_entry *cur = head, *next; |
| 507 | |
| 508 | while( cur != NULL ) |
| 509 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 510 | mbedtls_x509_crt_free( cur->cert ); |
| 511 | mbedtls_free( cur->cert ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 512 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 513 | mbedtls_pk_free( cur->key ); |
| 514 | mbedtls_free( cur->key ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 515 | |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 516 | mbedtls_x509_crt_free( cur->ca ); |
| 517 | mbedtls_free( cur->ca ); |
| 518 | |
| 519 | mbedtls_x509_crl_free( cur->crl ); |
| 520 | mbedtls_free( cur->crl ); |
| 521 | |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 522 | next = cur->next; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 523 | mbedtls_free( cur ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 524 | cur = next; |
| 525 | } |
| 526 | } |
| 527 | |
| 528 | /* |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 529 | * Parse a string of sextuples name1,crt1,key1,ca1,crl1,auth1[,...] |
| 530 | * into a usable sni_entry list. For ca1, crl1, auth1, the special value |
| 531 | * '-' means unset. If ca1 is unset, then crl1 is ignored too. |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 532 | * |
| 533 | * Modifies the input string! This is not production quality! |
| 534 | */ |
| 535 | sni_entry *sni_parse( char *sni_string ) |
| 536 | { |
| 537 | sni_entry *cur = NULL, *new = NULL; |
| 538 | char *p = sni_string; |
| 539 | char *end = p; |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 540 | char *crt_file, *key_file, *ca_file, *crl_file, *auth_str; |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 541 | |
| 542 | while( *end != '\0' ) |
| 543 | ++end; |
| 544 | *end = ','; |
| 545 | |
| 546 | while( p <= end ) |
| 547 | { |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 548 | if( ( new = mbedtls_calloc( 1, sizeof( sni_entry ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 549 | { |
| 550 | sni_free( cur ); |
| 551 | return( NULL ); |
| 552 | } |
| 553 | |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 554 | GET_ITEM( new->name ); |
| 555 | GET_ITEM( crt_file ); |
| 556 | GET_ITEM( key_file ); |
| 557 | GET_ITEM( ca_file ); |
| 558 | GET_ITEM( crl_file ); |
| 559 | GET_ITEM( auth_str ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 560 | |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 561 | if( ( new->cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ) ) == NULL || |
| 562 | ( new->key = mbedtls_calloc( 1, sizeof( mbedtls_pk_context ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 563 | goto error; |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 564 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 565 | mbedtls_x509_crt_init( new->cert ); |
| 566 | mbedtls_pk_init( new->key ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 567 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 568 | if( mbedtls_x509_crt_parse_file( new->cert, crt_file ) != 0 || |
| 569 | mbedtls_pk_parse_keyfile( new->key, key_file, "" ) != 0 ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 570 | goto error; |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 571 | |
| 572 | if( strcmp( ca_file, "-" ) != 0 ) |
| 573 | { |
| 574 | if( ( new->ca = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ) ) == NULL ) |
| 575 | goto error; |
| 576 | |
| 577 | mbedtls_x509_crt_init( new->ca ); |
| 578 | |
| 579 | if( mbedtls_x509_crt_parse_file( new->ca, ca_file ) != 0 ) |
| 580 | goto error; |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 581 | } |
| 582 | |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 583 | if( strcmp( crl_file, "-" ) != 0 ) |
| 584 | { |
| 585 | if( ( new->crl = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) ) ) == NULL ) |
| 586 | goto error; |
| 587 | |
| 588 | mbedtls_x509_crl_init( new->crl ); |
| 589 | |
| 590 | if( mbedtls_x509_crl_parse_file( new->crl, crl_file ) != 0 ) |
| 591 | goto error; |
| 592 | } |
| 593 | |
| 594 | if( strcmp( auth_str, "-" ) != 0 ) |
| 595 | { |
| 596 | if( ( new->authmode = get_auth_mode( auth_str ) ) < 0 ) |
| 597 | goto error; |
| 598 | } |
| 599 | else |
| 600 | new->authmode = DFL_AUTH_MODE; |
| 601 | |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 602 | new->next = cur; |
| 603 | cur = new; |
| 604 | } |
| 605 | |
| 606 | return( cur ); |
| 607 | |
| 608 | error: |
| 609 | sni_free( new ); |
| 610 | sni_free( cur ); |
| 611 | return( NULL ); |
| 612 | } |
| 613 | |
| 614 | /* |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 615 | * SNI callback. |
| 616 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 617 | int sni_callback( void *p_info, mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 618 | const unsigned char *name, size_t name_len ) |
| 619 | { |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 620 | const sni_entry *cur = (const sni_entry *) p_info; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 621 | |
| 622 | while( cur != NULL ) |
| 623 | { |
| 624 | if( name_len == strlen( cur->name ) && |
| 625 | memcmp( name, cur->name, name_len ) == 0 ) |
| 626 | { |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 627 | if( cur->ca != NULL ) |
| 628 | mbedtls_ssl_set_hs_ca_chain( ssl, cur->ca, cur->crl ); |
| 629 | |
| 630 | if( cur->authmode != DFL_AUTH_MODE ) |
| 631 | mbedtls_ssl_set_hs_authmode( ssl, cur->authmode ); |
| 632 | |
Manuel Pégourié-Gonnard | 1af6c85 | 2015-05-10 23:10:37 +0200 | [diff] [blame] | 633 | return( mbedtls_ssl_set_hs_own_cert( ssl, cur->cert, cur->key ) ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 634 | } |
| 635 | |
| 636 | cur = cur->next; |
| 637 | } |
| 638 | |
| 639 | return( -1 ); |
| 640 | } |
| 641 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 642 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 643 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 644 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Manuel Pégourié-Gonnard | 9e27163 | 2014-06-09 19:06:00 +0200 | [diff] [blame] | 645 | |
| 646 | #define HEX2NUM( c ) \ |
| 647 | if( c >= '0' && c <= '9' ) \ |
| 648 | c -= '0'; \ |
| 649 | else if( c >= 'a' && c <= 'f' ) \ |
| 650 | c -= 'a' - 10; \ |
| 651 | else if( c >= 'A' && c <= 'F' ) \ |
| 652 | c -= 'A' - 10; \ |
| 653 | else \ |
| 654 | return( -1 ); |
| 655 | |
| 656 | /* |
| 657 | * Convert a hex string to bytes. |
| 658 | * Return 0 on success, -1 on error. |
| 659 | */ |
| 660 | int unhexify( unsigned char *output, const char *input, size_t *olen ) |
| 661 | { |
| 662 | unsigned char c; |
| 663 | size_t j; |
| 664 | |
| 665 | *olen = strlen( input ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 666 | if( *olen % 2 != 0 || *olen / 2 > MBEDTLS_PSK_MAX_LEN ) |
Manuel Pégourié-Gonnard | 9e27163 | 2014-06-09 19:06:00 +0200 | [diff] [blame] | 667 | return( -1 ); |
| 668 | *olen /= 2; |
| 669 | |
| 670 | for( j = 0; j < *olen * 2; j += 2 ) |
| 671 | { |
| 672 | c = input[j]; |
| 673 | HEX2NUM( c ); |
| 674 | output[ j / 2 ] = c << 4; |
| 675 | |
| 676 | c = input[j + 1]; |
| 677 | HEX2NUM( c ); |
| 678 | output[ j / 2 ] |= c; |
| 679 | } |
| 680 | |
| 681 | return( 0 ); |
| 682 | } |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 683 | |
| 684 | typedef struct _psk_entry psk_entry; |
| 685 | |
| 686 | struct _psk_entry |
| 687 | { |
| 688 | const char *name; |
| 689 | size_t key_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 690 | unsigned char key[MBEDTLS_PSK_MAX_LEN]; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 691 | psk_entry *next; |
| 692 | }; |
| 693 | |
| 694 | /* |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 695 | * Free a list of psk_entry's |
| 696 | */ |
| 697 | void psk_free( psk_entry *head ) |
| 698 | { |
| 699 | psk_entry *next; |
| 700 | |
| 701 | while( head != NULL ) |
| 702 | { |
| 703 | next = head->next; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 704 | mbedtls_free( head ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 705 | head = next; |
| 706 | } |
| 707 | } |
| 708 | |
| 709 | /* |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 710 | * Parse a string of pairs name1,key1[,name2,key2[,...]] |
| 711 | * into a usable psk_entry list. |
| 712 | * |
| 713 | * Modifies the input string! This is not production quality! |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 714 | */ |
| 715 | psk_entry *psk_parse( char *psk_string ) |
| 716 | { |
| 717 | psk_entry *cur = NULL, *new = NULL; |
| 718 | char *p = psk_string; |
| 719 | char *end = p; |
| 720 | char *key_hex; |
| 721 | |
| 722 | while( *end != '\0' ) |
| 723 | ++end; |
| 724 | *end = ','; |
| 725 | |
| 726 | while( p <= end ) |
| 727 | { |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 728 | if( ( new = mbedtls_calloc( 1, sizeof( psk_entry ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | b199095 | 2015-02-18 09:32:06 +0000 | [diff] [blame] | 729 | goto error; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 730 | |
| 731 | memset( new, 0, sizeof( psk_entry ) ); |
| 732 | |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 733 | GET_ITEM( new->name ); |
| 734 | GET_ITEM( key_hex ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 735 | |
| 736 | if( unhexify( new->key, key_hex, &new->key_len ) != 0 ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 737 | goto error; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 738 | |
| 739 | new->next = cur; |
| 740 | cur = new; |
| 741 | } |
| 742 | |
| 743 | return( cur ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 744 | |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 745 | error: |
| 746 | psk_free( new ); |
| 747 | psk_free( cur ); |
| 748 | return( 0 ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 749 | } |
| 750 | |
| 751 | /* |
| 752 | * PSK callback |
| 753 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 754 | int psk_callback( void *p_info, mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 755 | const unsigned char *name, size_t name_len ) |
| 756 | { |
| 757 | psk_entry *cur = (psk_entry *) p_info; |
| 758 | |
| 759 | while( cur != NULL ) |
| 760 | { |
| 761 | if( name_len == strlen( cur->name ) && |
| 762 | memcmp( name, cur->name, name_len ) == 0 ) |
| 763 | { |
Manuel Pégourié-Gonnard | 4b68296 | 2015-05-07 15:59:54 +0100 | [diff] [blame] | 764 | return( mbedtls_ssl_set_hs_psk( ssl, cur->key, cur->key_len ) ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 765 | } |
| 766 | |
| 767 | cur = cur->next; |
| 768 | } |
| 769 | |
| 770 | return( -1 ); |
| 771 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 772 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
Manuel Pégourié-Gonnard | 9e27163 | 2014-06-09 19:06:00 +0200 | [diff] [blame] | 773 | |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 774 | static mbedtls_net_context listen_fd, client_fd; |
Paul Bakker | bc3e54c | 2014-08-18 14:36:17 +0200 | [diff] [blame] | 775 | |
| 776 | /* Interruption handler to ensure clean exit (for valgrind testing) */ |
| 777 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 778 | static int received_sigterm = 0; |
| 779 | void term_handler( int sig ) |
| 780 | { |
| 781 | ((void) sig); |
| 782 | received_sigterm = 1; |
Manuel Pégourié-Gonnard | 3d7d00a | 2015-06-30 15:55:03 +0200 | [diff] [blame] | 783 | mbedtls_net_free( &listen_fd ); /* causes mbedtls_net_accept() to abort */ |
| 784 | mbedtls_net_free( &client_fd ); /* causes net_read() to abort */ |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 785 | } |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 786 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 787 | |
Gilles Peskine | db56aca | 2017-05-11 19:01:11 +0200 | [diff] [blame] | 788 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 789 | static int ssl_sig_hashes_for_test[] = { |
| 790 | #if defined(MBEDTLS_SHA512_C) |
| 791 | MBEDTLS_MD_SHA512, |
| 792 | MBEDTLS_MD_SHA384, |
| 793 | #endif |
| 794 | #if defined(MBEDTLS_SHA256_C) |
| 795 | MBEDTLS_MD_SHA256, |
| 796 | MBEDTLS_MD_SHA224, |
| 797 | #endif |
| 798 | #if defined(MBEDTLS_SHA1_C) |
| 799 | /* Allow SHA-1 as we use it extensively in tests. */ |
| 800 | MBEDTLS_MD_SHA1, |
| 801 | #endif |
| 802 | MBEDTLS_MD_NONE |
| 803 | }; |
| 804 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
| 805 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 806 | int main( int argc, char *argv[] ) |
| 807 | { |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 808 | int ret = 0, len, written, frags, exchanges_left; |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 809 | int version_suites[4][2]; |
Manuel Pégourié-Gonnard | e7a3b10 | 2014-06-11 18:21:20 +0200 | [diff] [blame] | 810 | unsigned char buf[IO_BUF_LEN]; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 811 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
| 812 | unsigned char psk[MBEDTLS_PSK_MAX_LEN]; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 813 | size_t psk_len = 0; |
Paul Bakker | 9b7fb6f | 2014-06-12 23:01:43 +0200 | [diff] [blame] | 814 | psk_entry *psk_info = NULL; |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 815 | #endif |
Paul Bakker | ef3f8c7 | 2013-06-24 13:01:08 +0200 | [diff] [blame] | 816 | const char *pers = "ssl_server2"; |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 817 | unsigned char client_ip[16] = { 0 }; |
Manuel Pégourié-Gonnard | 0b104b0 | 2015-05-14 21:52:40 +0200 | [diff] [blame] | 818 | size_t cliip_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 819 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 820 | mbedtls_ssl_cookie_ctx cookie_ctx; |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 821 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 822 | |
Gilles Peskine | dd57d75 | 2017-05-05 18:59:02 +0200 | [diff] [blame] | 823 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 824 | mbedtls_x509_crt_profile crt_profile_for_test = mbedtls_x509_crt_profile_default; |
| 825 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 826 | mbedtls_entropy_context entropy; |
| 827 | mbedtls_ctr_drbg_context ctr_drbg; |
| 828 | mbedtls_ssl_context ssl; |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 829 | mbedtls_ssl_config conf; |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 830 | #if defined(MBEDTLS_TIMING_C) |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 831 | mbedtls_timing_delay_context timer; |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 832 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 833 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 834 | unsigned char renego_period[8] = { 0 }; |
| 835 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 836 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Manuel Pégourié-Gonnard | db1cc76 | 2015-05-12 11:27:25 +0200 | [diff] [blame] | 837 | uint32_t flags; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 838 | mbedtls_x509_crt cacert; |
| 839 | mbedtls_x509_crt srvcert; |
| 840 | mbedtls_pk_context pkey; |
| 841 | mbedtls_x509_crt srvcert2; |
| 842 | mbedtls_pk_context pkey2; |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 843 | int key_cert_init = 0, key_cert_init2 = 0; |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 844 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 845 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 846 | mbedtls_dhm_context dhm; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 847 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 848 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 849 | mbedtls_ssl_cache_context cache; |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 850 | #endif |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 851 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 852 | mbedtls_ssl_ticket_context ticket_ctx; |
| 853 | #endif |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 854 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 855 | sni_entry *sni_info = NULL; |
| 856 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 857 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 858 | const char *alpn_list[10]; |
| 859 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 860 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 861 | unsigned char alloc_buf[100000]; |
| 862 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 863 | |
| 864 | int i; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 865 | char *p, *q; |
| 866 | const int *list; |
| 867 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 868 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
| 869 | mbedtls_memory_buffer_alloc_init( alloc_buf, sizeof(alloc_buf) ); |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 870 | #endif |
| 871 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 872 | /* |
Manuel Pégourié-Gonnard | 3bd2aae | 2013-09-20 13:10:13 +0200 | [diff] [blame] | 873 | * Make sure memory references are valid in case we exit early. |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 874 | */ |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 875 | mbedtls_net_init( &client_fd ); |
| 876 | mbedtls_net_init( &listen_fd ); |
Manuel Pégourié-Gonnard | 41d479e | 2015-04-29 00:48:22 +0200 | [diff] [blame] | 877 | mbedtls_ssl_init( &ssl ); |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 878 | mbedtls_ssl_config_init( &conf ); |
Manuel Pégourié-Gonnard | ec160c0 | 2015-04-28 22:52:30 +0200 | [diff] [blame] | 879 | mbedtls_ctr_drbg_init( &ctr_drbg ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 880 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 881 | mbedtls_x509_crt_init( &cacert ); |
| 882 | mbedtls_x509_crt_init( &srvcert ); |
| 883 | mbedtls_pk_init( &pkey ); |
| 884 | mbedtls_x509_crt_init( &srvcert2 ); |
| 885 | mbedtls_pk_init( &pkey2 ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 886 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 887 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 888 | mbedtls_dhm_init( &dhm ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 889 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 890 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 891 | mbedtls_ssl_cache_init( &cache ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 892 | #endif |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 893 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 894 | mbedtls_ssl_ticket_init( &ticket_ctx ); |
| 895 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 896 | #if defined(MBEDTLS_SSL_ALPN) |
Paul Bakker | 525f875 | 2014-05-01 10:58:57 +0200 | [diff] [blame] | 897 | memset( (void *) alpn_list, 0, sizeof( alpn_list ) ); |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 898 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 899 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 900 | mbedtls_ssl_cookie_init( &cookie_ctx ); |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 901 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 902 | |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 903 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | 403a86f | 2014-11-17 12:46:49 +0100 | [diff] [blame] | 904 | /* Abort cleanly on SIGTERM and SIGINT */ |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 905 | signal( SIGTERM, term_handler ); |
Manuel Pégourié-Gonnard | 403a86f | 2014-11-17 12:46:49 +0100 | [diff] [blame] | 906 | signal( SIGINT, term_handler ); |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 907 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 908 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 909 | if( argc == 0 ) |
| 910 | { |
| 911 | usage: |
| 912 | if( ret == 0 ) |
| 913 | ret = 1; |
| 914 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 915 | mbedtls_printf( USAGE ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 916 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 917 | list = mbedtls_ssl_list_ciphersuites(); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 918 | while( *list ) |
| 919 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 920 | mbedtls_printf(" %-42s", mbedtls_ssl_get_ciphersuite_name( *list ) ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 921 | list++; |
| 922 | if( !*list ) |
| 923 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 924 | mbedtls_printf(" %s\n", mbedtls_ssl_get_ciphersuite_name( *list ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 925 | list++; |
| 926 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 927 | mbedtls_printf("\n"); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 928 | goto exit; |
| 929 | } |
| 930 | |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 931 | opt.server_addr = DFL_SERVER_ADDR; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 932 | opt.server_port = DFL_SERVER_PORT; |
| 933 | opt.debug_level = DFL_DEBUG_LEVEL; |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 934 | opt.nbio = DFL_NBIO; |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 935 | opt.read_timeout = DFL_READ_TIMEOUT; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 936 | opt.ca_file = DFL_CA_FILE; |
| 937 | opt.ca_path = DFL_CA_PATH; |
| 938 | opt.crt_file = DFL_CRT_FILE; |
| 939 | opt.key_file = DFL_KEY_FILE; |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 940 | opt.crt_file2 = DFL_CRT_FILE2; |
| 941 | opt.key_file2 = DFL_KEY_FILE2; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 942 | opt.psk = DFL_PSK; |
| 943 | opt.psk_identity = DFL_PSK_IDENTITY; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 944 | opt.psk_list = DFL_PSK_LIST; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 945 | opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 946 | opt.version_suites = DFL_VERSION_SUITES; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 947 | opt.renegotiation = DFL_RENEGOTIATION; |
| 948 | opt.allow_legacy = DFL_ALLOW_LEGACY; |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 949 | opt.renegotiate = DFL_RENEGOTIATE; |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 950 | opt.renego_delay = DFL_RENEGO_DELAY; |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 951 | opt.renego_period = DFL_RENEGO_PERIOD; |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 952 | opt.exchanges = DFL_EXCHANGES; |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 953 | opt.min_version = DFL_MIN_VERSION; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 954 | opt.max_version = DFL_MAX_VERSION; |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 955 | opt.arc4 = DFL_ARC4; |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 956 | opt.allow_sha1 = DFL_SHA1; |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 957 | opt.auth_mode = DFL_AUTH_MODE; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 958 | opt.mfl_code = DFL_MFL_CODE; |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 959 | opt.trunc_hmac = DFL_TRUNC_HMAC; |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 960 | opt.tickets = DFL_TICKETS; |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 961 | opt.ticket_timeout = DFL_TICKET_TIMEOUT; |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 962 | opt.cache_max = DFL_CACHE_MAX; |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 963 | opt.cache_timeout = DFL_CACHE_TIMEOUT; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 964 | opt.sni = DFL_SNI; |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 965 | opt.alpn_string = DFL_ALPN_STRING; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 966 | opt.dhm_file = DFL_DHM_FILE; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 967 | opt.transport = DFL_TRANSPORT; |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 968 | opt.cookies = DFL_COOKIES; |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 969 | opt.anti_replay = DFL_ANTI_REPLAY; |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 970 | opt.hs_to_min = DFL_HS_TO_MIN; |
| 971 | opt.hs_to_max = DFL_HS_TO_MAX; |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 972 | opt.badmac_limit = DFL_BADMAC_LIMIT; |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 973 | opt.extended_ms = DFL_EXTENDED_MS; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 974 | opt.etm = DFL_ETM; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 975 | |
| 976 | for( i = 1; i < argc; i++ ) |
| 977 | { |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 978 | p = argv[i]; |
| 979 | if( ( q = strchr( p, '=' ) ) == NULL ) |
| 980 | goto usage; |
| 981 | *q++ = '\0'; |
| 982 | |
| 983 | if( strcmp( p, "server_port" ) == 0 ) |
Manuel Pégourié-Gonnard | c0d7494 | 2015-06-23 12:30:57 +0200 | [diff] [blame] | 984 | opt.server_port = q; |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 985 | else if( strcmp( p, "server_addr" ) == 0 ) |
| 986 | opt.server_addr = q; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 987 | else if( strcmp( p, "dtls" ) == 0 ) |
| 988 | { |
| 989 | int t = atoi( q ); |
| 990 | if( t == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 991 | opt.transport = MBEDTLS_SSL_TRANSPORT_STREAM; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 992 | else if( t == 1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 993 | opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 994 | else |
| 995 | goto usage; |
| 996 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 997 | else if( strcmp( p, "debug_level" ) == 0 ) |
| 998 | { |
| 999 | opt.debug_level = atoi( q ); |
| 1000 | if( opt.debug_level < 0 || opt.debug_level > 65535 ) |
| 1001 | goto usage; |
| 1002 | } |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1003 | else if( strcmp( p, "nbio" ) == 0 ) |
| 1004 | { |
| 1005 | opt.nbio = atoi( q ); |
| 1006 | if( opt.nbio < 0 || opt.nbio > 2 ) |
| 1007 | goto usage; |
| 1008 | } |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 1009 | else if( strcmp( p, "read_timeout" ) == 0 ) |
| 1010 | opt.read_timeout = atoi( q ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1011 | else if( strcmp( p, "ca_file" ) == 0 ) |
| 1012 | opt.ca_file = q; |
| 1013 | else if( strcmp( p, "ca_path" ) == 0 ) |
| 1014 | opt.ca_path = q; |
| 1015 | else if( strcmp( p, "crt_file" ) == 0 ) |
| 1016 | opt.crt_file = q; |
| 1017 | else if( strcmp( p, "key_file" ) == 0 ) |
| 1018 | opt.key_file = q; |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 1019 | else if( strcmp( p, "crt_file2" ) == 0 ) |
| 1020 | opt.crt_file2 = q; |
| 1021 | else if( strcmp( p, "key_file2" ) == 0 ) |
| 1022 | opt.key_file2 = q; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1023 | else if( strcmp( p, "dhm_file" ) == 0 ) |
| 1024 | opt.dhm_file = q; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1025 | else if( strcmp( p, "psk" ) == 0 ) |
| 1026 | opt.psk = q; |
| 1027 | else if( strcmp( p, "psk_identity" ) == 0 ) |
| 1028 | opt.psk_identity = q; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1029 | else if( strcmp( p, "psk_list" ) == 0 ) |
| 1030 | opt.psk_list = q; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1031 | else if( strcmp( p, "force_ciphersuite" ) == 0 ) |
| 1032 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1033 | opt.force_ciphersuite[0] = mbedtls_ssl_get_ciphersuite_id( q ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1034 | |
Manuel Pégourié-Gonnard | 8de259b | 2014-06-11 14:19:06 +0200 | [diff] [blame] | 1035 | if( opt.force_ciphersuite[0] == 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1036 | { |
| 1037 | ret = 2; |
| 1038 | goto usage; |
| 1039 | } |
| 1040 | opt.force_ciphersuite[1] = 0; |
| 1041 | } |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1042 | else if( strcmp( p, "version_suites" ) == 0 ) |
| 1043 | opt.version_suites = q; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1044 | else if( strcmp( p, "renegotiation" ) == 0 ) |
| 1045 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1046 | opt.renegotiation = (atoi( q )) ? MBEDTLS_SSL_RENEGOTIATION_ENABLED : |
| 1047 | MBEDTLS_SSL_RENEGOTIATION_DISABLED; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1048 | } |
| 1049 | else if( strcmp( p, "allow_legacy" ) == 0 ) |
| 1050 | { |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1051 | switch( atoi( q ) ) |
| 1052 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1053 | case -1: opt.allow_legacy = MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE; break; |
| 1054 | case 0: opt.allow_legacy = MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION; break; |
| 1055 | case 1: opt.allow_legacy = MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION; break; |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1056 | default: goto usage; |
| 1057 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1058 | } |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1059 | else if( strcmp( p, "renegotiate" ) == 0 ) |
| 1060 | { |
| 1061 | opt.renegotiate = atoi( q ); |
| 1062 | if( opt.renegotiate < 0 || opt.renegotiate > 1 ) |
| 1063 | goto usage; |
| 1064 | } |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1065 | else if( strcmp( p, "renego_delay" ) == 0 ) |
| 1066 | { |
| 1067 | opt.renego_delay = atoi( q ); |
| 1068 | } |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1069 | else if( strcmp( p, "renego_period" ) == 0 ) |
| 1070 | { |
Andres AG | 0ac1392 | 2017-02-08 14:05:57 +0000 | [diff] [blame] | 1071 | #if defined(_MSC_VER) |
| 1072 | opt.renego_period = _strtoui64( q, NULL, 10 ); |
| 1073 | #else |
| 1074 | if( sscanf( q, "%" SCNu64, &opt.renego_period ) != 1 ) |
| 1075 | goto usage; |
| 1076 | #endif /* _MSC_VER */ |
| 1077 | if( opt.renego_period < 2 ) |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1078 | goto usage; |
| 1079 | } |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 1080 | else if( strcmp( p, "exchanges" ) == 0 ) |
| 1081 | { |
| 1082 | opt.exchanges = atoi( q ); |
Manuel Pégourié-Gonnard | 6a2bc23 | 2014-10-09 15:33:13 +0200 | [diff] [blame] | 1083 | if( opt.exchanges < 0 ) |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 1084 | goto usage; |
| 1085 | } |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1086 | else if( strcmp( p, "min_version" ) == 0 ) |
| 1087 | { |
| 1088 | if( strcmp( q, "ssl3" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1089 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_0; |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1090 | else if( strcmp( q, "tls1" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1091 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_1; |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 1092 | else if( strcmp( q, "tls1_1" ) == 0 || |
| 1093 | strcmp( q, "dtls1" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1094 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2; |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 1095 | else if( strcmp( q, "tls1_2" ) == 0 || |
| 1096 | strcmp( q, "dtls1_2" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1097 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1098 | else |
| 1099 | goto usage; |
| 1100 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1101 | else if( strcmp( p, "max_version" ) == 0 ) |
| 1102 | { |
| 1103 | if( strcmp( q, "ssl3" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1104 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_0; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1105 | else if( strcmp( q, "tls1" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1106 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_1; |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 1107 | else if( strcmp( q, "tls1_1" ) == 0 || |
| 1108 | strcmp( q, "dtls1" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1109 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2; |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 1110 | else if( strcmp( q, "tls1_2" ) == 0 || |
| 1111 | strcmp( q, "dtls1_2" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1112 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1113 | else |
| 1114 | goto usage; |
| 1115 | } |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1116 | else if( strcmp( p, "arc4" ) == 0 ) |
| 1117 | { |
| 1118 | switch( atoi( q ) ) |
| 1119 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1120 | case 0: opt.arc4 = MBEDTLS_SSL_ARC4_DISABLED; break; |
| 1121 | case 1: opt.arc4 = MBEDTLS_SSL_ARC4_ENABLED; break; |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1122 | default: goto usage; |
| 1123 | } |
| 1124 | } |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1125 | else if( strcmp( p, "allow_sha1" ) == 0 ) |
| 1126 | { |
| 1127 | switch( atoi( q ) ) |
| 1128 | { |
| 1129 | case 0: opt.allow_sha1 = 0; break; |
| 1130 | case 1: opt.allow_sha1 = 1; break; |
| 1131 | default: goto usage; |
| 1132 | } |
| 1133 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1134 | else if( strcmp( p, "force_version" ) == 0 ) |
| 1135 | { |
| 1136 | if( strcmp( q, "ssl3" ) == 0 ) |
| 1137 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1138 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_0; |
| 1139 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_0; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1140 | } |
| 1141 | else if( strcmp( q, "tls1" ) == 0 ) |
| 1142 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1143 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_1; |
| 1144 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_1; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1145 | } |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1146 | else if( strcmp( q, "tls1_1" ) == 0 ) |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1147 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1148 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2; |
| 1149 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1150 | } |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1151 | else if( strcmp( q, "tls1_2" ) == 0 ) |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1152 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1153 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1154 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1155 | } |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1156 | else if( strcmp( q, "dtls1" ) == 0 ) |
| 1157 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1158 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2; |
| 1159 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2; |
| 1160 | opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM; |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1161 | } |
| 1162 | else if( strcmp( q, "dtls1_2" ) == 0 ) |
| 1163 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1164 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1165 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1166 | opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM; |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1167 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1168 | else |
| 1169 | goto usage; |
| 1170 | } |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1171 | else if( strcmp( p, "auth_mode" ) == 0 ) |
| 1172 | { |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 1173 | if( ( opt.auth_mode = get_auth_mode( q ) ) < 0 ) |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1174 | goto usage; |
| 1175 | } |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1176 | else if( strcmp( p, "max_frag_len" ) == 0 ) |
| 1177 | { |
| 1178 | if( strcmp( q, "512" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1179 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_512; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1180 | else if( strcmp( q, "1024" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1181 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_1024; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1182 | else if( strcmp( q, "2048" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1183 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_2048; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1184 | else if( strcmp( q, "4096" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1185 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_4096; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1186 | else |
| 1187 | goto usage; |
| 1188 | } |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1189 | else if( strcmp( p, "alpn" ) == 0 ) |
| 1190 | { |
| 1191 | opt.alpn_string = q; |
| 1192 | } |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1193 | else if( strcmp( p, "trunc_hmac" ) == 0 ) |
| 1194 | { |
| 1195 | switch( atoi( q ) ) |
| 1196 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1197 | case 0: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_DISABLED; break; |
| 1198 | case 1: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; break; |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1199 | default: goto usage; |
| 1200 | } |
| 1201 | } |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1202 | else if( strcmp( p, "extended_ms" ) == 0 ) |
| 1203 | { |
| 1204 | switch( atoi( q ) ) |
| 1205 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1206 | case 0: opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_DISABLED; break; |
| 1207 | case 1: opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; break; |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1208 | default: goto usage; |
| 1209 | } |
| 1210 | } |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1211 | else if( strcmp( p, "etm" ) == 0 ) |
| 1212 | { |
| 1213 | switch( atoi( q ) ) |
| 1214 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1215 | case 0: opt.etm = MBEDTLS_SSL_ETM_DISABLED; break; |
| 1216 | case 1: opt.etm = MBEDTLS_SSL_ETM_ENABLED; break; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1217 | default: goto usage; |
| 1218 | } |
| 1219 | } |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 1220 | else if( strcmp( p, "tickets" ) == 0 ) |
| 1221 | { |
| 1222 | opt.tickets = atoi( q ); |
| 1223 | if( opt.tickets < 0 || opt.tickets > 1 ) |
| 1224 | goto usage; |
| 1225 | } |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 1226 | else if( strcmp( p, "ticket_timeout" ) == 0 ) |
| 1227 | { |
| 1228 | opt.ticket_timeout = atoi( q ); |
| 1229 | if( opt.ticket_timeout < 0 ) |
| 1230 | goto usage; |
| 1231 | } |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1232 | else if( strcmp( p, "cache_max" ) == 0 ) |
| 1233 | { |
| 1234 | opt.cache_max = atoi( q ); |
| 1235 | if( opt.cache_max < 0 ) |
| 1236 | goto usage; |
| 1237 | } |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1238 | else if( strcmp( p, "cache_timeout" ) == 0 ) |
| 1239 | { |
| 1240 | opt.cache_timeout = atoi( q ); |
| 1241 | if( opt.cache_timeout < 0 ) |
| 1242 | goto usage; |
| 1243 | } |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1244 | else if( strcmp( p, "cookies" ) == 0 ) |
| 1245 | { |
| 1246 | opt.cookies = atoi( q ); |
| 1247 | if( opt.cookies < -1 || opt.cookies > 1) |
| 1248 | goto usage; |
| 1249 | } |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1250 | else if( strcmp( p, "anti_replay" ) == 0 ) |
| 1251 | { |
| 1252 | opt.anti_replay = atoi( q ); |
| 1253 | if( opt.anti_replay < 0 || opt.anti_replay > 1) |
| 1254 | goto usage; |
| 1255 | } |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 1256 | else if( strcmp( p, "badmac_limit" ) == 0 ) |
| 1257 | { |
| 1258 | opt.badmac_limit = atoi( q ); |
| 1259 | if( opt.badmac_limit < 0 ) |
| 1260 | goto usage; |
| 1261 | } |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 1262 | else if( strcmp( p, "hs_timeout" ) == 0 ) |
| 1263 | { |
| 1264 | if( ( p = strchr( q, '-' ) ) == NULL ) |
| 1265 | goto usage; |
| 1266 | *p++ = '\0'; |
| 1267 | opt.hs_to_min = atoi( q ); |
| 1268 | opt.hs_to_max = atoi( p ); |
| 1269 | if( opt.hs_to_min == 0 || opt.hs_to_max < opt.hs_to_min ) |
| 1270 | goto usage; |
| 1271 | } |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1272 | else if( strcmp( p, "sni" ) == 0 ) |
| 1273 | { |
| 1274 | opt.sni = q; |
| 1275 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1276 | else |
| 1277 | goto usage; |
| 1278 | } |
| 1279 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1280 | #if defined(MBEDTLS_DEBUG_C) |
| 1281 | mbedtls_debug_set_threshold( opt.debug_level ); |
Paul Bakker | c73079a | 2014-04-25 16:34:30 +0200 | [diff] [blame] | 1282 | #endif |
| 1283 | |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1284 | if( opt.force_ciphersuite[0] > 0 ) |
| 1285 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1286 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
| 1287 | ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1288 | |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1289 | if( opt.max_version != -1 && |
| 1290 | ciphersuite_info->min_minor_ver > opt.max_version ) |
| 1291 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1292 | mbedtls_printf("forced ciphersuite not allowed with this protocol version\n"); |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1293 | ret = 2; |
| 1294 | goto usage; |
| 1295 | } |
| 1296 | if( opt.min_version != -1 && |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1297 | ciphersuite_info->max_minor_ver < opt.min_version ) |
| 1298 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1299 | mbedtls_printf("forced ciphersuite not allowed with this protocol version\n"); |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1300 | ret = 2; |
| 1301 | goto usage; |
| 1302 | } |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1303 | |
| 1304 | /* If we select a version that's not supported by |
| 1305 | * this suite, then there will be no common ciphersuite... */ |
| 1306 | if( opt.max_version == -1 || |
| 1307 | opt.max_version > ciphersuite_info->max_minor_ver ) |
| 1308 | { |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1309 | opt.max_version = ciphersuite_info->max_minor_ver; |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1310 | } |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1311 | if( opt.min_version < ciphersuite_info->min_minor_ver ) |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1312 | { |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1313 | opt.min_version = ciphersuite_info->min_minor_ver; |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1314 | /* DTLS starts with TLS 1.1 */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1315 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
| 1316 | opt.min_version < MBEDTLS_SSL_MINOR_VERSION_2 ) |
| 1317 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2; |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1318 | } |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1319 | |
| 1320 | /* Enable RC4 if needed and not explicitly disabled */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1321 | if( ciphersuite_info->cipher == MBEDTLS_CIPHER_ARC4_128 ) |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1322 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1323 | if( opt.arc4 == MBEDTLS_SSL_ARC4_DISABLED ) |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1324 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1325 | mbedtls_printf("forced RC4 ciphersuite with RC4 disabled\n"); |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1326 | ret = 2; |
| 1327 | goto usage; |
| 1328 | } |
| 1329 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1330 | opt.arc4 = MBEDTLS_SSL_ARC4_ENABLED; |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1331 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1332 | } |
| 1333 | |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1334 | if( opt.version_suites != NULL ) |
| 1335 | { |
| 1336 | const char *name[4] = { 0 }; |
| 1337 | |
| 1338 | /* Parse 4-element coma-separated list */ |
| 1339 | for( i = 0, p = (char *) opt.version_suites; |
| 1340 | i < 4 && *p != '\0'; |
| 1341 | i++ ) |
| 1342 | { |
| 1343 | name[i] = p; |
| 1344 | |
| 1345 | /* Terminate the current string and move on to next one */ |
| 1346 | while( *p != ',' && *p != '\0' ) |
| 1347 | p++; |
| 1348 | if( *p == ',' ) |
| 1349 | *p++ = '\0'; |
| 1350 | } |
| 1351 | |
| 1352 | if( i != 4 ) |
| 1353 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1354 | mbedtls_printf( "too few values for version_suites\n" ); |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1355 | ret = 1; |
| 1356 | goto exit; |
| 1357 | } |
| 1358 | |
| 1359 | memset( version_suites, 0, sizeof( version_suites ) ); |
| 1360 | |
| 1361 | /* Get the suites identifiers from their name */ |
| 1362 | for( i = 0; i < 4; i++ ) |
| 1363 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1364 | version_suites[i][0] = mbedtls_ssl_get_ciphersuite_id( name[i] ); |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1365 | |
| 1366 | if( version_suites[i][0] == 0 ) |
| 1367 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1368 | mbedtls_printf( "unknown ciphersuite: '%s'\n", name[i] ); |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1369 | ret = 2; |
| 1370 | goto usage; |
| 1371 | } |
| 1372 | } |
| 1373 | } |
| 1374 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1375 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1376 | /* |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1377 | * Unhexify the pre-shared key and parse the list if any given |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1378 | */ |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1379 | if( unhexify( psk, opt.psk, &psk_len ) != 0 ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1380 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1381 | mbedtls_printf( "pre-shared key not valid hex\n" ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1382 | goto exit; |
| 1383 | } |
| 1384 | |
| 1385 | if( opt.psk_list != NULL ) |
| 1386 | { |
| 1387 | if( ( psk_info = psk_parse( opt.psk_list ) ) == NULL ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1388 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1389 | mbedtls_printf( "psk_list invalid" ); |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1390 | goto exit; |
| 1391 | } |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1392 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1393 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1394 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1395 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1396 | if( opt.alpn_string != NULL ) |
| 1397 | { |
| 1398 | p = (char *) opt.alpn_string; |
| 1399 | i = 0; |
| 1400 | |
| 1401 | /* Leave room for a final NULL in alpn_list */ |
| 1402 | while( i < (int) sizeof alpn_list - 1 && *p != '\0' ) |
| 1403 | { |
| 1404 | alpn_list[i++] = p; |
| 1405 | |
| 1406 | /* Terminate the current string and move on to next one */ |
| 1407 | while( *p != ',' && *p != '\0' ) |
| 1408 | p++; |
| 1409 | if( *p == ',' ) |
| 1410 | *p++ = '\0'; |
| 1411 | } |
| 1412 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1413 | #endif /* MBEDTLS_SSL_ALPN */ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1414 | |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1415 | /* |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1416 | * 0. Initialize the RNG and the session data |
| 1417 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1418 | mbedtls_printf( "\n . Seeding the random number generator..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1419 | fflush( stdout ); |
| 1420 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1421 | mbedtls_entropy_init( &entropy ); |
Manuel Pégourié-Gonnard | ec160c0 | 2015-04-28 22:52:30 +0200 | [diff] [blame] | 1422 | if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy, |
Paul Bakker | ef3f8c7 | 2013-06-24 13:01:08 +0200 | [diff] [blame] | 1423 | (const unsigned char *) pers, |
| 1424 | strlen( pers ) ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1425 | { |
Manuel Pégourié-Gonnard | ec160c0 | 2015-04-28 22:52:30 +0200 | [diff] [blame] | 1426 | mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned -0x%x\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1427 | goto exit; |
| 1428 | } |
| 1429 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1430 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1431 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1432 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1433 | /* |
| 1434 | * 1.1. Load the trusted CA |
| 1435 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1436 | mbedtls_printf( " . Loading the CA root certificate ..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1437 | fflush( stdout ); |
| 1438 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1439 | #if defined(MBEDTLS_FS_IO) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1440 | if( strlen( opt.ca_path ) ) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1441 | if( strcmp( opt.ca_path, "none" ) == 0 ) |
| 1442 | ret = 0; |
| 1443 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1444 | ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1445 | else if( strlen( opt.ca_file ) ) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1446 | if( strcmp( opt.ca_file, "none" ) == 0 ) |
| 1447 | ret = 0; |
| 1448 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1449 | ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); |
Paul Bakker | ddf26b4 | 2013-09-18 13:46:23 +0200 | [diff] [blame] | 1450 | else |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1451 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1452 | #if defined(MBEDTLS_CERTS_C) |
| 1453 | for( i = 0; mbedtls_test_cas[i] != NULL; i++ ) |
Manuel Pégourié-Gonnard | 2f16506 | 2015-03-27 10:20:26 +0100 | [diff] [blame] | 1454 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1455 | ret = mbedtls_x509_crt_parse( &cacert, |
| 1456 | (const unsigned char *) mbedtls_test_cas[i], |
| 1457 | mbedtls_test_cas_len[i] ); |
Manuel Pégourié-Gonnard | 2f16506 | 2015-03-27 10:20:26 +0100 | [diff] [blame] | 1458 | if( ret != 0 ) |
| 1459 | break; |
| 1460 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1461 | #else |
| 1462 | { |
| 1463 | ret = 1; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1464 | mbedtls_printf("MBEDTLS_CERTS_C not defined."); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1465 | } |
| 1466 | #endif |
| 1467 | if( ret < 0 ) |
| 1468 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1469 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1470 | goto exit; |
| 1471 | } |
| 1472 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1473 | mbedtls_printf( " ok (%d skipped)\n", ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1474 | |
| 1475 | /* |
| 1476 | * 1.2. Load own certificate and private key |
| 1477 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1478 | mbedtls_printf( " . Loading the server cert. and key..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1479 | fflush( stdout ); |
| 1480 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1481 | #if defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1482 | if( strlen( opt.crt_file ) && strcmp( opt.crt_file, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1483 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1484 | key_cert_init++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1485 | if( ( ret = mbedtls_x509_crt_parse_file( &srvcert, opt.crt_file ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1486 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1487 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file returned -0x%x\n\n", |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1488 | -ret ); |
| 1489 | goto exit; |
| 1490 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1491 | } |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1492 | if( strlen( opt.key_file ) && strcmp( opt.key_file, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1493 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1494 | key_cert_init++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1495 | if( ( ret = mbedtls_pk_parse_keyfile( &pkey, opt.key_file, "" ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1496 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1497 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1498 | goto exit; |
| 1499 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1500 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1501 | if( key_cert_init == 1 ) |
| 1502 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1503 | mbedtls_printf( " failed\n ! crt_file without key_file or vice-versa\n\n" ); |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1504 | goto exit; |
| 1505 | } |
| 1506 | |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1507 | if( strlen( opt.crt_file2 ) && strcmp( opt.crt_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1508 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1509 | key_cert_init2++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1510 | if( ( ret = mbedtls_x509_crt_parse_file( &srvcert2, opt.crt_file2 ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1511 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1512 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file(2) returned -0x%x\n\n", |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1513 | -ret ); |
| 1514 | goto exit; |
| 1515 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1516 | } |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1517 | if( strlen( opt.key_file2 ) && strcmp( opt.key_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1518 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1519 | key_cert_init2++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1520 | if( ( ret = mbedtls_pk_parse_keyfile( &pkey2, opt.key_file2, "" ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1521 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1522 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile(2) returned -0x%x\n\n", |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1523 | -ret ); |
| 1524 | goto exit; |
| 1525 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1526 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1527 | if( key_cert_init2 == 1 ) |
| 1528 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1529 | mbedtls_printf( " failed\n ! crt_file2 without key_file2 or vice-versa\n\n" ); |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1530 | goto exit; |
| 1531 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1532 | #endif |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1533 | if( key_cert_init == 0 && |
| 1534 | strcmp( opt.crt_file, "none" ) != 0 && |
| 1535 | strcmp( opt.key_file, "none" ) != 0 && |
| 1536 | key_cert_init2 == 0 && |
| 1537 | strcmp( opt.crt_file2, "none" ) != 0 && |
| 1538 | strcmp( opt.key_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1539 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1540 | #if !defined(MBEDTLS_CERTS_C) |
| 1541 | mbedtls_printf( "Not certificated or key provided, and \n" |
| 1542 | "MBEDTLS_CERTS_C not defined!\n" ); |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1543 | goto exit; |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1544 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1545 | #if defined(MBEDTLS_RSA_C) |
| 1546 | if( ( ret = mbedtls_x509_crt_parse( &srvcert, |
| 1547 | (const unsigned char *) mbedtls_test_srv_crt_rsa, |
| 1548 | mbedtls_test_srv_crt_rsa_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1549 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1550 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1551 | goto exit; |
| 1552 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1553 | if( ( ret = mbedtls_pk_parse_key( &pkey, |
| 1554 | (const unsigned char *) mbedtls_test_srv_key_rsa, |
| 1555 | mbedtls_test_srv_key_rsa_len, NULL, 0 ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1556 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1557 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_key returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1558 | goto exit; |
| 1559 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1560 | key_cert_init = 2; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1561 | #endif /* MBEDTLS_RSA_C */ |
| 1562 | #if defined(MBEDTLS_ECDSA_C) |
| 1563 | if( ( ret = mbedtls_x509_crt_parse( &srvcert2, |
| 1564 | (const unsigned char *) mbedtls_test_srv_crt_ec, |
| 1565 | mbedtls_test_srv_crt_ec_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1566 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1567 | mbedtls_printf( " failed\n ! x509_crt_parse2 returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1568 | goto exit; |
| 1569 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1570 | if( ( ret = mbedtls_pk_parse_key( &pkey2, |
| 1571 | (const unsigned char *) mbedtls_test_srv_key_ec, |
| 1572 | mbedtls_test_srv_key_ec_len, NULL, 0 ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1573 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1574 | mbedtls_printf( " failed\n ! pk_parse_key2 returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1575 | goto exit; |
| 1576 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1577 | key_cert_init2 = 2; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1578 | #endif /* MBEDTLS_ECDSA_C */ |
| 1579 | #endif /* MBEDTLS_CERTS_C */ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1580 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1581 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1582 | mbedtls_printf( " ok\n" ); |
| 1583 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1584 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1585 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1586 | if( opt.dhm_file != NULL ) |
| 1587 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1588 | mbedtls_printf( " . Loading DHM parameters..." ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1589 | fflush( stdout ); |
| 1590 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1591 | if( ( ret = mbedtls_dhm_parse_dhmfile( &dhm, opt.dhm_file ) ) != 0 ) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1592 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1593 | mbedtls_printf( " failed\n ! mbedtls_dhm_parse_dhmfile returned -0x%04X\n\n", |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1594 | -ret ); |
| 1595 | goto exit; |
| 1596 | } |
| 1597 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1598 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1599 | } |
| 1600 | #endif |
| 1601 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 1602 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1603 | if( opt.sni != NULL ) |
| 1604 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1605 | mbedtls_printf( " . Setting up SNI information..." ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1606 | fflush( stdout ); |
| 1607 | |
| 1608 | if( ( sni_info = sni_parse( opt.sni ) ) == NULL ) |
| 1609 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1610 | mbedtls_printf( " failed\n" ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1611 | goto exit; |
| 1612 | } |
| 1613 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1614 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1615 | } |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 1616 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1617 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1618 | /* |
| 1619 | * 2. Setup the listening TCP socket |
| 1620 | */ |
Manuel Pégourié-Gonnard | c0d7494 | 2015-06-23 12:30:57 +0200 | [diff] [blame] | 1621 | mbedtls_printf( " . Bind on %s://%s:%s/ ...", |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1622 | opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ? "tcp" : "udp", |
Manuel Pégourié-Gonnard | 8a06d9c | 2014-03-23 18:23:41 +0100 | [diff] [blame] | 1623 | opt.server_addr ? opt.server_addr : "*", |
| 1624 | opt.server_port ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1625 | fflush( stdout ); |
| 1626 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1627 | if( ( ret = mbedtls_net_bind( &listen_fd, opt.server_addr, opt.server_port, |
| 1628 | opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ? |
| 1629 | MBEDTLS_NET_PROTO_TCP : MBEDTLS_NET_PROTO_UDP ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1630 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1631 | mbedtls_printf( " failed\n ! mbedtls_net_bind returned -0x%x\n\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1632 | goto exit; |
| 1633 | } |
| 1634 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1635 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1636 | |
| 1637 | /* |
| 1638 | * 3. Setup stuff |
| 1639 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1640 | mbedtls_printf( " . Setting up the SSL/TLS structure..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1641 | fflush( stdout ); |
| 1642 | |
Manuel Pégourié-Gonnard | 419d5ae | 2015-05-04 19:32:36 +0200 | [diff] [blame] | 1643 | if( ( ret = mbedtls_ssl_config_defaults( &conf, |
| 1644 | MBEDTLS_SSL_IS_SERVER, |
Manuel Pégourié-Gonnard | b31c5f6 | 2015-06-17 13:53:47 +0200 | [diff] [blame] | 1645 | opt.transport, |
| 1646 | MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 ) |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 1647 | { |
| 1648 | mbedtls_printf( " failed\n ! mbedtls_ssl_config_defaults returned -0x%x\n\n", -ret ); |
| 1649 | goto exit; |
| 1650 | } |
| 1651 | |
Gilles Peskine | dd57d75 | 2017-05-05 18:59:02 +0200 | [diff] [blame] | 1652 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 1653 | /* The default algorithms profile disables SHA-1, but our tests still |
| 1654 | rely on it heavily. Hence we allow it here. A real-world server |
| 1655 | should use the default profile unless there is a good reason not to. */ |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1656 | if( opt.allow_sha1 > 0 ) |
| 1657 | { |
| 1658 | crt_profile_for_test.allowed_mds |= MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA1 ); |
| 1659 | mbedtls_ssl_conf_cert_profile( &conf, &crt_profile_for_test ); |
Gilles Peskine | db56aca | 2017-05-11 19:01:11 +0200 | [diff] [blame] | 1660 | mbedtls_ssl_conf_sig_hashes( &conf, ssl_sig_hashes_for_test ); |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1661 | } |
Gilles Peskine | dd57d75 | 2017-05-05 18:59:02 +0200 | [diff] [blame] | 1662 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
| 1663 | |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1664 | if( opt.auth_mode != DFL_AUTH_MODE ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1665 | mbedtls_ssl_conf_authmode( &conf, opt.auth_mode ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1666 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1667 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 1668 | if( opt.hs_to_min != DFL_HS_TO_MIN || opt.hs_to_max != DFL_HS_TO_MAX ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1669 | mbedtls_ssl_conf_handshake_timeout( &conf, opt.hs_to_min, opt.hs_to_max ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1670 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 1671 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1672 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1673 | if( ( ret = mbedtls_ssl_conf_max_frag_len( &conf, opt.mfl_code ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1674 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1675 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_max_frag_len returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1676 | goto exit; |
| 1677 | }; |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 1678 | #endif |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1679 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1680 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1681 | if( opt.trunc_hmac != DFL_TRUNC_HMAC ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1682 | mbedtls_ssl_conf_truncated_hmac( &conf, opt.trunc_hmac ); |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1683 | #endif |
| 1684 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1685 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1686 | if( opt.extended_ms != DFL_EXTENDED_MS ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1687 | mbedtls_ssl_conf_extended_master_secret( &conf, opt.extended_ms ); |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1688 | #endif |
| 1689 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1690 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1691 | if( opt.etm != DFL_ETM ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1692 | mbedtls_ssl_conf_encrypt_then_mac( &conf, opt.etm ); |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1693 | #endif |
| 1694 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1695 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1696 | if( opt.alpn_string != NULL ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1697 | if( ( ret = mbedtls_ssl_conf_alpn_protocols( &conf, alpn_list ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1698 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1699 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_alpn_protocols returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1700 | goto exit; |
| 1701 | } |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1702 | #endif |
| 1703 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1704 | mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg ); |
| 1705 | mbedtls_ssl_conf_dbg( &conf, my_debug, stdout ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1706 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1707 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1708 | if( opt.cache_max != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1709 | mbedtls_ssl_cache_set_max_entries( &cache, opt.cache_max ); |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1710 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1711 | if( opt.cache_timeout != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1712 | mbedtls_ssl_cache_set_timeout( &cache, opt.cache_timeout ); |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1713 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1714 | mbedtls_ssl_conf_session_cache( &conf, &cache, |
Manuel Pégourié-Gonnard | 5cb3308 | 2015-05-06 18:06:26 +0100 | [diff] [blame] | 1715 | mbedtls_ssl_cache_get, |
| 1716 | mbedtls_ssl_cache_set ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 1717 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1718 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1719 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 1720 | if( opt.tickets == MBEDTLS_SSL_SESSION_TICKETS_ENABLED ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1721 | { |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 1722 | if( ( ret = mbedtls_ssl_ticket_setup( &ticket_ctx, |
| 1723 | mbedtls_ctr_drbg_random, &ctr_drbg, |
Manuel Pégourié-Gonnard | a0adc1b | 2015-05-25 10:35:16 +0200 | [diff] [blame] | 1724 | MBEDTLS_CIPHER_AES_256_GCM, |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 1725 | opt.ticket_timeout ) ) != 0 ) |
| 1726 | { |
| 1727 | mbedtls_printf( " failed\n ! mbedtls_ssl_ticket_setup returned %d\n\n", ret ); |
| 1728 | goto exit; |
| 1729 | } |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 1730 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 1731 | mbedtls_ssl_conf_session_tickets_cb( &conf, |
| 1732 | mbedtls_ssl_ticket_write, |
| 1733 | mbedtls_ssl_ticket_parse, |
| 1734 | &ticket_ctx ); |
| 1735 | } |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 1736 | #endif |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 1737 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1738 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 1739 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 1740 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1741 | #if defined(MBEDTLS_SSL_COOKIE_C) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1742 | if( opt.cookies > 0 ) |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 1743 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1744 | if( ( ret = mbedtls_ssl_cookie_setup( &cookie_ctx, |
| 1745 | mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 ) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1746 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1747 | mbedtls_printf( " failed\n ! mbedtls_ssl_cookie_setup returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1748 | goto exit; |
| 1749 | } |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 1750 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1751 | mbedtls_ssl_conf_dtls_cookies( &conf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1752 | &cookie_ctx ); |
| 1753 | } |
| 1754 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1755 | #endif /* MBEDTLS_SSL_COOKIE_C */ |
| 1756 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1757 | if( opt.cookies == 0 ) |
| 1758 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1759 | mbedtls_ssl_conf_dtls_cookies( &conf, NULL, NULL, NULL ); |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1760 | } |
| 1761 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1762 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1763 | { |
| 1764 | ; /* Nothing to do */ |
| 1765 | } |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1766 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1767 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1768 | if( opt.anti_replay != DFL_ANTI_REPLAY ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1769 | mbedtls_ssl_conf_dtls_anti_replay( &conf, opt.anti_replay ); |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 1770 | #endif |
| 1771 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1772 | #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 1773 | if( opt.badmac_limit != DFL_BADMAC_LIMIT ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1774 | mbedtls_ssl_conf_dtls_badmac_limit( &conf, opt.badmac_limit ); |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1775 | #endif |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 1776 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1777 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 1778 | |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1779 | if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1780 | mbedtls_ssl_conf_ciphersuites( &conf, opt.force_ciphersuite ); |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1781 | |
Manuel Pégourié-Gonnard | 66dc555 | 2015-05-14 12:28:21 +0200 | [diff] [blame] | 1782 | #if defined(MBEDTLS_ARC4_C) |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1783 | if( opt.arc4 != DFL_ARC4 ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1784 | mbedtls_ssl_conf_arc4_support( &conf, opt.arc4 ); |
Manuel Pégourié-Gonnard | 66dc555 | 2015-05-14 12:28:21 +0200 | [diff] [blame] | 1785 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1786 | |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1787 | if( opt.version_suites != NULL ) |
| 1788 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1789 | mbedtls_ssl_conf_ciphersuites_for_version( &conf, version_suites[0], |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1790 | MBEDTLS_SSL_MAJOR_VERSION_3, |
| 1791 | MBEDTLS_SSL_MINOR_VERSION_0 ); |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1792 | mbedtls_ssl_conf_ciphersuites_for_version( &conf, version_suites[1], |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1793 | MBEDTLS_SSL_MAJOR_VERSION_3, |
| 1794 | MBEDTLS_SSL_MINOR_VERSION_1 ); |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1795 | mbedtls_ssl_conf_ciphersuites_for_version( &conf, version_suites[2], |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1796 | MBEDTLS_SSL_MAJOR_VERSION_3, |
| 1797 | MBEDTLS_SSL_MINOR_VERSION_2 ); |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1798 | mbedtls_ssl_conf_ciphersuites_for_version( &conf, version_suites[3], |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1799 | MBEDTLS_SSL_MAJOR_VERSION_3, |
| 1800 | MBEDTLS_SSL_MINOR_VERSION_3 ); |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1801 | } |
| 1802 | |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1803 | if( opt.allow_legacy != DFL_ALLOW_LEGACY ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1804 | mbedtls_ssl_conf_legacy_renegotiation( &conf, opt.allow_legacy ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1805 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1806 | mbedtls_ssl_conf_renegotiation( &conf, opt.renegotiation ); |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1807 | |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1808 | if( opt.renego_delay != DFL_RENEGO_DELAY ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1809 | mbedtls_ssl_conf_renegotiation_enforced( &conf, opt.renego_delay ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1810 | |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1811 | if( opt.renego_period != DFL_RENEGO_PERIOD ) |
| 1812 | { |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 1813 | PUT_UINT64_BE( renego_period, opt.renego_period, 0 ); |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1814 | mbedtls_ssl_conf_renegotiation_period( &conf, renego_period ); |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1815 | } |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 1816 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1817 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1818 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1819 | if( strcmp( opt.ca_path, "none" ) != 0 && |
| 1820 | strcmp( opt.ca_file, "none" ) != 0 ) |
| 1821 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1822 | mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL ); |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1823 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1824 | if( key_cert_init ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1825 | if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &srvcert, &pkey ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1826 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1827 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1828 | goto exit; |
| 1829 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1830 | if( key_cert_init2 ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1831 | if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &srvcert2, &pkey2 ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1832 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1833 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1834 | goto exit; |
| 1835 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1836 | #endif |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 1837 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 1838 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1839 | if( opt.sni != NULL ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1840 | mbedtls_ssl_conf_sni( &conf, sni_callback, sni_info ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1841 | #endif |
| 1842 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1843 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 1844 | if( strlen( opt.psk ) != 0 && strlen( opt.psk_identity ) != 0 ) |
| 1845 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1846 | ret = mbedtls_ssl_conf_psk( &conf, psk, psk_len, |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 1847 | (const unsigned char *) opt.psk_identity, |
| 1848 | strlen( opt.psk_identity ) ); |
| 1849 | if( ret != 0 ) |
| 1850 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1851 | mbedtls_printf( " failed\n mbedtls_ssl_conf_psk returned -0x%04X\n\n", - ret ); |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 1852 | goto exit; |
| 1853 | } |
| 1854 | } |
| 1855 | |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1856 | if( opt.psk_list != NULL ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1857 | mbedtls_ssl_conf_psk_cb( &conf, psk_callback, psk_info ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 1858 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1859 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1860 | #if defined(MBEDTLS_DHM_C) |
Paul Bakker | 5d19f86 | 2012-09-28 07:33:00 +0000 | [diff] [blame] | 1861 | /* |
| 1862 | * Use different group than default DHM group |
| 1863 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1864 | #if defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1865 | if( opt.dhm_file != NULL ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1866 | ret = mbedtls_ssl_conf_dh_param_ctx( &conf, &dhm ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1867 | #endif |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1868 | if( ret != 0 ) |
| 1869 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1870 | mbedtls_printf( " failed\n mbedtls_ssl_conf_dh_param returned -0x%04X\n\n", - ret ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1871 | goto exit; |
| 1872 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1873 | #endif |
| 1874 | |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 1875 | if( opt.min_version != DFL_MIN_VERSION ) |
Manuel Pégourié-Gonnard | 01e5e8c | 2015-05-11 10:11:56 +0200 | [diff] [blame] | 1876 | mbedtls_ssl_conf_min_version( &conf, MBEDTLS_SSL_MAJOR_VERSION_3, opt.min_version ); |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1877 | |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 1878 | if( opt.max_version != DFL_MIN_VERSION ) |
Manuel Pégourié-Gonnard | 01e5e8c | 2015-05-11 10:11:56 +0200 | [diff] [blame] | 1879 | mbedtls_ssl_conf_max_version( &conf, MBEDTLS_SSL_MAJOR_VERSION_3, opt.max_version ); |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1880 | |
Manuel Pégourié-Gonnard | 06939ce | 2015-05-11 11:25:46 +0200 | [diff] [blame] | 1881 | if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 ) |
| 1882 | { |
| 1883 | mbedtls_printf( " failed\n ! mbedtls_ssl_setup returned -0x%x\n\n", -ret ); |
| 1884 | goto exit; |
| 1885 | } |
| 1886 | |
| 1887 | if( opt.nbio == 2 ) |
| 1888 | mbedtls_ssl_set_bio( &ssl, &client_fd, my_send, my_recv, NULL ); |
| 1889 | else |
| 1890 | mbedtls_ssl_set_bio( &ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, |
Manuel Pégourié-Gonnard | d4f04db | 2015-05-14 18:58:17 +0200 | [diff] [blame] | 1891 | opt.nbio == 0 ? mbedtls_net_recv_timeout : NULL ); |
Manuel Pégourié-Gonnard | 06939ce | 2015-05-11 11:25:46 +0200 | [diff] [blame] | 1892 | |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 1893 | #if defined(MBEDTLS_TIMING_C) |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 1894 | mbedtls_ssl_set_timer_cb( &ssl, &timer, mbedtls_timing_set_delay, |
| 1895 | mbedtls_timing_get_delay ); |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 1896 | #endif |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 1897 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1898 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1899 | |
| 1900 | reset: |
Manuel Pégourié-Gonnard | b6440a4 | 2014-09-20 12:03:00 +0200 | [diff] [blame] | 1901 | #if !defined(_WIN32) |
| 1902 | if( received_sigterm ) |
| 1903 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1904 | mbedtls_printf( " interrupted by SIGTERM\n" ); |
Manuel Pégourié-Gonnard | b6440a4 | 2014-09-20 12:03:00 +0200 | [diff] [blame] | 1905 | ret = 0; |
| 1906 | goto exit; |
| 1907 | } |
| 1908 | #endif |
| 1909 | |
Manuel Pégourié-Gonnard | 3f09b6d | 2015-09-08 11:58:14 +0200 | [diff] [blame] | 1910 | if( ret == MBEDTLS_ERR_SSL_CLIENT_RECONNECT ) |
| 1911 | { |
| 1912 | mbedtls_printf( " ! Client initiated reconnection from same port\n" ); |
| 1913 | goto handshake; |
| 1914 | } |
| 1915 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1916 | #ifdef MBEDTLS_ERROR_C |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1917 | if( ret != 0 ) |
| 1918 | { |
| 1919 | char error_buf[100]; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1920 | mbedtls_strerror( ret, error_buf, 100 ); |
| 1921 | mbedtls_printf("Last error was: %d - %s\n\n", ret, error_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1922 | } |
| 1923 | #endif |
| 1924 | |
Manuel Pégourié-Gonnard | 3d7d00a | 2015-06-30 15:55:03 +0200 | [diff] [blame] | 1925 | mbedtls_net_free( &client_fd ); |
Manuel Pégourié-Gonnard | 8a06d9c | 2014-03-23 18:23:41 +0100 | [diff] [blame] | 1926 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1927 | mbedtls_ssl_session_reset( &ssl ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1928 | |
| 1929 | /* |
| 1930 | * 3. Wait until a client connects |
| 1931 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1932 | mbedtls_printf( " . Waiting for a remote connection ..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1933 | fflush( stdout ); |
| 1934 | |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 1935 | if( ( ret = mbedtls_net_accept( &listen_fd, &client_fd, |
Manuel Pégourié-Gonnard | 0b104b0 | 2015-05-14 21:52:40 +0200 | [diff] [blame] | 1936 | client_ip, sizeof( client_ip ), &cliip_len ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1937 | { |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 1938 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 1939 | if( received_sigterm ) |
| 1940 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1941 | mbedtls_printf( " interrupted by signal\n" ); |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 1942 | ret = 0; |
| 1943 | goto exit; |
| 1944 | } |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 1945 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 1946 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1947 | mbedtls_printf( " failed\n ! mbedtls_net_accept returned -0x%x\n\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1948 | goto exit; |
| 1949 | } |
| 1950 | |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1951 | if( opt.nbio > 0 ) |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 1952 | ret = mbedtls_net_set_nonblock( &client_fd ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1953 | else |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 1954 | ret = mbedtls_net_set_block( &client_fd ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1955 | if( ret != 0 ) |
| 1956 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1957 | mbedtls_printf( " failed\n ! net_set_(non)block() returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1958 | goto exit; |
| 1959 | } |
| 1960 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 1961 | mbedtls_ssl_conf_read_timeout( &conf, opt.read_timeout ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1962 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1963 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
| 1964 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1965 | { |
Manuel Pégourié-Gonnard | 0b104b0 | 2015-05-14 21:52:40 +0200 | [diff] [blame] | 1966 | if( ( ret = mbedtls_ssl_set_client_transport_id( &ssl, |
| 1967 | client_ip, cliip_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1968 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1969 | mbedtls_printf( " failed\n ! " |
Manuel Pégourié-Gonnard | 151dc77 | 2015-05-14 13:55:51 +0200 | [diff] [blame] | 1970 | "mbedtls_ssl_set_client_transport_id() returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1971 | goto exit; |
| 1972 | } |
| 1973 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1974 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1975 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1976 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1977 | |
| 1978 | /* |
| 1979 | * 4. Handshake |
| 1980 | */ |
Manuel Pégourié-Gonnard | 3f09b6d | 2015-09-08 11:58:14 +0200 | [diff] [blame] | 1981 | handshake: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1982 | mbedtls_printf( " . Performing the SSL/TLS handshake..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1983 | fflush( stdout ); |
| 1984 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1985 | do ret = mbedtls_ssl_handshake( &ssl ); |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 1986 | while( ret == MBEDTLS_ERR_SSL_WANT_READ || |
| 1987 | ret == MBEDTLS_ERR_SSL_WANT_WRITE ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1988 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1989 | if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ) |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 1990 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1991 | mbedtls_printf( " hello verification requested\n" ); |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 1992 | ret = 0; |
| 1993 | goto reset; |
| 1994 | } |
| 1995 | else if( ret != 0 ) |
| 1996 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1997 | mbedtls_printf( " failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 1998 | |
| 1999 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 2000 | if( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ) |
| 2001 | { |
| 2002 | char vrfy_buf[512]; |
Manuel Pégourié-Gonnard | ea35666 | 2015-08-27 12:02:40 +0200 | [diff] [blame] | 2003 | flags = mbedtls_ssl_get_verify_result( &ssl ); |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2004 | |
| 2005 | mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", flags ); |
| 2006 | |
| 2007 | mbedtls_printf( "%s\n", vrfy_buf ); |
| 2008 | } |
| 2009 | #endif |
| 2010 | |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 2011 | goto reset; |
| 2012 | } |
| 2013 | else /* ret == 0 */ |
| 2014 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2015 | mbedtls_printf( " ok\n [ Protocol is %s ]\n [ Ciphersuite is %s ]\n", |
| 2016 | mbedtls_ssl_get_version( &ssl ), mbedtls_ssl_get_ciphersuite( &ssl ) ); |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 2017 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2018 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2019 | if( ( ret = mbedtls_ssl_get_record_expansion( &ssl ) ) >= 0 ) |
| 2020 | mbedtls_printf( " [ Record expansion is %d ]\n", ret ); |
Manuel Pégourié-Gonnard | 9b35f18 | 2014-10-14 17:47:31 +0200 | [diff] [blame] | 2021 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2022 | mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" ); |
Manuel Pégourié-Gonnard | 9b35f18 | 2014-10-14 17:47:31 +0200 | [diff] [blame] | 2023 | |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 2024 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
| 2025 | mbedtls_printf( " [ Maximum fragment length is %u ]\n", |
| 2026 | (unsigned int) mbedtls_ssl_get_max_frag_len( &ssl ) ); |
| 2027 | #endif |
| 2028 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2029 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 2030 | if( opt.alpn_string != NULL ) |
| 2031 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2032 | const char *alp = mbedtls_ssl_get_alpn_protocol( &ssl ); |
| 2033 | mbedtls_printf( " [ Application Layer Protocol is %s ]\n", |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 2034 | alp ? alp : "(none)" ); |
| 2035 | } |
| 2036 | #endif |
| 2037 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2038 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2039 | /* |
| 2040 | * 5. Verify the server certificate |
| 2041 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2042 | mbedtls_printf( " . Verifying peer X.509 certificate..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2043 | |
Manuel Pégourié-Gonnard | e6ef16f | 2015-05-11 19:54:43 +0200 | [diff] [blame] | 2044 | if( ( flags = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2045 | { |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 2046 | char vrfy_buf[512]; |
| 2047 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2048 | mbedtls_printf( " failed\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2049 | |
Manuel Pégourié-Gonnard | e6ef16f | 2015-05-11 19:54:43 +0200 | [diff] [blame] | 2050 | mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", flags ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2051 | |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 2052 | mbedtls_printf( "%s\n", vrfy_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2053 | } |
| 2054 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2055 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2056 | |
Manuel Pégourié-Gonnard | 1c5b9fc | 2015-06-27 14:38:51 +0200 | [diff] [blame] | 2057 | if( mbedtls_ssl_get_peer_cert( &ssl ) != NULL ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2058 | { |
Manuel Pégourié-Gonnard | 1c5b9fc | 2015-06-27 14:38:51 +0200 | [diff] [blame] | 2059 | char crt_buf[512]; |
| 2060 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2061 | mbedtls_printf( " . Peer certificate information ...\n" ); |
Manuel Pégourié-Gonnard | 1c5b9fc | 2015-06-27 14:38:51 +0200 | [diff] [blame] | 2062 | mbedtls_x509_crt_info( crt_buf, sizeof( crt_buf ), " ", |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2063 | mbedtls_ssl_get_peer_cert( &ssl ) ); |
Manuel Pégourié-Gonnard | 6755717 | 2015-07-02 11:15:48 +0200 | [diff] [blame] | 2064 | mbedtls_printf( "%s\n", crt_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2065 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2066 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2067 | |
Manuel Pégourié-Gonnard | 6a2bc23 | 2014-10-09 15:33:13 +0200 | [diff] [blame] | 2068 | if( opt.exchanges == 0 ) |
| 2069 | goto close_notify; |
| 2070 | |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 2071 | exchanges_left = opt.exchanges; |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2072 | data_exchange: |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2073 | /* |
| 2074 | * 6. Read the HTTP Request |
| 2075 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2076 | mbedtls_printf( " < Read from client:" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2077 | fflush( stdout ); |
| 2078 | |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2079 | /* |
| 2080 | * TLS and DTLS need different reading styles (stream vs datagram) |
| 2081 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2082 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2083 | { |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2084 | do |
| 2085 | { |
| 2086 | int terminated = 0; |
| 2087 | len = sizeof( buf ) - 1; |
| 2088 | memset( buf, 0, sizeof( buf ) ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2089 | ret = mbedtls_ssl_read( &ssl, buf, len ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2090 | |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 2091 | if( ret == MBEDTLS_ERR_SSL_WANT_READ || |
| 2092 | ret == MBEDTLS_ERR_SSL_WANT_WRITE ) |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2093 | continue; |
| 2094 | |
| 2095 | if( ret <= 0 ) |
| 2096 | { |
| 2097 | switch( ret ) |
| 2098 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2099 | case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: |
| 2100 | mbedtls_printf( " connection was closed gracefully\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2101 | goto close_notify; |
| 2102 | |
| 2103 | case 0: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2104 | case MBEDTLS_ERR_NET_CONN_RESET: |
| 2105 | mbedtls_printf( " connection was reset by peer\n" ); |
| 2106 | ret = MBEDTLS_ERR_NET_CONN_RESET; |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2107 | goto reset; |
| 2108 | |
| 2109 | default: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2110 | mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", -ret ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2111 | goto reset; |
| 2112 | } |
| 2113 | } |
| 2114 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2115 | if( mbedtls_ssl_get_bytes_avail( &ssl ) == 0 ) |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2116 | { |
| 2117 | len = ret; |
| 2118 | buf[len] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2119 | mbedtls_printf( " %d bytes read\n\n%s\n", len, (char *) buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2120 | |
| 2121 | /* End of message should be detected according to the syntax of the |
| 2122 | * application protocol (eg HTTP), just use a dummy test here. */ |
| 2123 | if( buf[len - 1] == '\n' ) |
| 2124 | terminated = 1; |
| 2125 | } |
| 2126 | else |
| 2127 | { |
| 2128 | int extra_len, ori_len; |
| 2129 | unsigned char *larger_buf; |
| 2130 | |
| 2131 | ori_len = ret; |
Manuel Pégourié-Gonnard | 9de64f5 | 2015-07-01 15:51:43 +0200 | [diff] [blame] | 2132 | extra_len = (int) mbedtls_ssl_get_bytes_avail( &ssl ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2133 | |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 2134 | larger_buf = mbedtls_calloc( 1, ori_len + extra_len + 1 ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2135 | if( larger_buf == NULL ) |
| 2136 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2137 | mbedtls_printf( " ! memory allocation failed\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2138 | ret = 1; |
| 2139 | goto reset; |
| 2140 | } |
| 2141 | |
| 2142 | memset( larger_buf, 0, ori_len + extra_len ); |
| 2143 | memcpy( larger_buf, buf, ori_len ); |
| 2144 | |
| 2145 | /* This read should never fail and get the whole cached data */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2146 | ret = mbedtls_ssl_read( &ssl, larger_buf + ori_len, extra_len ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2147 | if( ret != extra_len || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2148 | mbedtls_ssl_get_bytes_avail( &ssl ) != 0 ) |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2149 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2150 | mbedtls_printf( " ! mbedtls_ssl_read failed on cached data\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2151 | ret = 1; |
| 2152 | goto reset; |
| 2153 | } |
| 2154 | |
| 2155 | larger_buf[ori_len + extra_len] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2156 | mbedtls_printf( " %u bytes read (%u + %u)\n\n%s\n", |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2157 | ori_len + extra_len, ori_len, extra_len, |
| 2158 | (char *) larger_buf ); |
| 2159 | |
| 2160 | /* End of message should be detected according to the syntax of the |
| 2161 | * application protocol (eg HTTP), just use a dummy test here. */ |
| 2162 | if( larger_buf[ori_len + extra_len - 1] == '\n' ) |
| 2163 | terminated = 1; |
| 2164 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2165 | mbedtls_free( larger_buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2166 | } |
| 2167 | |
| 2168 | if( terminated ) |
| 2169 | { |
| 2170 | ret = 0; |
| 2171 | break; |
| 2172 | } |
| 2173 | } |
| 2174 | while( 1 ); |
| 2175 | } |
| 2176 | else /* Not stream, so datagram */ |
| 2177 | { |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2178 | len = sizeof( buf ) - 1; |
| 2179 | memset( buf, 0, sizeof( buf ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2180 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2181 | do ret = mbedtls_ssl_read( &ssl, buf, len ); |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 2182 | while( ret == MBEDTLS_ERR_SSL_WANT_READ || |
| 2183 | ret == MBEDTLS_ERR_SSL_WANT_WRITE ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2184 | |
| 2185 | if( ret <= 0 ) |
| 2186 | { |
| 2187 | switch( ret ) |
| 2188 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2189 | case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: |
| 2190 | mbedtls_printf( " connection was closed gracefully\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2191 | ret = 0; |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2192 | goto close_notify; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2193 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2194 | default: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2195 | mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", -ret ); |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2196 | goto reset; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2197 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2198 | } |
| 2199 | |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2200 | len = ret; |
| 2201 | buf[len] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2202 | mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2203 | ret = 0; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2204 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2205 | |
| 2206 | /* |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2207 | * 7a. Request renegotiation while client is waiting for input from us. |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 2208 | * (only on the first exchange, to be able to test retransmission) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2209 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2210 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 3a173f4 | 2015-01-22 13:30:33 +0000 | [diff] [blame] | 2211 | if( opt.renegotiate && exchanges_left == opt.exchanges ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2212 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2213 | mbedtls_printf( " . Requestion renegotiation..." ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2214 | fflush( stdout ); |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2215 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2216 | while( ( ret = mbedtls_ssl_renegotiate( &ssl ) ) != 0 ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2217 | { |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 2218 | if( ret != MBEDTLS_ERR_SSL_WANT_READ && |
| 2219 | ret != MBEDTLS_ERR_SSL_WANT_WRITE ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2220 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2221 | mbedtls_printf( " failed\n ! mbedtls_ssl_renegotiate returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2222 | goto reset; |
| 2223 | } |
| 2224 | } |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2225 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2226 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2227 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2228 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2229 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2230 | /* |
| 2231 | * 7. Write the 200 Response |
| 2232 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2233 | mbedtls_printf( " > Write to client:" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2234 | fflush( stdout ); |
| 2235 | |
| 2236 | len = sprintf( (char *) buf, HTTP_RESPONSE, |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2237 | mbedtls_ssl_get_ciphersuite( &ssl ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2238 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2239 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2240 | { |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2241 | for( written = 0, frags = 0; written < len; written += ret, frags++ ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2242 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2243 | while( ( ret = mbedtls_ssl_write( &ssl, buf + written, len - written ) ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2244 | <= 0 ) |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 2245 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2246 | if( ret == MBEDTLS_ERR_NET_CONN_RESET ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2247 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2248 | mbedtls_printf( " failed\n ! peer closed the connection\n\n" ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2249 | goto reset; |
| 2250 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2251 | |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 2252 | if( ret != MBEDTLS_ERR_SSL_WANT_READ && |
| 2253 | ret != MBEDTLS_ERR_SSL_WANT_WRITE ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2254 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2255 | mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2256 | goto reset; |
| 2257 | } |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 2258 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2259 | } |
| 2260 | } |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2261 | else /* Not stream, so datagram */ |
| 2262 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2263 | do ret = mbedtls_ssl_write( &ssl, buf, len ); |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 2264 | while( ret == MBEDTLS_ERR_SSL_WANT_READ || |
| 2265 | ret == MBEDTLS_ERR_SSL_WANT_WRITE ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2266 | |
| 2267 | if( ret < 0 ) |
| 2268 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2269 | mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2270 | goto reset; |
| 2271 | } |
| 2272 | |
| 2273 | frags = 1; |
| 2274 | written = ret; |
| 2275 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2276 | |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 2277 | buf[written] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2278 | mbedtls_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf ); |
Manuel Pégourié-Gonnard | a92ed48 | 2015-01-14 10:46:08 +0100 | [diff] [blame] | 2279 | ret = 0; |
Manuel Pégourié-Gonnard | f3dc2f6 | 2013-10-29 18:17:41 +0100 | [diff] [blame] | 2280 | |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2281 | /* |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2282 | * 7b. Continue doing data exchanges? |
| 2283 | */ |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 2284 | if( --exchanges_left > 0 ) |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2285 | goto data_exchange; |
| 2286 | |
| 2287 | /* |
| 2288 | * 8. Done, cleanly close the connection |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2289 | */ |
| 2290 | close_notify: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2291 | mbedtls_printf( " . Closing the connection..." ); |
Manuel Pégourié-Gonnard | 6b0d268 | 2014-03-25 11:24:43 +0100 | [diff] [blame] | 2292 | |
Manuel Pégourié-Gonnard | 994f8b5 | 2014-10-09 19:56:44 +0200 | [diff] [blame] | 2293 | /* No error checking, the connection might be closed already */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2294 | do ret = mbedtls_ssl_close_notify( &ssl ); |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 2295 | while( ret == MBEDTLS_ERR_SSL_WANT_WRITE ); |
Manuel Pégourié-Gonnard | 994f8b5 | 2014-10-09 19:56:44 +0200 | [diff] [blame] | 2296 | ret = 0; |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2297 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2298 | mbedtls_printf( " done\n" ); |
Rich Evans | f90016a | 2015-01-19 14:26:37 +0000 | [diff] [blame] | 2299 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2300 | goto reset; |
| 2301 | |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2302 | /* |
| 2303 | * Cleanup and exit |
| 2304 | */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2305 | exit: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2306 | #ifdef MBEDTLS_ERROR_C |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2307 | if( ret != 0 ) |
| 2308 | { |
| 2309 | char error_buf[100]; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2310 | mbedtls_strerror( ret, error_buf, 100 ); |
| 2311 | mbedtls_printf("Last error was: -0x%X - %s\n\n", -ret, error_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2312 | } |
| 2313 | #endif |
| 2314 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2315 | mbedtls_printf( " . Cleaning up..." ); |
Manuel Pégourié-Gonnard | f29e5de | 2014-11-21 11:54:41 +0100 | [diff] [blame] | 2316 | fflush( stdout ); |
| 2317 | |
Manuel Pégourié-Gonnard | 3d7d00a | 2015-06-30 15:55:03 +0200 | [diff] [blame] | 2318 | mbedtls_net_free( &client_fd ); |
| 2319 | mbedtls_net_free( &listen_fd ); |
Paul Bakker | 0c22610 | 2014-04-17 16:02:36 +0200 | [diff] [blame] | 2320 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2321 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 2322 | mbedtls_dhm_free( &dhm ); |
Paul Bakker | a317a98 | 2014-06-18 16:44:11 +0200 | [diff] [blame] | 2323 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2324 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 2325 | mbedtls_x509_crt_free( &cacert ); |
| 2326 | mbedtls_x509_crt_free( &srvcert ); |
| 2327 | mbedtls_pk_free( &pkey ); |
| 2328 | mbedtls_x509_crt_free( &srvcert2 ); |
| 2329 | mbedtls_pk_free( &pkey2 ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 2330 | #endif |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 2331 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2332 | sni_free( sni_info ); |
| 2333 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2334 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Manuel Pégourié-Gonnard | 4505ed3 | 2014-06-19 20:56:52 +0200 | [diff] [blame] | 2335 | psk_free( psk_info ); |
| 2336 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2337 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 2338 | mbedtls_dhm_free( &dhm ); |
Manuel Pégourié-Gonnard | 4505ed3 | 2014-06-19 20:56:52 +0200 | [diff] [blame] | 2339 | #endif |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 2340 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2341 | mbedtls_ssl_free( &ssl ); |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 2342 | mbedtls_ssl_config_free( &conf ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2343 | mbedtls_ctr_drbg_free( &ctr_drbg ); |
| 2344 | mbedtls_entropy_free( &entropy ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2345 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2346 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 2347 | mbedtls_ssl_cache_free( &cache ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 2348 | #endif |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 2349 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 2350 | mbedtls_ssl_ticket_free( &ticket_ctx ); |
| 2351 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2352 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 2353 | mbedtls_ssl_cookie_free( &cookie_ctx ); |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 2354 | #endif |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 2355 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2356 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
| 2357 | #if defined(MBEDTLS_MEMORY_DEBUG) |
| 2358 | mbedtls_memory_buffer_alloc_status(); |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 2359 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2360 | mbedtls_memory_buffer_alloc_free(); |
Paul Bakker | 1337aff | 2013-09-29 14:45:34 +0200 | [diff] [blame] | 2361 | #endif |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 2362 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2363 | mbedtls_printf( " done.\n" ); |
Manuel Pégourié-Gonnard | f29e5de | 2014-11-21 11:54:41 +0100 | [diff] [blame] | 2364 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2365 | #if defined(_WIN32) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2366 | mbedtls_printf( " + Press Enter to exit this program.\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2367 | fflush( stdout ); getchar(); |
| 2368 | #endif |
| 2369 | |
Paul Bakker | dbd79ca | 2013-07-24 16:28:35 +0200 | [diff] [blame] | 2370 | // Shell can not handle large exit numbers -> 1 for errors |
| 2371 | if( ret < 0 ) |
| 2372 | ret = 1; |
| 2373 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2374 | return( ret ); |
| 2375 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2376 | #endif /* MBEDTLS_BIGNUM_C && MBEDTLS_ENTROPY_C && MBEDTLS_SSL_TLS_C && |
| 2377 | MBEDTLS_SSL_SRV_C && MBEDTLS_NET_C && MBEDTLS_RSA_C && |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 2378 | MBEDTLS_CTR_DRBG_C */ |