Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1 | /* |
| 2 | * SSL client with options |
| 3 | * |
Manuel Pégourié-Gonnard | a658a40 | 2015-01-23 09:45:19 +0000 | [diff] [blame] | 4 | * Copyright (C) 2006-2013, ARM Limited, All Rights Reserved |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 5 | * |
Manuel Pégourié-Gonnard | fe44643 | 2015-03-06 13:17:10 +0000 | [diff] [blame] | 6 | * This file is part of mbed TLS (https://tls.mbed.org) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 7 | * |
| 8 | * This program is free software; you can redistribute it and/or modify |
| 9 | * it under the terms of the GNU General Public License as published by |
| 10 | * the Free Software Foundation; either version 2 of the License, or |
| 11 | * (at your option) any later version. |
| 12 | * |
| 13 | * This program is distributed in the hope that it will be useful, |
| 14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 16 | * GNU General Public License for more details. |
| 17 | * |
| 18 | * You should have received a copy of the GNU General Public License along |
| 19 | * with this program; if not, write to the Free Software Foundation, Inc., |
| 20 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| 21 | */ |
| 22 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 23 | #if !defined(MBEDTLS_CONFIG_FILE) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 24 | #include "mbedtls/config.h" |
Manuel Pégourié-Gonnard | cef4ad2 | 2014-04-29 12:39:06 +0200 | [diff] [blame] | 25 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 26 | #include MBEDTLS_CONFIG_FILE |
Manuel Pégourié-Gonnard | cef4ad2 | 2014-04-29 12:39:06 +0200 | [diff] [blame] | 27 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 28 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 29 | #if defined(MBEDTLS_PLATFORM_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 30 | #include "mbedtls/platform.h" |
Rich Evans | f90016a | 2015-01-19 14:26:37 +0000 | [diff] [blame] | 31 | #else |
Manuel Pégourié-Gonnard | 8a4d571 | 2014-06-24 14:19:59 +0200 | [diff] [blame] | 32 | #include <stdio.h> |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 33 | #define mbedtls_free free |
| 34 | #define mbedtls_malloc malloc |
| 35 | #define mbedtls_fprintf fprintf |
| 36 | #define mbedtls_printf printf |
Rich Evans | 18b78c7 | 2015-02-11 14:06:19 +0000 | [diff] [blame] | 37 | #endif |
Manuel Pégourié-Gonnard | 8a4d571 | 2014-06-24 14:19:59 +0200 | [diff] [blame] | 38 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 39 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 40 | #define SNI_OPTION |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 41 | #endif |
| 42 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 43 | #if defined(_WIN32) |
| 44 | #include <windows.h> |
| 45 | #endif |
| 46 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 47 | #if defined(MBEDTLS_ENTROPY_C) && \ |
| 48 | defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_SSL_SRV_C) && \ |
| 49 | defined(MBEDTLS_NET_C) && defined(MBEDTLS_CTR_DRBG_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 50 | #include "mbedtls/net.h" |
| 51 | #include "mbedtls/ssl.h" |
| 52 | #include "mbedtls/entropy.h" |
| 53 | #include "mbedtls/ctr_drbg.h" |
| 54 | #include "mbedtls/certs.h" |
| 55 | #include "mbedtls/x509.h" |
| 56 | #include "mbedtls/error.h" |
| 57 | #include "mbedtls/debug.h" |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 58 | |
Rich Evans | 18b78c7 | 2015-02-11 14:06:19 +0000 | [diff] [blame] | 59 | #include <stdio.h> |
| 60 | #include <stdlib.h> |
| 61 | #include <string.h> |
| 62 | #endif |
| 63 | |
| 64 | #if !defined(_WIN32) |
| 65 | #include <signal.h> |
| 66 | #endif |
| 67 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 68 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 69 | #include "mbedtls/ssl_cache.h" |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 70 | #endif |
| 71 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 72 | #if defined(MBEDTLS_SSL_COOKIE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 73 | #include "mbedtls/ssl_cookie.h" |
Manuel Pégourié-Gonnard | 232edd4 | 2014-07-23 16:56:27 +0200 | [diff] [blame] | 74 | #endif |
| 75 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 76 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 77 | #include "mbedtls/memory_buffer_alloc.h" |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 78 | #endif |
| 79 | |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 80 | #define DFL_SERVER_ADDR NULL |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 81 | #define DFL_SERVER_PORT 4433 |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 82 | #define DFL_DEBUG_LEVEL 0 |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 83 | #define DFL_NBIO 0 |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 84 | #define DFL_READ_TIMEOUT 0 |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 85 | #define DFL_CA_FILE "" |
| 86 | #define DFL_CA_PATH "" |
| 87 | #define DFL_CRT_FILE "" |
| 88 | #define DFL_KEY_FILE "" |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 89 | #define DFL_CRT_FILE2 "" |
| 90 | #define DFL_KEY_FILE2 "" |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 91 | #define DFL_PSK "" |
| 92 | #define DFL_PSK_IDENTITY "Client_identity" |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 93 | #define DFL_PSK_LIST NULL |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 94 | #define DFL_FORCE_CIPHER 0 |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 95 | #define DFL_VERSION_SUITES NULL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 96 | #define DFL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION_DISABLED |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 97 | #define DFL_ALLOW_LEGACY -2 |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 98 | #define DFL_RENEGOTIATE 0 |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 99 | #define DFL_RENEGO_DELAY -2 |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 100 | #define DFL_RENEGO_PERIOD -1 |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 101 | #define DFL_EXCHANGES 1 |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 102 | #define DFL_MIN_VERSION -1 |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 103 | #define DFL_MAX_VERSION -1 |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 104 | #define DFL_ARC4 -1 |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 105 | #define DFL_AUTH_MODE -1 |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 106 | #define DFL_MFL_CODE MBEDTLS_SSL_MAX_FRAG_LEN_NONE |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 107 | #define DFL_TRUNC_HMAC -1 |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 108 | #define DFL_TICKETS MBEDTLS_SSL_SESSION_TICKETS_ENABLED |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 109 | #define DFL_TICKET_TIMEOUT -1 |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 110 | #define DFL_CACHE_MAX -1 |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 111 | #define DFL_CACHE_TIMEOUT -1 |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 112 | #define DFL_SNI NULL |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 113 | #define DFL_ALPN_STRING NULL |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 114 | #define DFL_DHM_FILE NULL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 115 | #define DFL_TRANSPORT MBEDTLS_SSL_TRANSPORT_STREAM |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 116 | #define DFL_COOKIES 1 |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 117 | #define DFL_ANTI_REPLAY -1 |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 118 | #define DFL_HS_TO_MIN 0 |
| 119 | #define DFL_HS_TO_MAX 0 |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 120 | #define DFL_BADMAC_LIMIT -1 |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 121 | #define DFL_EXTENDED_MS -1 |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 122 | #define DFL_ETM -1 |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 123 | |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 124 | #define LONG_RESPONSE "<p>01-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 125 | "02-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 126 | "03-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 127 | "04-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 128 | "05-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 129 | "06-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 130 | "07-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah</p>\r\n" |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 131 | |
Paul Bakker | 8e714d7 | 2013-07-18 11:05:13 +0200 | [diff] [blame] | 132 | /* Uncomment LONG_RESPONSE at the end of HTTP_RESPONSE to test sending longer |
| 133 | * packets (for fragmentation purposes) */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 134 | #define HTTP_RESPONSE \ |
| 135 | "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \ |
Manuel Pégourié-Gonnard | 9169921 | 2015-01-22 16:26:39 +0000 | [diff] [blame] | 136 | "<h2>mbed TLS Test Server</h2>\r\n" \ |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 137 | "<p>Successful connection using: %s</p>\r\n" // LONG_RESPONSE |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 138 | |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 139 | /* |
| 140 | * Size of the basic I/O buffer. Able to hold our default response. |
| 141 | * |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 142 | * You will need to adapt the mbedtls_ssl_get_bytes_avail() test in ssl-opt.sh |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 143 | * if you change this value to something outside the range <= 100 or > 500 |
| 144 | */ |
Manuel Pégourié-Gonnard | e7a3b10 | 2014-06-11 18:21:20 +0200 | [diff] [blame] | 145 | #define IO_BUF_LEN 200 |
| 146 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 147 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 148 | #if defined(MBEDTLS_FS_IO) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 149 | #define USAGE_IO \ |
Paul Bakker | 1f9d02d | 2012-11-20 10:30:55 +0100 | [diff] [blame] | 150 | " ca_file=%%s The single file containing the top-level CA(s) you fully trust\n" \ |
| 151 | " default: \"\" (pre-loaded)\n" \ |
| 152 | " ca_path=%%s The path containing the top-level CA(s) you fully trust\n" \ |
| 153 | " default: \"\" (pre-loaded) (overrides ca_file)\n" \ |
| 154 | " crt_file=%%s Your own cert and chain (in bottom to top order, top may be omitted)\n" \ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 155 | " default: see note after key_file2\n" \ |
| 156 | " key_file=%%s default: see note after key_file2\n" \ |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 157 | " crt_file2=%%s Your second cert and chain (in bottom to top order, top may be omitted)\n" \ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 158 | " default: see note after key_file2\n" \ |
| 159 | " key_file2=%%s default: see note below\n" \ |
| 160 | " note: if neither crt_file/key_file nor crt_file2/key_file2 are used,\n" \ |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 161 | " preloaded certificate(s) and key(s) are used if available\n" \ |
| 162 | " dhm_file=%%s File containing Diffie-Hellman parameters\n" \ |
| 163 | " default: preloaded parameters\n" |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 164 | #else |
| 165 | #define USAGE_IO \ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 166 | "\n" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 167 | " No file operations available (MBEDTLS_FS_IO not defined)\n" \ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 168 | "\n" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 169 | #endif /* MBEDTLS_FS_IO */ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 170 | #else |
| 171 | #define USAGE_IO "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 172 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 173 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 174 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 175 | #define USAGE_PSK \ |
| 176 | " psk=%%s default: \"\" (in hex, without 0x)\n" \ |
| 177 | " psk_identity=%%s default: \"Client_identity\"\n" |
| 178 | #else |
| 179 | #define USAGE_PSK "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 180 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 181 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 182 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 183 | #define USAGE_TICKETS \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 184 | " tickets=%%d default: 1 (enabled)\n" \ |
| 185 | " ticket_timeout=%%d default: ticket default (1d)\n" |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 186 | #else |
| 187 | #define USAGE_TICKETS "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 188 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 189 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 190 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 191 | #define USAGE_CACHE \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 192 | " cache_max=%%d default: cache default (50)\n" \ |
| 193 | " cache_timeout=%%d default: cache default (1d)\n" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 194 | #else |
| 195 | #define USAGE_CACHE "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 196 | #endif /* MBEDTLS_SSL_CACHE_C */ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 197 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 198 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 199 | #define USAGE_SNI \ |
| 200 | " sni=%%s name1,cert1,key1[,name2,cert2,key2[,...]]\n" \ |
| 201 | " default: disabled\n" |
| 202 | #else |
| 203 | #define USAGE_SNI "" |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 204 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 205 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 206 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 207 | #define USAGE_MAX_FRAG_LEN \ |
| 208 | " max_frag_len=%%d default: 16384 (tls default)\n" \ |
| 209 | " options: 512, 1024, 2048, 4096\n" |
| 210 | #else |
| 211 | #define USAGE_MAX_FRAG_LEN "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 212 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 213 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 214 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 215 | #define USAGE_TRUNC_HMAC \ |
| 216 | " trunc_hmac=%%d default: library default\n" |
| 217 | #else |
| 218 | #define USAGE_TRUNC_HMAC "" |
| 219 | #endif |
| 220 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 221 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 222 | #define USAGE_ALPN \ |
| 223 | " alpn=%%s default: \"\" (disabled)\n" \ |
| 224 | " example: spdy/1,http/1.1\n" |
| 225 | #else |
| 226 | #define USAGE_ALPN "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 227 | #endif /* MBEDTLS_SSL_ALPN */ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 228 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 229 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 230 | #define USAGE_COOKIES \ |
| 231 | " cookies=0/1/-1 default: 1 (enabled)\n" \ |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 232 | " 0: disabled, -1: library default (broken)\n" |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 233 | #else |
| 234 | #define USAGE_COOKIES "" |
| 235 | #endif |
| 236 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 237 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 238 | #define USAGE_ANTI_REPLAY \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 239 | " anti_replay=0/1 default: (library default: enabled)\n" |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 240 | #else |
| 241 | #define USAGE_ANTI_REPLAY "" |
| 242 | #endif |
| 243 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 244 | #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 245 | #define USAGE_BADMAC_LIMIT \ |
| 246 | " badmac_limit=%%d default: (library default: disabled)\n" |
| 247 | #else |
| 248 | #define USAGE_BADMAC_LIMIT "" |
| 249 | #endif |
| 250 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 251 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 252 | #define USAGE_DTLS \ |
| 253 | " dtls=%%d default: 0 (TLS)\n" \ |
| 254 | " hs_timeout=%%d-%%d default: (library default: 1000-60000)\n" \ |
| 255 | " range of DTLS handshake timeouts in millisecs\n" |
| 256 | #else |
| 257 | #define USAGE_DTLS "" |
| 258 | #endif |
| 259 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 260 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 261 | #define USAGE_EMS \ |
| 262 | " extended_ms=0/1 default: (library default: on)\n" |
| 263 | #else |
| 264 | #define USAGE_EMS "" |
| 265 | #endif |
| 266 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 267 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 268 | #define USAGE_ETM \ |
| 269 | " etm=0/1 default: (library default: on)\n" |
| 270 | #else |
| 271 | #define USAGE_ETM "" |
| 272 | #endif |
| 273 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 274 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 275 | #define USAGE_RENEGO \ |
| 276 | " renegotiation=%%d default: 0 (disabled)\n" \ |
| 277 | " renegotiate=%%d default: 0 (disabled)\n" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 278 | " renego_delay=%%d default: -2 (library default)\n" \ |
| 279 | " renego_period=%%d default: (library default)\n" |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 280 | #else |
| 281 | #define USAGE_RENEGO "" |
| 282 | #endif |
| 283 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 284 | #define USAGE \ |
| 285 | "\n usage: ssl_server2 param=<>...\n" \ |
| 286 | "\n acceptable parameters:\n" \ |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 287 | " server_addr=%%d default: (all interfaces)\n" \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 288 | " server_port=%%d default: 4433\n" \ |
| 289 | " debug_level=%%d default: 0 (disabled)\n" \ |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 290 | " nbio=%%d default: 0 (blocking I/O)\n" \ |
| 291 | " options: 1 (non-blocking), 2 (added delays)\n" \ |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 292 | " read_timeout=%%d default: 0 (no timeout)\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 293 | "\n" \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 294 | USAGE_DTLS \ |
| 295 | USAGE_COOKIES \ |
| 296 | USAGE_ANTI_REPLAY \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 297 | USAGE_BADMAC_LIMIT \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 298 | "\n" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 299 | " auth_mode=%%s default: (library default: required)\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 300 | " options: none, optional, required\n" \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 301 | USAGE_IO \ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 302 | USAGE_SNI \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 303 | "\n" \ |
| 304 | USAGE_PSK \ |
| 305 | "\n" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 306 | " allow_legacy=%%d default: (library default: no)\n" \ |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 307 | USAGE_RENEGO \ |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 308 | " exchanges=%%d default: 1\n" \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 309 | "\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 310 | USAGE_TICKETS \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 311 | USAGE_CACHE \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 312 | USAGE_MAX_FRAG_LEN \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 313 | USAGE_TRUNC_HMAC \ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 314 | USAGE_ALPN \ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 315 | USAGE_EMS \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 316 | USAGE_ETM \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 317 | "\n" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 318 | " arc4=%%d default: (library default: 0)\n" \ |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 319 | " min_version=%%s default: (library default: tls1)\n" \ |
| 320 | " max_version=%%s default: (library default: tls1_2)\n" \ |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 321 | " force_version=%%s default: \"\" (none)\n" \ |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 322 | " options: ssl3, tls1, tls1_1, tls1_2, dtls1, dtls1_2\n" \ |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 323 | "\n" \ |
| 324 | " version_suites=a,b,c,d per-version ciphersuites\n" \ |
| 325 | " in order from ssl3 to tls1_2\n" \ |
| 326 | " default: all enabled\n" \ |
| 327 | " force_ciphersuite=<name> default: all enabled\n" \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 328 | " acceptable ciphersuite names:\n" |
| 329 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 330 | #if !defined(MBEDTLS_ENTROPY_C) || \ |
| 331 | !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_SRV_C) || \ |
| 332 | !defined(MBEDTLS_NET_C) || !defined(MBEDTLS_CTR_DRBG_C) |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 333 | #include <stdio.h> |
| 334 | int main( void ) |
| 335 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 336 | mbedtls_printf("MBEDTLS_ENTROPY_C and/or " |
| 337 | "MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_SRV_C and/or " |
| 338 | "MBEDTLS_NET_C and/or MBEDTLS_CTR_DRBG_C not defined.\n"); |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 339 | return( 0 ); |
| 340 | } |
| 341 | #else |
| 342 | /* |
| 343 | * global options |
| 344 | */ |
| 345 | struct options |
| 346 | { |
| 347 | const char *server_addr; /* address on which the ssl service runs */ |
| 348 | int server_port; /* port on which the ssl service runs */ |
| 349 | int debug_level; /* level of debugging */ |
| 350 | int nbio; /* should I/O be blocking? */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 351 | uint32_t read_timeout; /* timeout on mbedtls_ssl_read() in milliseconds */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 352 | const char *ca_file; /* the file with the CA certificate(s) */ |
| 353 | const char *ca_path; /* the path with the CA certificate(s) reside */ |
| 354 | const char *crt_file; /* the file with the server certificate */ |
| 355 | const char *key_file; /* the file with the server key */ |
| 356 | const char *crt_file2; /* the file with the 2nd server certificate */ |
| 357 | const char *key_file2; /* the file with the 2nd server key */ |
| 358 | const char *psk; /* the pre-shared key */ |
| 359 | const char *psk_identity; /* the pre-shared key identity */ |
| 360 | char *psk_list; /* list of PSK id/key pairs for callback */ |
| 361 | int force_ciphersuite[2]; /* protocol/ciphersuite to use, or all */ |
| 362 | const char *version_suites; /* per-version ciphersuites */ |
| 363 | int renegotiation; /* enable / disable renegotiation */ |
| 364 | int allow_legacy; /* allow legacy renegotiation */ |
| 365 | int renegotiate; /* attempt renegotiation? */ |
| 366 | int renego_delay; /* delay before enforcing renegotiation */ |
| 367 | int renego_period; /* period for automatic renegotiation */ |
| 368 | int exchanges; /* number of data exchanges */ |
| 369 | int min_version; /* minimum protocol version accepted */ |
| 370 | int max_version; /* maximum protocol version accepted */ |
| 371 | int arc4; /* flag for arc4 suites support */ |
| 372 | int auth_mode; /* verify mode for connection */ |
| 373 | unsigned char mfl_code; /* code for maximum fragment length */ |
| 374 | int trunc_hmac; /* accept truncated hmac? */ |
| 375 | int tickets; /* enable / disable session tickets */ |
| 376 | int ticket_timeout; /* session ticket lifetime */ |
| 377 | int cache_max; /* max number of session cache entries */ |
| 378 | int cache_timeout; /* expiration delay of session cache entries */ |
| 379 | char *sni; /* string describing sni information */ |
| 380 | const char *alpn_string; /* ALPN supported protocols */ |
| 381 | const char *dhm_file; /* the file with the DH parameters */ |
| 382 | int extended_ms; /* allow negotiation of extended MS? */ |
| 383 | int etm; /* allow negotiation of encrypt-then-MAC? */ |
Manuel Pégourié-Gonnard | d901d17 | 2015-02-16 18:37:53 +0000 | [diff] [blame] | 384 | int transport; /* TLS or DTLS? */ |
| 385 | int cookies; /* Use cookies for DTLS? -1 to break them */ |
| 386 | int anti_replay; /* Use anti-replay for DTLS? -1 for default */ |
| 387 | uint32_t hs_to_min; /* Initial value of DTLS handshake timer */ |
| 388 | uint32_t hs_to_max; /* Max value of DTLS handshake timer */ |
| 389 | int badmac_limit; /* Limit of records with bad MAC */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 390 | } opt; |
| 391 | |
| 392 | static void my_debug( void *ctx, int level, const char *str ) |
| 393 | { |
| 394 | ((void) level); |
| 395 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 396 | mbedtls_fprintf( (FILE *) ctx, "%s", str ); |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 397 | fflush( (FILE *) ctx ); |
| 398 | } |
| 399 | |
| 400 | /* |
| 401 | * Test recv/send functions that make sure each try returns |
| 402 | * WANT_READ/WANT_WRITE at least once before sucesseding |
| 403 | */ |
| 404 | static int my_recv( void *ctx, unsigned char *buf, size_t len ) |
| 405 | { |
| 406 | static int first_try = 1; |
| 407 | int ret; |
| 408 | |
| 409 | if( first_try ) |
| 410 | { |
| 411 | first_try = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 412 | return( MBEDTLS_ERR_NET_WANT_READ ); |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 413 | } |
| 414 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 415 | ret = mbedtls_net_recv( ctx, buf, len ); |
| 416 | if( ret != MBEDTLS_ERR_NET_WANT_READ ) |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 417 | first_try = 1; /* Next call will be a new operation */ |
| 418 | return( ret ); |
| 419 | } |
| 420 | |
| 421 | static int my_send( void *ctx, const unsigned char *buf, size_t len ) |
| 422 | { |
| 423 | static int first_try = 1; |
| 424 | int ret; |
| 425 | |
| 426 | if( first_try ) |
| 427 | { |
| 428 | first_try = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 429 | return( MBEDTLS_ERR_NET_WANT_WRITE ); |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 430 | } |
| 431 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 432 | ret = mbedtls_net_send( ctx, buf, len ); |
| 433 | if( ret != MBEDTLS_ERR_NET_WANT_WRITE ) |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 434 | first_try = 1; /* Next call will be a new operation */ |
| 435 | return( ret ); |
| 436 | } |
| 437 | |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 438 | /* |
| 439 | * Used by sni_parse and psk_parse to handle coma-separated lists |
| 440 | */ |
| 441 | #define GET_ITEM( dst ) \ |
| 442 | dst = p; \ |
| 443 | while( *p != ',' ) \ |
| 444 | if( ++p > end ) \ |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 445 | goto error; \ |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 446 | *p++ = '\0'; |
| 447 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 448 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 449 | typedef struct _sni_entry sni_entry; |
| 450 | |
| 451 | struct _sni_entry { |
| 452 | const char *name; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 453 | mbedtls_x509_crt *cert; |
| 454 | mbedtls_pk_context *key; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 455 | sni_entry *next; |
| 456 | }; |
| 457 | |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 458 | void sni_free( sni_entry *head ) |
| 459 | { |
| 460 | sni_entry *cur = head, *next; |
| 461 | |
| 462 | while( cur != NULL ) |
| 463 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 464 | mbedtls_x509_crt_free( cur->cert ); |
| 465 | mbedtls_free( cur->cert ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 466 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 467 | mbedtls_pk_free( cur->key ); |
| 468 | mbedtls_free( cur->key ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 469 | |
| 470 | next = cur->next; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 471 | mbedtls_free( cur ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 472 | cur = next; |
| 473 | } |
| 474 | } |
| 475 | |
| 476 | /* |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 477 | * Parse a string of triplets name1,crt1,key1[,name2,crt2,key2[,...]] |
| 478 | * into a usable sni_entry list. |
| 479 | * |
| 480 | * Modifies the input string! This is not production quality! |
| 481 | */ |
| 482 | sni_entry *sni_parse( char *sni_string ) |
| 483 | { |
| 484 | sni_entry *cur = NULL, *new = NULL; |
| 485 | char *p = sni_string; |
| 486 | char *end = p; |
| 487 | char *crt_file, *key_file; |
| 488 | |
| 489 | while( *end != '\0' ) |
| 490 | ++end; |
| 491 | *end = ','; |
| 492 | |
| 493 | while( p <= end ) |
| 494 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 495 | if( ( new = mbedtls_malloc( sizeof( sni_entry ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 496 | { |
| 497 | sni_free( cur ); |
| 498 | return( NULL ); |
| 499 | } |
| 500 | |
| 501 | memset( new, 0, sizeof( sni_entry ) ); |
| 502 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 503 | if( ( new->cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) ) ) == NULL || |
| 504 | ( new->key = mbedtls_malloc( sizeof( mbedtls_pk_context ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 505 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 506 | mbedtls_free( new->cert ); |
| 507 | mbedtls_free( new ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 508 | sni_free( cur ); |
| 509 | return( NULL ); |
| 510 | } |
| 511 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 512 | mbedtls_x509_crt_init( new->cert ); |
| 513 | mbedtls_pk_init( new->key ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 514 | |
| 515 | GET_ITEM( new->name ); |
| 516 | GET_ITEM( crt_file ); |
| 517 | GET_ITEM( key_file ); |
| 518 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 519 | if( mbedtls_x509_crt_parse_file( new->cert, crt_file ) != 0 || |
| 520 | mbedtls_pk_parse_keyfile( new->key, key_file, "" ) != 0 ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 521 | { |
| 522 | goto error; |
| 523 | } |
| 524 | |
| 525 | new->next = cur; |
| 526 | cur = new; |
| 527 | } |
| 528 | |
| 529 | return( cur ); |
| 530 | |
| 531 | error: |
| 532 | sni_free( new ); |
| 533 | sni_free( cur ); |
| 534 | return( NULL ); |
| 535 | } |
| 536 | |
| 537 | /* |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 538 | * SNI callback. |
| 539 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 540 | int sni_callback( void *p_info, mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 541 | const unsigned char *name, size_t name_len ) |
| 542 | { |
| 543 | sni_entry *cur = (sni_entry *) p_info; |
| 544 | |
| 545 | while( cur != NULL ) |
| 546 | { |
| 547 | if( name_len == strlen( cur->name ) && |
| 548 | memcmp( name, cur->name, name_len ) == 0 ) |
| 549 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 550 | return( mbedtls_ssl_set_own_cert( ssl, cur->cert, cur->key ) ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 551 | } |
| 552 | |
| 553 | cur = cur->next; |
| 554 | } |
| 555 | |
| 556 | return( -1 ); |
| 557 | } |
| 558 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 559 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 560 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 561 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Manuel Pégourié-Gonnard | 9e27163 | 2014-06-09 19:06:00 +0200 | [diff] [blame] | 562 | |
| 563 | #define HEX2NUM( c ) \ |
| 564 | if( c >= '0' && c <= '9' ) \ |
| 565 | c -= '0'; \ |
| 566 | else if( c >= 'a' && c <= 'f' ) \ |
| 567 | c -= 'a' - 10; \ |
| 568 | else if( c >= 'A' && c <= 'F' ) \ |
| 569 | c -= 'A' - 10; \ |
| 570 | else \ |
| 571 | return( -1 ); |
| 572 | |
| 573 | /* |
| 574 | * Convert a hex string to bytes. |
| 575 | * Return 0 on success, -1 on error. |
| 576 | */ |
| 577 | int unhexify( unsigned char *output, const char *input, size_t *olen ) |
| 578 | { |
| 579 | unsigned char c; |
| 580 | size_t j; |
| 581 | |
| 582 | *olen = strlen( input ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 583 | if( *olen % 2 != 0 || *olen / 2 > MBEDTLS_PSK_MAX_LEN ) |
Manuel Pégourié-Gonnard | 9e27163 | 2014-06-09 19:06:00 +0200 | [diff] [blame] | 584 | return( -1 ); |
| 585 | *olen /= 2; |
| 586 | |
| 587 | for( j = 0; j < *olen * 2; j += 2 ) |
| 588 | { |
| 589 | c = input[j]; |
| 590 | HEX2NUM( c ); |
| 591 | output[ j / 2 ] = c << 4; |
| 592 | |
| 593 | c = input[j + 1]; |
| 594 | HEX2NUM( c ); |
| 595 | output[ j / 2 ] |= c; |
| 596 | } |
| 597 | |
| 598 | return( 0 ); |
| 599 | } |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 600 | |
| 601 | typedef struct _psk_entry psk_entry; |
| 602 | |
| 603 | struct _psk_entry |
| 604 | { |
| 605 | const char *name; |
| 606 | size_t key_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 607 | unsigned char key[MBEDTLS_PSK_MAX_LEN]; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 608 | psk_entry *next; |
| 609 | }; |
| 610 | |
| 611 | /* |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 612 | * Free a list of psk_entry's |
| 613 | */ |
| 614 | void psk_free( psk_entry *head ) |
| 615 | { |
| 616 | psk_entry *next; |
| 617 | |
| 618 | while( head != NULL ) |
| 619 | { |
| 620 | next = head->next; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 621 | mbedtls_free( head ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 622 | head = next; |
| 623 | } |
| 624 | } |
| 625 | |
| 626 | /* |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 627 | * Parse a string of pairs name1,key1[,name2,key2[,...]] |
| 628 | * into a usable psk_entry list. |
| 629 | * |
| 630 | * Modifies the input string! This is not production quality! |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 631 | */ |
| 632 | psk_entry *psk_parse( char *psk_string ) |
| 633 | { |
| 634 | psk_entry *cur = NULL, *new = NULL; |
| 635 | char *p = psk_string; |
| 636 | char *end = p; |
| 637 | char *key_hex; |
| 638 | |
| 639 | while( *end != '\0' ) |
| 640 | ++end; |
| 641 | *end = ','; |
| 642 | |
| 643 | while( p <= end ) |
| 644 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 645 | if( ( new = mbedtls_malloc( sizeof( psk_entry ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | b199095 | 2015-02-18 09:32:06 +0000 | [diff] [blame] | 646 | goto error; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 647 | |
| 648 | memset( new, 0, sizeof( psk_entry ) ); |
| 649 | |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 650 | GET_ITEM( new->name ); |
| 651 | GET_ITEM( key_hex ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 652 | |
| 653 | if( unhexify( new->key, key_hex, &new->key_len ) != 0 ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 654 | goto error; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 655 | |
| 656 | new->next = cur; |
| 657 | cur = new; |
| 658 | } |
| 659 | |
| 660 | return( cur ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 661 | |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 662 | error: |
| 663 | psk_free( new ); |
| 664 | psk_free( cur ); |
| 665 | return( 0 ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 666 | } |
| 667 | |
| 668 | /* |
| 669 | * PSK callback |
| 670 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 671 | int psk_callback( void *p_info, mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 672 | const unsigned char *name, size_t name_len ) |
| 673 | { |
| 674 | psk_entry *cur = (psk_entry *) p_info; |
| 675 | |
| 676 | while( cur != NULL ) |
| 677 | { |
| 678 | if( name_len == strlen( cur->name ) && |
| 679 | memcmp( name, cur->name, name_len ) == 0 ) |
| 680 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 681 | return( mbedtls_ssl_set_psk( ssl, cur->key, cur->key_len, |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 682 | name, name_len ) ); |
| 683 | } |
| 684 | |
| 685 | cur = cur->next; |
| 686 | } |
| 687 | |
| 688 | return( -1 ); |
| 689 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 690 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
Manuel Pégourié-Gonnard | 9e27163 | 2014-06-09 19:06:00 +0200 | [diff] [blame] | 691 | |
Manuel Pégourié-Gonnard | a9d7d03 | 2014-10-09 16:07:08 +0200 | [diff] [blame] | 692 | static int listen_fd, client_fd = -1; |
Paul Bakker | bc3e54c | 2014-08-18 14:36:17 +0200 | [diff] [blame] | 693 | |
| 694 | /* Interruption handler to ensure clean exit (for valgrind testing) */ |
| 695 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 696 | static int received_sigterm = 0; |
| 697 | void term_handler( int sig ) |
| 698 | { |
| 699 | ((void) sig); |
| 700 | received_sigterm = 1; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 701 | mbedtls_net_close( listen_fd ); /* causes mbedtls_net_accept() to abort */ |
| 702 | mbedtls_net_close( client_fd ); /* causes net_read() to abort */ |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 703 | } |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 704 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 705 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 706 | int main( int argc, char *argv[] ) |
| 707 | { |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 708 | int ret = 0, len, written, frags, exchanges_left; |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 709 | int version_suites[4][2]; |
Manuel Pégourié-Gonnard | e7a3b10 | 2014-06-11 18:21:20 +0200 | [diff] [blame] | 710 | unsigned char buf[IO_BUF_LEN]; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 711 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
| 712 | unsigned char psk[MBEDTLS_PSK_MAX_LEN]; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 713 | size_t psk_len = 0; |
Paul Bakker | 9b7fb6f | 2014-06-12 23:01:43 +0200 | [diff] [blame] | 714 | psk_entry *psk_info = NULL; |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 715 | #endif |
Paul Bakker | ef3f8c7 | 2013-06-24 13:01:08 +0200 | [diff] [blame] | 716 | const char *pers = "ssl_server2"; |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 717 | unsigned char client_ip[16] = { 0 }; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 718 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 719 | mbedtls_ssl_cookie_ctx cookie_ctx; |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 720 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 721 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 722 | mbedtls_entropy_context entropy; |
| 723 | mbedtls_ctr_drbg_context ctr_drbg; |
| 724 | mbedtls_ssl_context ssl; |
| 725 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 726 | unsigned char renego_period[8] = { 0 }; |
| 727 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 728 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 729 | mbedtls_x509_crt cacert; |
| 730 | mbedtls_x509_crt srvcert; |
| 731 | mbedtls_pk_context pkey; |
| 732 | mbedtls_x509_crt srvcert2; |
| 733 | mbedtls_pk_context pkey2; |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 734 | int key_cert_init = 0, key_cert_init2 = 0; |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 735 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 736 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 737 | mbedtls_dhm_context dhm; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 738 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 739 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 740 | mbedtls_ssl_cache_context cache; |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 741 | #endif |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 742 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 743 | sni_entry *sni_info = NULL; |
| 744 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 745 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 746 | const char *alpn_list[10]; |
| 747 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 748 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 749 | unsigned char alloc_buf[100000]; |
| 750 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 751 | |
| 752 | int i; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 753 | char *p, *q; |
| 754 | const int *list; |
| 755 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 756 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
| 757 | mbedtls_memory_buffer_alloc_init( alloc_buf, sizeof(alloc_buf) ); |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 758 | #endif |
| 759 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 760 | /* |
Manuel Pégourié-Gonnard | 3bd2aae | 2013-09-20 13:10:13 +0200 | [diff] [blame] | 761 | * Make sure memory references are valid in case we exit early. |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 762 | */ |
| 763 | listen_fd = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 764 | memset( &ssl, 0, sizeof( mbedtls_ssl_context ) ); |
| 765 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 766 | mbedtls_x509_crt_init( &cacert ); |
| 767 | mbedtls_x509_crt_init( &srvcert ); |
| 768 | mbedtls_pk_init( &pkey ); |
| 769 | mbedtls_x509_crt_init( &srvcert2 ); |
| 770 | mbedtls_pk_init( &pkey2 ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 771 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 772 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 773 | mbedtls_dhm_init( &dhm ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 774 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 775 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 776 | mbedtls_ssl_cache_init( &cache ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 777 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 778 | #if defined(MBEDTLS_SSL_ALPN) |
Paul Bakker | 525f875 | 2014-05-01 10:58:57 +0200 | [diff] [blame] | 779 | memset( (void *) alpn_list, 0, sizeof( alpn_list ) ); |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 780 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 781 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 782 | mbedtls_ssl_cookie_init( &cookie_ctx ); |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 783 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 784 | |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 785 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | 403a86f | 2014-11-17 12:46:49 +0100 | [diff] [blame] | 786 | /* Abort cleanly on SIGTERM and SIGINT */ |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 787 | signal( SIGTERM, term_handler ); |
Manuel Pégourié-Gonnard | 403a86f | 2014-11-17 12:46:49 +0100 | [diff] [blame] | 788 | signal( SIGINT, term_handler ); |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 789 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 790 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 791 | if( argc == 0 ) |
| 792 | { |
| 793 | usage: |
| 794 | if( ret == 0 ) |
| 795 | ret = 1; |
| 796 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 797 | mbedtls_printf( USAGE ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 798 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 799 | list = mbedtls_ssl_list_ciphersuites(); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 800 | while( *list ) |
| 801 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 802 | mbedtls_printf(" %-42s", mbedtls_ssl_get_ciphersuite_name( *list ) ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 803 | list++; |
| 804 | if( !*list ) |
| 805 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 806 | mbedtls_printf(" %s\n", mbedtls_ssl_get_ciphersuite_name( *list ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 807 | list++; |
| 808 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 809 | mbedtls_printf("\n"); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 810 | goto exit; |
| 811 | } |
| 812 | |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 813 | opt.server_addr = DFL_SERVER_ADDR; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 814 | opt.server_port = DFL_SERVER_PORT; |
| 815 | opt.debug_level = DFL_DEBUG_LEVEL; |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 816 | opt.nbio = DFL_NBIO; |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 817 | opt.read_timeout = DFL_READ_TIMEOUT; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 818 | opt.ca_file = DFL_CA_FILE; |
| 819 | opt.ca_path = DFL_CA_PATH; |
| 820 | opt.crt_file = DFL_CRT_FILE; |
| 821 | opt.key_file = DFL_KEY_FILE; |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 822 | opt.crt_file2 = DFL_CRT_FILE2; |
| 823 | opt.key_file2 = DFL_KEY_FILE2; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 824 | opt.psk = DFL_PSK; |
| 825 | opt.psk_identity = DFL_PSK_IDENTITY; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 826 | opt.psk_list = DFL_PSK_LIST; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 827 | opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 828 | opt.version_suites = DFL_VERSION_SUITES; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 829 | opt.renegotiation = DFL_RENEGOTIATION; |
| 830 | opt.allow_legacy = DFL_ALLOW_LEGACY; |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 831 | opt.renegotiate = DFL_RENEGOTIATE; |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 832 | opt.renego_delay = DFL_RENEGO_DELAY; |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 833 | opt.renego_period = DFL_RENEGO_PERIOD; |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 834 | opt.exchanges = DFL_EXCHANGES; |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 835 | opt.min_version = DFL_MIN_VERSION; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 836 | opt.max_version = DFL_MAX_VERSION; |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 837 | opt.arc4 = DFL_ARC4; |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 838 | opt.auth_mode = DFL_AUTH_MODE; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 839 | opt.mfl_code = DFL_MFL_CODE; |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 840 | opt.trunc_hmac = DFL_TRUNC_HMAC; |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 841 | opt.tickets = DFL_TICKETS; |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 842 | opt.ticket_timeout = DFL_TICKET_TIMEOUT; |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 843 | opt.cache_max = DFL_CACHE_MAX; |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 844 | opt.cache_timeout = DFL_CACHE_TIMEOUT; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 845 | opt.sni = DFL_SNI; |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 846 | opt.alpn_string = DFL_ALPN_STRING; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 847 | opt.dhm_file = DFL_DHM_FILE; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 848 | opt.transport = DFL_TRANSPORT; |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 849 | opt.cookies = DFL_COOKIES; |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 850 | opt.anti_replay = DFL_ANTI_REPLAY; |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 851 | opt.hs_to_min = DFL_HS_TO_MIN; |
| 852 | opt.hs_to_max = DFL_HS_TO_MAX; |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 853 | opt.badmac_limit = DFL_BADMAC_LIMIT; |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 854 | opt.extended_ms = DFL_EXTENDED_MS; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 855 | opt.etm = DFL_ETM; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 856 | |
| 857 | for( i = 1; i < argc; i++ ) |
| 858 | { |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 859 | p = argv[i]; |
| 860 | if( ( q = strchr( p, '=' ) ) == NULL ) |
| 861 | goto usage; |
| 862 | *q++ = '\0'; |
| 863 | |
| 864 | if( strcmp( p, "server_port" ) == 0 ) |
| 865 | { |
| 866 | opt.server_port = atoi( q ); |
| 867 | if( opt.server_port < 1 || opt.server_port > 65535 ) |
| 868 | goto usage; |
| 869 | } |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 870 | else if( strcmp( p, "server_addr" ) == 0 ) |
| 871 | opt.server_addr = q; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 872 | else if( strcmp( p, "dtls" ) == 0 ) |
| 873 | { |
| 874 | int t = atoi( q ); |
| 875 | if( t == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 876 | opt.transport = MBEDTLS_SSL_TRANSPORT_STREAM; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 877 | else if( t == 1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 878 | opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 879 | else |
| 880 | goto usage; |
| 881 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 882 | else if( strcmp( p, "debug_level" ) == 0 ) |
| 883 | { |
| 884 | opt.debug_level = atoi( q ); |
| 885 | if( opt.debug_level < 0 || opt.debug_level > 65535 ) |
| 886 | goto usage; |
| 887 | } |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 888 | else if( strcmp( p, "nbio" ) == 0 ) |
| 889 | { |
| 890 | opt.nbio = atoi( q ); |
| 891 | if( opt.nbio < 0 || opt.nbio > 2 ) |
| 892 | goto usage; |
| 893 | } |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 894 | else if( strcmp( p, "read_timeout" ) == 0 ) |
| 895 | opt.read_timeout = atoi( q ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 896 | else if( strcmp( p, "ca_file" ) == 0 ) |
| 897 | opt.ca_file = q; |
| 898 | else if( strcmp( p, "ca_path" ) == 0 ) |
| 899 | opt.ca_path = q; |
| 900 | else if( strcmp( p, "crt_file" ) == 0 ) |
| 901 | opt.crt_file = q; |
| 902 | else if( strcmp( p, "key_file" ) == 0 ) |
| 903 | opt.key_file = q; |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 904 | else if( strcmp( p, "crt_file2" ) == 0 ) |
| 905 | opt.crt_file2 = q; |
| 906 | else if( strcmp( p, "key_file2" ) == 0 ) |
| 907 | opt.key_file2 = q; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 908 | else if( strcmp( p, "dhm_file" ) == 0 ) |
| 909 | opt.dhm_file = q; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 910 | else if( strcmp( p, "psk" ) == 0 ) |
| 911 | opt.psk = q; |
| 912 | else if( strcmp( p, "psk_identity" ) == 0 ) |
| 913 | opt.psk_identity = q; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 914 | else if( strcmp( p, "psk_list" ) == 0 ) |
| 915 | opt.psk_list = q; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 916 | else if( strcmp( p, "force_ciphersuite" ) == 0 ) |
| 917 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 918 | opt.force_ciphersuite[0] = mbedtls_ssl_get_ciphersuite_id( q ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 919 | |
Manuel Pégourié-Gonnard | 8de259b | 2014-06-11 14:19:06 +0200 | [diff] [blame] | 920 | if( opt.force_ciphersuite[0] == 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 921 | { |
| 922 | ret = 2; |
| 923 | goto usage; |
| 924 | } |
| 925 | opt.force_ciphersuite[1] = 0; |
| 926 | } |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 927 | else if( strcmp( p, "version_suites" ) == 0 ) |
| 928 | opt.version_suites = q; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 929 | else if( strcmp( p, "renegotiation" ) == 0 ) |
| 930 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 931 | opt.renegotiation = (atoi( q )) ? MBEDTLS_SSL_RENEGOTIATION_ENABLED : |
| 932 | MBEDTLS_SSL_RENEGOTIATION_DISABLED; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 933 | } |
| 934 | else if( strcmp( p, "allow_legacy" ) == 0 ) |
| 935 | { |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 936 | switch( atoi( q ) ) |
| 937 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 938 | case -1: opt.allow_legacy = MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE; break; |
| 939 | case 0: opt.allow_legacy = MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION; break; |
| 940 | case 1: opt.allow_legacy = MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION; break; |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 941 | default: goto usage; |
| 942 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 943 | } |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 944 | else if( strcmp( p, "renegotiate" ) == 0 ) |
| 945 | { |
| 946 | opt.renegotiate = atoi( q ); |
| 947 | if( opt.renegotiate < 0 || opt.renegotiate > 1 ) |
| 948 | goto usage; |
| 949 | } |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 950 | else if( strcmp( p, "renego_delay" ) == 0 ) |
| 951 | { |
| 952 | opt.renego_delay = atoi( q ); |
| 953 | } |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 954 | else if( strcmp( p, "renego_period" ) == 0 ) |
| 955 | { |
| 956 | opt.renego_period = atoi( q ); |
| 957 | if( opt.renego_period < 2 || opt.renego_period > 255 ) |
| 958 | goto usage; |
| 959 | } |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 960 | else if( strcmp( p, "exchanges" ) == 0 ) |
| 961 | { |
| 962 | opt.exchanges = atoi( q ); |
Manuel Pégourié-Gonnard | 6a2bc23 | 2014-10-09 15:33:13 +0200 | [diff] [blame] | 963 | if( opt.exchanges < 0 ) |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 964 | goto usage; |
| 965 | } |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 966 | else if( strcmp( p, "min_version" ) == 0 ) |
| 967 | { |
| 968 | if( strcmp( q, "ssl3" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 969 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_0; |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 970 | else if( strcmp( q, "tls1" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 971 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_1; |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 972 | else if( strcmp( q, "tls1_1" ) == 0 || |
| 973 | strcmp( q, "dtls1" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 974 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2; |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 975 | else if( strcmp( q, "tls1_2" ) == 0 || |
| 976 | strcmp( q, "dtls1_2" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 977 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 978 | else |
| 979 | goto usage; |
| 980 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 981 | else if( strcmp( p, "max_version" ) == 0 ) |
| 982 | { |
| 983 | if( strcmp( q, "ssl3" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 984 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_0; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 985 | else if( strcmp( q, "tls1" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 986 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_1; |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 987 | else if( strcmp( q, "tls1_1" ) == 0 || |
| 988 | strcmp( q, "dtls1" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 989 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2; |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 990 | else if( strcmp( q, "tls1_2" ) == 0 || |
| 991 | strcmp( q, "dtls1_2" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 992 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 993 | else |
| 994 | goto usage; |
| 995 | } |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 996 | else if( strcmp( p, "arc4" ) == 0 ) |
| 997 | { |
| 998 | switch( atoi( q ) ) |
| 999 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1000 | case 0: opt.arc4 = MBEDTLS_SSL_ARC4_DISABLED; break; |
| 1001 | case 1: opt.arc4 = MBEDTLS_SSL_ARC4_ENABLED; break; |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1002 | default: goto usage; |
| 1003 | } |
| 1004 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1005 | else if( strcmp( p, "force_version" ) == 0 ) |
| 1006 | { |
| 1007 | if( strcmp( q, "ssl3" ) == 0 ) |
| 1008 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1009 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_0; |
| 1010 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_0; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1011 | } |
| 1012 | else if( strcmp( q, "tls1" ) == 0 ) |
| 1013 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1014 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_1; |
| 1015 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_1; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1016 | } |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1017 | else if( strcmp( q, "tls1_1" ) == 0 ) |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1018 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1019 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2; |
| 1020 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1021 | } |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1022 | else if( strcmp( q, "tls1_2" ) == 0 ) |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1023 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1024 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1025 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1026 | } |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1027 | else if( strcmp( q, "dtls1" ) == 0 ) |
| 1028 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1029 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2; |
| 1030 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2; |
| 1031 | opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM; |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1032 | } |
| 1033 | else if( strcmp( q, "dtls1_2" ) == 0 ) |
| 1034 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1035 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1036 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1037 | opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM; |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1038 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1039 | else |
| 1040 | goto usage; |
| 1041 | } |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1042 | else if( strcmp( p, "auth_mode" ) == 0 ) |
| 1043 | { |
| 1044 | if( strcmp( q, "none" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1045 | opt.auth_mode = MBEDTLS_SSL_VERIFY_NONE; |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1046 | else if( strcmp( q, "optional" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1047 | opt.auth_mode = MBEDTLS_SSL_VERIFY_OPTIONAL; |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1048 | else if( strcmp( q, "required" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1049 | opt.auth_mode = MBEDTLS_SSL_VERIFY_REQUIRED; |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1050 | else |
| 1051 | goto usage; |
| 1052 | } |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1053 | else if( strcmp( p, "max_frag_len" ) == 0 ) |
| 1054 | { |
| 1055 | if( strcmp( q, "512" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1056 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_512; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1057 | else if( strcmp( q, "1024" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1058 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_1024; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1059 | else if( strcmp( q, "2048" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1060 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_2048; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1061 | else if( strcmp( q, "4096" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1062 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_4096; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1063 | else |
| 1064 | goto usage; |
| 1065 | } |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1066 | else if( strcmp( p, "alpn" ) == 0 ) |
| 1067 | { |
| 1068 | opt.alpn_string = q; |
| 1069 | } |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1070 | else if( strcmp( p, "trunc_hmac" ) == 0 ) |
| 1071 | { |
| 1072 | switch( atoi( q ) ) |
| 1073 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1074 | case 0: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_DISABLED; break; |
| 1075 | case 1: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; break; |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1076 | default: goto usage; |
| 1077 | } |
| 1078 | } |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1079 | else if( strcmp( p, "extended_ms" ) == 0 ) |
| 1080 | { |
| 1081 | switch( atoi( q ) ) |
| 1082 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1083 | case 0: opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_DISABLED; break; |
| 1084 | case 1: opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; break; |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1085 | default: goto usage; |
| 1086 | } |
| 1087 | } |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1088 | else if( strcmp( p, "etm" ) == 0 ) |
| 1089 | { |
| 1090 | switch( atoi( q ) ) |
| 1091 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1092 | case 0: opt.etm = MBEDTLS_SSL_ETM_DISABLED; break; |
| 1093 | case 1: opt.etm = MBEDTLS_SSL_ETM_ENABLED; break; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1094 | default: goto usage; |
| 1095 | } |
| 1096 | } |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 1097 | else if( strcmp( p, "tickets" ) == 0 ) |
| 1098 | { |
| 1099 | opt.tickets = atoi( q ); |
| 1100 | if( opt.tickets < 0 || opt.tickets > 1 ) |
| 1101 | goto usage; |
| 1102 | } |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 1103 | else if( strcmp( p, "ticket_timeout" ) == 0 ) |
| 1104 | { |
| 1105 | opt.ticket_timeout = atoi( q ); |
| 1106 | if( opt.ticket_timeout < 0 ) |
| 1107 | goto usage; |
| 1108 | } |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1109 | else if( strcmp( p, "cache_max" ) == 0 ) |
| 1110 | { |
| 1111 | opt.cache_max = atoi( q ); |
| 1112 | if( opt.cache_max < 0 ) |
| 1113 | goto usage; |
| 1114 | } |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1115 | else if( strcmp( p, "cache_timeout" ) == 0 ) |
| 1116 | { |
| 1117 | opt.cache_timeout = atoi( q ); |
| 1118 | if( opt.cache_timeout < 0 ) |
| 1119 | goto usage; |
| 1120 | } |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1121 | else if( strcmp( p, "cookies" ) == 0 ) |
| 1122 | { |
| 1123 | opt.cookies = atoi( q ); |
| 1124 | if( opt.cookies < -1 || opt.cookies > 1) |
| 1125 | goto usage; |
| 1126 | } |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1127 | else if( strcmp( p, "anti_replay" ) == 0 ) |
| 1128 | { |
| 1129 | opt.anti_replay = atoi( q ); |
| 1130 | if( opt.anti_replay < 0 || opt.anti_replay > 1) |
| 1131 | goto usage; |
| 1132 | } |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 1133 | else if( strcmp( p, "badmac_limit" ) == 0 ) |
| 1134 | { |
| 1135 | opt.badmac_limit = atoi( q ); |
| 1136 | if( opt.badmac_limit < 0 ) |
| 1137 | goto usage; |
| 1138 | } |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 1139 | else if( strcmp( p, "hs_timeout" ) == 0 ) |
| 1140 | { |
| 1141 | if( ( p = strchr( q, '-' ) ) == NULL ) |
| 1142 | goto usage; |
| 1143 | *p++ = '\0'; |
| 1144 | opt.hs_to_min = atoi( q ); |
| 1145 | opt.hs_to_max = atoi( p ); |
| 1146 | if( opt.hs_to_min == 0 || opt.hs_to_max < opt.hs_to_min ) |
| 1147 | goto usage; |
| 1148 | } |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1149 | else if( strcmp( p, "sni" ) == 0 ) |
| 1150 | { |
| 1151 | opt.sni = q; |
| 1152 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1153 | else |
| 1154 | goto usage; |
| 1155 | } |
| 1156 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1157 | #if defined(MBEDTLS_DEBUG_C) |
| 1158 | mbedtls_debug_set_threshold( opt.debug_level ); |
Paul Bakker | c73079a | 2014-04-25 16:34:30 +0200 | [diff] [blame] | 1159 | #endif |
| 1160 | |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1161 | if( opt.force_ciphersuite[0] > 0 ) |
| 1162 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1163 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
| 1164 | ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1165 | |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1166 | if( opt.max_version != -1 && |
| 1167 | ciphersuite_info->min_minor_ver > opt.max_version ) |
| 1168 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1169 | mbedtls_printf("forced ciphersuite not allowed with this protocol version\n"); |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1170 | ret = 2; |
| 1171 | goto usage; |
| 1172 | } |
| 1173 | if( opt.min_version != -1 && |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1174 | ciphersuite_info->max_minor_ver < opt.min_version ) |
| 1175 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1176 | mbedtls_printf("forced ciphersuite not allowed with this protocol version\n"); |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1177 | ret = 2; |
| 1178 | goto usage; |
| 1179 | } |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1180 | |
| 1181 | /* If we select a version that's not supported by |
| 1182 | * this suite, then there will be no common ciphersuite... */ |
| 1183 | if( opt.max_version == -1 || |
| 1184 | opt.max_version > ciphersuite_info->max_minor_ver ) |
| 1185 | { |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1186 | opt.max_version = ciphersuite_info->max_minor_ver; |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1187 | } |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1188 | if( opt.min_version < ciphersuite_info->min_minor_ver ) |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1189 | { |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 1190 | opt.min_version = ciphersuite_info->min_minor_ver; |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1191 | /* DTLS starts with TLS 1.1 */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1192 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
| 1193 | opt.min_version < MBEDTLS_SSL_MINOR_VERSION_2 ) |
| 1194 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2; |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 1195 | } |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1196 | |
| 1197 | /* Enable RC4 if needed and not explicitly disabled */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1198 | if( ciphersuite_info->cipher == MBEDTLS_CIPHER_ARC4_128 ) |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1199 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1200 | if( opt.arc4 == MBEDTLS_SSL_ARC4_DISABLED ) |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1201 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1202 | mbedtls_printf("forced RC4 ciphersuite with RC4 disabled\n"); |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1203 | ret = 2; |
| 1204 | goto usage; |
| 1205 | } |
| 1206 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1207 | opt.arc4 = MBEDTLS_SSL_ARC4_ENABLED; |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1208 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1209 | } |
| 1210 | |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1211 | if( opt.version_suites != NULL ) |
| 1212 | { |
| 1213 | const char *name[4] = { 0 }; |
| 1214 | |
| 1215 | /* Parse 4-element coma-separated list */ |
| 1216 | for( i = 0, p = (char *) opt.version_suites; |
| 1217 | i < 4 && *p != '\0'; |
| 1218 | i++ ) |
| 1219 | { |
| 1220 | name[i] = p; |
| 1221 | |
| 1222 | /* Terminate the current string and move on to next one */ |
| 1223 | while( *p != ',' && *p != '\0' ) |
| 1224 | p++; |
| 1225 | if( *p == ',' ) |
| 1226 | *p++ = '\0'; |
| 1227 | } |
| 1228 | |
| 1229 | if( i != 4 ) |
| 1230 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1231 | mbedtls_printf( "too few values for version_suites\n" ); |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1232 | ret = 1; |
| 1233 | goto exit; |
| 1234 | } |
| 1235 | |
| 1236 | memset( version_suites, 0, sizeof( version_suites ) ); |
| 1237 | |
| 1238 | /* Get the suites identifiers from their name */ |
| 1239 | for( i = 0; i < 4; i++ ) |
| 1240 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1241 | version_suites[i][0] = mbedtls_ssl_get_ciphersuite_id( name[i] ); |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1242 | |
| 1243 | if( version_suites[i][0] == 0 ) |
| 1244 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1245 | mbedtls_printf( "unknown ciphersuite: '%s'\n", name[i] ); |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1246 | ret = 2; |
| 1247 | goto usage; |
| 1248 | } |
| 1249 | } |
| 1250 | } |
| 1251 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1252 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1253 | /* |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1254 | * Unhexify the pre-shared key and parse the list if any given |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1255 | */ |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1256 | if( unhexify( psk, opt.psk, &psk_len ) != 0 ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1257 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1258 | mbedtls_printf( "pre-shared key not valid hex\n" ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1259 | goto exit; |
| 1260 | } |
| 1261 | |
| 1262 | if( opt.psk_list != NULL ) |
| 1263 | { |
| 1264 | if( ( psk_info = psk_parse( opt.psk_list ) ) == NULL ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1265 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1266 | mbedtls_printf( "psk_list invalid" ); |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1267 | goto exit; |
| 1268 | } |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1269 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1270 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1271 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1272 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1273 | if( opt.alpn_string != NULL ) |
| 1274 | { |
| 1275 | p = (char *) opt.alpn_string; |
| 1276 | i = 0; |
| 1277 | |
| 1278 | /* Leave room for a final NULL in alpn_list */ |
| 1279 | while( i < (int) sizeof alpn_list - 1 && *p != '\0' ) |
| 1280 | { |
| 1281 | alpn_list[i++] = p; |
| 1282 | |
| 1283 | /* Terminate the current string and move on to next one */ |
| 1284 | while( *p != ',' && *p != '\0' ) |
| 1285 | p++; |
| 1286 | if( *p == ',' ) |
| 1287 | *p++ = '\0'; |
| 1288 | } |
| 1289 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1290 | #endif /* MBEDTLS_SSL_ALPN */ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1291 | |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1292 | /* |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1293 | * 0. Initialize the RNG and the session data |
| 1294 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1295 | mbedtls_printf( "\n . Seeding the random number generator..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1296 | fflush( stdout ); |
| 1297 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1298 | mbedtls_entropy_init( &entropy ); |
| 1299 | if( ( ret = mbedtls_ctr_drbg_init( &ctr_drbg, mbedtls_entropy_func, &entropy, |
Paul Bakker | ef3f8c7 | 2013-06-24 13:01:08 +0200 | [diff] [blame] | 1300 | (const unsigned char *) pers, |
| 1301 | strlen( pers ) ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1302 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1303 | mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_init returned -0x%x\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1304 | goto exit; |
| 1305 | } |
| 1306 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1307 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1308 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1309 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1310 | /* |
| 1311 | * 1.1. Load the trusted CA |
| 1312 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1313 | mbedtls_printf( " . Loading the CA root certificate ..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1314 | fflush( stdout ); |
| 1315 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1316 | #if defined(MBEDTLS_FS_IO) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1317 | if( strlen( opt.ca_path ) ) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1318 | if( strcmp( opt.ca_path, "none" ) == 0 ) |
| 1319 | ret = 0; |
| 1320 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1321 | ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1322 | else if( strlen( opt.ca_file ) ) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1323 | if( strcmp( opt.ca_file, "none" ) == 0 ) |
| 1324 | ret = 0; |
| 1325 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1326 | ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); |
Paul Bakker | ddf26b4 | 2013-09-18 13:46:23 +0200 | [diff] [blame] | 1327 | else |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1328 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1329 | #if defined(MBEDTLS_CERTS_C) |
| 1330 | for( i = 0; mbedtls_test_cas[i] != NULL; i++ ) |
Manuel Pégourié-Gonnard | 2f16506 | 2015-03-27 10:20:26 +0100 | [diff] [blame] | 1331 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1332 | ret = mbedtls_x509_crt_parse( &cacert, |
| 1333 | (const unsigned char *) mbedtls_test_cas[i], |
| 1334 | mbedtls_test_cas_len[i] ); |
Manuel Pégourié-Gonnard | 2f16506 | 2015-03-27 10:20:26 +0100 | [diff] [blame] | 1335 | if( ret != 0 ) |
| 1336 | break; |
| 1337 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1338 | #else |
| 1339 | { |
| 1340 | ret = 1; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1341 | mbedtls_printf("MBEDTLS_CERTS_C not defined."); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1342 | } |
| 1343 | #endif |
| 1344 | if( ret < 0 ) |
| 1345 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1346 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1347 | goto exit; |
| 1348 | } |
| 1349 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1350 | mbedtls_printf( " ok (%d skipped)\n", ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1351 | |
| 1352 | /* |
| 1353 | * 1.2. Load own certificate and private key |
| 1354 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1355 | mbedtls_printf( " . Loading the server cert. and key..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1356 | fflush( stdout ); |
| 1357 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1358 | #if defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1359 | if( strlen( opt.crt_file ) && strcmp( opt.crt_file, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1360 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1361 | key_cert_init++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1362 | if( ( ret = mbedtls_x509_crt_parse_file( &srvcert, opt.crt_file ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1363 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1364 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file returned -0x%x\n\n", |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1365 | -ret ); |
| 1366 | goto exit; |
| 1367 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1368 | } |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1369 | if( strlen( opt.key_file ) && strcmp( opt.key_file, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1370 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1371 | key_cert_init++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1372 | if( ( ret = mbedtls_pk_parse_keyfile( &pkey, opt.key_file, "" ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1373 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1374 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1375 | goto exit; |
| 1376 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1377 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1378 | if( key_cert_init == 1 ) |
| 1379 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1380 | mbedtls_printf( " failed\n ! crt_file without key_file or vice-versa\n\n" ); |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1381 | goto exit; |
| 1382 | } |
| 1383 | |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1384 | if( strlen( opt.crt_file2 ) && strcmp( opt.crt_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1385 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1386 | key_cert_init2++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1387 | if( ( ret = mbedtls_x509_crt_parse_file( &srvcert2, opt.crt_file2 ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1388 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1389 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file(2) returned -0x%x\n\n", |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1390 | -ret ); |
| 1391 | goto exit; |
| 1392 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1393 | } |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1394 | if( strlen( opt.key_file2 ) && strcmp( opt.key_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1395 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1396 | key_cert_init2++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1397 | if( ( ret = mbedtls_pk_parse_keyfile( &pkey2, opt.key_file2, "" ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1398 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1399 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile(2) returned -0x%x\n\n", |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1400 | -ret ); |
| 1401 | goto exit; |
| 1402 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1403 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1404 | if( key_cert_init2 == 1 ) |
| 1405 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1406 | mbedtls_printf( " failed\n ! crt_file2 without key_file2 or vice-versa\n\n" ); |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1407 | goto exit; |
| 1408 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1409 | #endif |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1410 | if( key_cert_init == 0 && |
| 1411 | strcmp( opt.crt_file, "none" ) != 0 && |
| 1412 | strcmp( opt.key_file, "none" ) != 0 && |
| 1413 | key_cert_init2 == 0 && |
| 1414 | strcmp( opt.crt_file2, "none" ) != 0 && |
| 1415 | strcmp( opt.key_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1416 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1417 | #if !defined(MBEDTLS_CERTS_C) |
| 1418 | mbedtls_printf( "Not certificated or key provided, and \n" |
| 1419 | "MBEDTLS_CERTS_C not defined!\n" ); |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1420 | goto exit; |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1421 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1422 | #if defined(MBEDTLS_RSA_C) |
| 1423 | if( ( ret = mbedtls_x509_crt_parse( &srvcert, |
| 1424 | (const unsigned char *) mbedtls_test_srv_crt_rsa, |
| 1425 | mbedtls_test_srv_crt_rsa_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1426 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1427 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1428 | goto exit; |
| 1429 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1430 | if( ( ret = mbedtls_pk_parse_key( &pkey, |
| 1431 | (const unsigned char *) mbedtls_test_srv_key_rsa, |
| 1432 | mbedtls_test_srv_key_rsa_len, NULL, 0 ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1433 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1434 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_key returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1435 | goto exit; |
| 1436 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1437 | key_cert_init = 2; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1438 | #endif /* MBEDTLS_RSA_C */ |
| 1439 | #if defined(MBEDTLS_ECDSA_C) |
| 1440 | if( ( ret = mbedtls_x509_crt_parse( &srvcert2, |
| 1441 | (const unsigned char *) mbedtls_test_srv_crt_ec, |
| 1442 | mbedtls_test_srv_crt_ec_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1443 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1444 | mbedtls_printf( " failed\n ! x509_crt_parse2 returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1445 | goto exit; |
| 1446 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1447 | if( ( ret = mbedtls_pk_parse_key( &pkey2, |
| 1448 | (const unsigned char *) mbedtls_test_srv_key_ec, |
| 1449 | mbedtls_test_srv_key_ec_len, NULL, 0 ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1450 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1451 | mbedtls_printf( " failed\n ! pk_parse_key2 returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1452 | goto exit; |
| 1453 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1454 | key_cert_init2 = 2; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1455 | #endif /* MBEDTLS_ECDSA_C */ |
| 1456 | #endif /* MBEDTLS_CERTS_C */ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 1457 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1458 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1459 | mbedtls_printf( " ok\n" ); |
| 1460 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1461 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1462 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1463 | if( opt.dhm_file != NULL ) |
| 1464 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1465 | mbedtls_printf( " . Loading DHM parameters..." ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1466 | fflush( stdout ); |
| 1467 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1468 | if( ( ret = mbedtls_dhm_parse_dhmfile( &dhm, opt.dhm_file ) ) != 0 ) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1469 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1470 | mbedtls_printf( " failed\n ! mbedtls_dhm_parse_dhmfile returned -0x%04X\n\n", |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1471 | -ret ); |
| 1472 | goto exit; |
| 1473 | } |
| 1474 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1475 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1476 | } |
| 1477 | #endif |
| 1478 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 1479 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1480 | if( opt.sni != NULL ) |
| 1481 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1482 | mbedtls_printf( " . Setting up SNI information..." ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1483 | fflush( stdout ); |
| 1484 | |
| 1485 | if( ( sni_info = sni_parse( opt.sni ) ) == NULL ) |
| 1486 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1487 | mbedtls_printf( " failed\n" ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1488 | goto exit; |
| 1489 | } |
| 1490 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1491 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1492 | } |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 1493 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1494 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1495 | /* |
| 1496 | * 2. Setup the listening TCP socket |
| 1497 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1498 | mbedtls_printf( " . Bind on %s://%s:%-4d/ ...", |
| 1499 | opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ? "tcp" : "udp", |
Manuel Pégourié-Gonnard | 8a06d9c | 2014-03-23 18:23:41 +0100 | [diff] [blame] | 1500 | opt.server_addr ? opt.server_addr : "*", |
| 1501 | opt.server_port ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1502 | fflush( stdout ); |
| 1503 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1504 | if( ( ret = mbedtls_net_bind( &listen_fd, opt.server_addr, opt.server_port, |
| 1505 | opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ? |
| 1506 | MBEDTLS_NET_PROTO_TCP : MBEDTLS_NET_PROTO_UDP ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1507 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1508 | mbedtls_printf( " failed\n ! mbedtls_net_bind returned -0x%x\n\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1509 | goto exit; |
| 1510 | } |
| 1511 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1512 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1513 | |
| 1514 | /* |
| 1515 | * 3. Setup stuff |
| 1516 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1517 | mbedtls_printf( " . Setting up the SSL/TLS structure..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1518 | fflush( stdout ); |
| 1519 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1520 | if( ( ret = mbedtls_ssl_init( &ssl ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1521 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1522 | mbedtls_printf( " failed\n ! mbedtls_ssl_init returned -0x%x\n\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1523 | goto exit; |
| 1524 | } |
| 1525 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1526 | mbedtls_ssl_set_endpoint( &ssl, MBEDTLS_SSL_IS_SERVER ); |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1527 | if( opt.auth_mode != DFL_AUTH_MODE ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1528 | mbedtls_ssl_set_authmode( &ssl, opt.auth_mode ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1529 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1530 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 1531 | if( ( ret = mbedtls_ssl_set_transport( &ssl, opt.transport ) ) != 0 ) |
Manuel Pégourié-Gonnard | 864a81f | 2014-02-10 14:25:10 +0100 | [diff] [blame] | 1532 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1533 | mbedtls_printf( " failed\n ! selected transport is not available\n" ); |
Manuel Pégourié-Gonnard | 864a81f | 2014-02-10 14:25:10 +0100 | [diff] [blame] | 1534 | goto exit; |
| 1535 | } |
| 1536 | |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 1537 | if( opt.hs_to_min != DFL_HS_TO_MIN || opt.hs_to_max != DFL_HS_TO_MAX ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1538 | mbedtls_ssl_set_handshake_timeout( &ssl, opt.hs_to_min, opt.hs_to_max ); |
| 1539 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 1540 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1541 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
| 1542 | if( ( ret = mbedtls_ssl_set_max_frag_len( &ssl, opt.mfl_code ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1543 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1544 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_max_frag_len returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1545 | goto exit; |
| 1546 | }; |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 1547 | #endif |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1548 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1549 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1550 | if( opt.trunc_hmac != DFL_TRUNC_HMAC ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1551 | mbedtls_ssl_set_truncated_hmac( &ssl, opt.trunc_hmac ); |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1552 | #endif |
| 1553 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1554 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1555 | if( opt.extended_ms != DFL_EXTENDED_MS ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1556 | mbedtls_ssl_set_extended_master_secret( &ssl, opt.extended_ms ); |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1557 | #endif |
| 1558 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1559 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1560 | if( opt.etm != DFL_ETM ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1561 | mbedtls_ssl_set_encrypt_then_mac( &ssl, opt.etm ); |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1562 | #endif |
| 1563 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1564 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1565 | if( opt.alpn_string != NULL ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1566 | if( ( ret = mbedtls_ssl_set_alpn_protocols( &ssl, alpn_list ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1567 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1568 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_alpn_protocols returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1569 | goto exit; |
| 1570 | } |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1571 | #endif |
| 1572 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1573 | mbedtls_ssl_set_rng( &ssl, mbedtls_ctr_drbg_random, &ctr_drbg ); |
| 1574 | mbedtls_ssl_set_dbg( &ssl, my_debug, stdout ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1575 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1576 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1577 | if( opt.cache_max != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1578 | mbedtls_ssl_cache_set_max_entries( &cache, opt.cache_max ); |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1579 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1580 | if( opt.cache_timeout != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1581 | mbedtls_ssl_cache_set_timeout( &cache, opt.cache_timeout ); |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1582 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1583 | mbedtls_ssl_set_session_cache( &ssl, mbedtls_ssl_cache_get, &cache, |
| 1584 | mbedtls_ssl_cache_set, &cache ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 1585 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1586 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1587 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 1588 | if( ( ret = mbedtls_ssl_set_session_tickets( &ssl, opt.tickets ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1589 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1590 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_session_tickets returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1591 | goto exit; |
| 1592 | } |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 1593 | |
| 1594 | if( opt.ticket_timeout != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1595 | mbedtls_ssl_set_session_ticket_lifetime( &ssl, opt.ticket_timeout ); |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 1596 | #endif |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 1597 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1598 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 1599 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 1600 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1601 | #if defined(MBEDTLS_SSL_COOKIE_C) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1602 | if( opt.cookies > 0 ) |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 1603 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1604 | if( ( ret = mbedtls_ssl_cookie_setup( &cookie_ctx, |
| 1605 | mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 ) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1606 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1607 | mbedtls_printf( " failed\n ! mbedtls_ssl_cookie_setup returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1608 | goto exit; |
| 1609 | } |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 1610 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1611 | mbedtls_ssl_set_dtls_cookies( &ssl, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1612 | &cookie_ctx ); |
| 1613 | } |
| 1614 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1615 | #endif /* MBEDTLS_SSL_COOKIE_C */ |
| 1616 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1617 | if( opt.cookies == 0 ) |
| 1618 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1619 | mbedtls_ssl_set_dtls_cookies( &ssl, NULL, NULL, NULL ); |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1620 | } |
| 1621 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1622 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1623 | { |
| 1624 | ; /* Nothing to do */ |
| 1625 | } |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1626 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1627 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1628 | if( opt.anti_replay != DFL_ANTI_REPLAY ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1629 | mbedtls_ssl_set_dtls_anti_replay( &ssl, opt.anti_replay ); |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 1630 | #endif |
| 1631 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1632 | #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 1633 | if( opt.badmac_limit != DFL_BADMAC_LIMIT ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1634 | mbedtls_ssl_set_dtls_badmac_limit( &ssl, opt.badmac_limit ); |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1635 | #endif |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 1636 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1637 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 1638 | |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1639 | if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1640 | mbedtls_ssl_set_ciphersuites( &ssl, opt.force_ciphersuite ); |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 1641 | |
| 1642 | if( opt.arc4 != DFL_ARC4 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1643 | mbedtls_ssl_set_arc4_support( &ssl, opt.arc4 ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1644 | |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1645 | if( opt.version_suites != NULL ) |
| 1646 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1647 | mbedtls_ssl_set_ciphersuites_for_version( &ssl, version_suites[0], |
| 1648 | MBEDTLS_SSL_MAJOR_VERSION_3, |
| 1649 | MBEDTLS_SSL_MINOR_VERSION_0 ); |
| 1650 | mbedtls_ssl_set_ciphersuites_for_version( &ssl, version_suites[1], |
| 1651 | MBEDTLS_SSL_MAJOR_VERSION_3, |
| 1652 | MBEDTLS_SSL_MINOR_VERSION_1 ); |
| 1653 | mbedtls_ssl_set_ciphersuites_for_version( &ssl, version_suites[2], |
| 1654 | MBEDTLS_SSL_MAJOR_VERSION_3, |
| 1655 | MBEDTLS_SSL_MINOR_VERSION_2 ); |
| 1656 | mbedtls_ssl_set_ciphersuites_for_version( &ssl, version_suites[3], |
| 1657 | MBEDTLS_SSL_MAJOR_VERSION_3, |
| 1658 | MBEDTLS_SSL_MINOR_VERSION_3 ); |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 1659 | } |
| 1660 | |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1661 | if( opt.allow_legacy != DFL_ALLOW_LEGACY ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1662 | mbedtls_ssl_legacy_renegotiation( &ssl, opt.allow_legacy ); |
| 1663 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 1664 | mbedtls_ssl_set_renegotiation( &ssl, opt.renegotiation ); |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1665 | |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1666 | if( opt.renego_delay != DFL_RENEGO_DELAY ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1667 | mbedtls_ssl_set_renegotiation_enforced( &ssl, opt.renego_delay ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1668 | |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1669 | if( opt.renego_period != DFL_RENEGO_PERIOD ) |
| 1670 | { |
| 1671 | renego_period[7] = opt.renego_period; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1672 | mbedtls_ssl_set_renegotiation_period( &ssl, renego_period ); |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1673 | } |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 1674 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1675 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1676 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1677 | if( strcmp( opt.ca_path, "none" ) != 0 && |
| 1678 | strcmp( opt.ca_file, "none" ) != 0 ) |
| 1679 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1680 | mbedtls_ssl_set_ca_chain( &ssl, &cacert, NULL, NULL ); |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 1681 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1682 | if( key_cert_init ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1683 | if( ( ret = mbedtls_ssl_set_own_cert( &ssl, &srvcert, &pkey ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1684 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1685 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_own_cert returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1686 | goto exit; |
| 1687 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1688 | if( key_cert_init2 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1689 | if( ( ret = mbedtls_ssl_set_own_cert( &ssl, &srvcert2, &pkey2 ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1690 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1691 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_own_cert returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 1692 | goto exit; |
| 1693 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 1694 | #endif |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 1695 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 1696 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1697 | if( opt.sni != NULL ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1698 | mbedtls_ssl_set_sni( &ssl, sni_callback, sni_info ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1699 | #endif |
| 1700 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1701 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 1702 | if( strlen( opt.psk ) != 0 && strlen( opt.psk_identity ) != 0 ) |
| 1703 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1704 | ret = mbedtls_ssl_set_psk( &ssl, psk, psk_len, |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 1705 | (const unsigned char *) opt.psk_identity, |
| 1706 | strlen( opt.psk_identity ) ); |
| 1707 | if( ret != 0 ) |
| 1708 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1709 | mbedtls_printf( " failed\n mbedtls_ssl_set_psk returned -0x%04X\n\n", - ret ); |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 1710 | goto exit; |
| 1711 | } |
| 1712 | } |
| 1713 | |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1714 | if( opt.psk_list != NULL ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1715 | mbedtls_ssl_set_psk_cb( &ssl, psk_callback, psk_info ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 1716 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1717 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1718 | #if defined(MBEDTLS_DHM_C) |
Paul Bakker | 5d19f86 | 2012-09-28 07:33:00 +0000 | [diff] [blame] | 1719 | /* |
| 1720 | * Use different group than default DHM group |
| 1721 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1722 | #if defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1723 | if( opt.dhm_file != NULL ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1724 | ret = mbedtls_ssl_set_dh_param_ctx( &ssl, &dhm ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1725 | else |
| 1726 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1727 | ret = mbedtls_ssl_set_dh_param( &ssl, MBEDTLS_DHM_RFC5114_MODP_2048_P, |
| 1728 | MBEDTLS_DHM_RFC5114_MODP_2048_G ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1729 | |
| 1730 | if( ret != 0 ) |
| 1731 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1732 | mbedtls_printf( " failed\n mbedtls_ssl_set_dh_param returned -0x%04X\n\n", - ret ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1733 | goto exit; |
| 1734 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1735 | #endif |
| 1736 | |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 1737 | if( opt.min_version != DFL_MIN_VERSION ) |
Manuel Pégourié-Gonnard | 864a81f | 2014-02-10 14:25:10 +0100 | [diff] [blame] | 1738 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1739 | ret = mbedtls_ssl_set_min_version( &ssl, MBEDTLS_SSL_MAJOR_VERSION_3, opt.min_version ); |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 1740 | if( ret != 0 ) |
Manuel Pégourié-Gonnard | 864a81f | 2014-02-10 14:25:10 +0100 | [diff] [blame] | 1741 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1742 | mbedtls_printf( " failed\n ! selected min_version is not available\n" ); |
Manuel Pégourié-Gonnard | 864a81f | 2014-02-10 14:25:10 +0100 | [diff] [blame] | 1743 | goto exit; |
| 1744 | } |
| 1745 | } |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1746 | |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 1747 | if( opt.max_version != DFL_MIN_VERSION ) |
Manuel Pégourié-Gonnard | 864a81f | 2014-02-10 14:25:10 +0100 | [diff] [blame] | 1748 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1749 | ret = mbedtls_ssl_set_max_version( &ssl, MBEDTLS_SSL_MAJOR_VERSION_3, opt.max_version ); |
Manuel Pégourié-Gonnard | 864a81f | 2014-02-10 14:25:10 +0100 | [diff] [blame] | 1750 | if( ret != 0 ) |
| 1751 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1752 | mbedtls_printf( " failed\n ! selected max_version is not available\n" ); |
Manuel Pégourié-Gonnard | 864a81f | 2014-02-10 14:25:10 +0100 | [diff] [blame] | 1753 | goto exit; |
| 1754 | } |
| 1755 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1756 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1757 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1758 | |
| 1759 | reset: |
Manuel Pégourié-Gonnard | b6440a4 | 2014-09-20 12:03:00 +0200 | [diff] [blame] | 1760 | #if !defined(_WIN32) |
| 1761 | if( received_sigterm ) |
| 1762 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1763 | mbedtls_printf( " interrupted by SIGTERM\n" ); |
Manuel Pégourié-Gonnard | b6440a4 | 2014-09-20 12:03:00 +0200 | [diff] [blame] | 1764 | ret = 0; |
| 1765 | goto exit; |
| 1766 | } |
| 1767 | #endif |
| 1768 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1769 | #ifdef MBEDTLS_ERROR_C |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1770 | if( ret != 0 ) |
| 1771 | { |
| 1772 | char error_buf[100]; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1773 | mbedtls_strerror( ret, error_buf, 100 ); |
| 1774 | mbedtls_printf("Last error was: %d - %s\n\n", ret, error_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1775 | } |
| 1776 | #endif |
| 1777 | |
| 1778 | if( client_fd != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1779 | mbedtls_net_close( client_fd ); |
Manuel Pégourié-Gonnard | 8a06d9c | 2014-03-23 18:23:41 +0100 | [diff] [blame] | 1780 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1781 | mbedtls_ssl_session_reset( &ssl ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1782 | |
| 1783 | /* |
| 1784 | * 3. Wait until a client connects |
| 1785 | */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1786 | client_fd = -1; |
| 1787 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1788 | mbedtls_printf( " . Waiting for a remote connection ..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1789 | fflush( stdout ); |
| 1790 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1791 | if( ( ret = mbedtls_net_accept( listen_fd, &client_fd, client_ip ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1792 | { |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 1793 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 1794 | if( received_sigterm ) |
| 1795 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1796 | mbedtls_printf( " interrupted by signal\n" ); |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 1797 | ret = 0; |
| 1798 | goto exit; |
| 1799 | } |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 1800 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 1801 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1802 | mbedtls_printf( " failed\n ! mbedtls_net_accept returned -0x%x\n\n", -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1803 | goto exit; |
| 1804 | } |
| 1805 | |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1806 | if( opt.nbio > 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1807 | ret = mbedtls_net_set_nonblock( client_fd ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1808 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1809 | ret = mbedtls_net_set_block( client_fd ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1810 | if( ret != 0 ) |
| 1811 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1812 | mbedtls_printf( " failed\n ! net_set_(non)block() returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1813 | goto exit; |
| 1814 | } |
| 1815 | |
| 1816 | if( opt.nbio == 2 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1817 | mbedtls_ssl_set_bio_timeout( &ssl, &client_fd, my_send, my_recv, NULL, 0 ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1818 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1819 | mbedtls_ssl_set_bio_timeout( &ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, |
| 1820 | #if defined(MBEDTLS_HAVE_TIME) |
| 1821 | opt.nbio == 0 ? mbedtls_net_recv_timeout : NULL, |
Manuel Pégourié-Gonnard | a014829 | 2014-09-18 16:06:04 +0200 | [diff] [blame] | 1822 | #else |
| 1823 | NULL, |
| 1824 | #endif |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 1825 | opt.read_timeout ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1826 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1827 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
| 1828 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1829 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1830 | if( ( ret = mbedtls_ssl_set_client_transport_id( &ssl, client_ip, |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1831 | sizeof( client_ip ) ) ) != 0 ) |
| 1832 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1833 | mbedtls_printf( " failed\n ! " |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1834 | "ssl_set_client_tranport_id() returned -0x%x\n\n", -ret ); |
| 1835 | goto exit; |
| 1836 | } |
| 1837 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1838 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1839 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1840 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1841 | |
| 1842 | /* |
Manuel Pégourié-Gonnard | bd97fdb | 2014-09-26 16:46:36 +0200 | [diff] [blame] | 1843 | * With UDP, bind_fd is hijacked by client_fd, so bind a new one |
| 1844 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1845 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 1846 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | bd97fdb | 2014-09-26 16:46:36 +0200 | [diff] [blame] | 1847 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1848 | mbedtls_printf( " . Re-bind on udp://%s:%-4d/ ...", |
Manuel Pégourié-Gonnard | bd97fdb | 2014-09-26 16:46:36 +0200 | [diff] [blame] | 1849 | opt.server_addr ? opt.server_addr : "*", |
| 1850 | opt.server_port ); |
| 1851 | fflush( stdout ); |
| 1852 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1853 | if( ( ret = mbedtls_net_bind( &listen_fd, opt.server_addr, |
| 1854 | opt.server_port, MBEDTLS_NET_PROTO_UDP ) ) != 0 ) |
Manuel Pégourié-Gonnard | bd97fdb | 2014-09-26 16:46:36 +0200 | [diff] [blame] | 1855 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1856 | mbedtls_printf( " failed\n ! mbedtls_net_bind returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | bd97fdb | 2014-09-26 16:46:36 +0200 | [diff] [blame] | 1857 | goto exit; |
| 1858 | } |
| 1859 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1860 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | bd97fdb | 2014-09-26 16:46:36 +0200 | [diff] [blame] | 1861 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1862 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | bd97fdb | 2014-09-26 16:46:36 +0200 | [diff] [blame] | 1863 | |
| 1864 | /* |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1865 | * 4. Handshake |
| 1866 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1867 | mbedtls_printf( " . Performing the SSL/TLS handshake..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1868 | fflush( stdout ); |
| 1869 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1870 | do ret = mbedtls_ssl_handshake( &ssl ); |
| 1871 | while( ret == MBEDTLS_ERR_NET_WANT_READ || |
| 1872 | ret == MBEDTLS_ERR_NET_WANT_WRITE ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1873 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1874 | if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ) |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 1875 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1876 | mbedtls_printf( " hello verification requested\n" ); |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 1877 | ret = 0; |
| 1878 | goto reset; |
| 1879 | } |
| 1880 | else if( ret != 0 ) |
| 1881 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1882 | mbedtls_printf( " failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret ); |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 1883 | goto reset; |
| 1884 | } |
| 1885 | else /* ret == 0 */ |
| 1886 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1887 | mbedtls_printf( " ok\n [ Protocol is %s ]\n [ Ciphersuite is %s ]\n", |
| 1888 | mbedtls_ssl_get_version( &ssl ), mbedtls_ssl_get_ciphersuite( &ssl ) ); |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 1889 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1890 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1891 | if( ( ret = mbedtls_ssl_get_record_expansion( &ssl ) ) >= 0 ) |
| 1892 | mbedtls_printf( " [ Record expansion is %d ]\n", ret ); |
Manuel Pégourié-Gonnard | 9b35f18 | 2014-10-14 17:47:31 +0200 | [diff] [blame] | 1893 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1894 | mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" ); |
Manuel Pégourié-Gonnard | 9b35f18 | 2014-10-14 17:47:31 +0200 | [diff] [blame] | 1895 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1896 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1897 | if( opt.alpn_string != NULL ) |
| 1898 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1899 | const char *alp = mbedtls_ssl_get_alpn_protocol( &ssl ); |
| 1900 | mbedtls_printf( " [ Application Layer Protocol is %s ]\n", |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1901 | alp ? alp : "(none)" ); |
| 1902 | } |
| 1903 | #endif |
| 1904 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1905 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1906 | /* |
| 1907 | * 5. Verify the server certificate |
| 1908 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1909 | mbedtls_printf( " . Verifying peer X.509 certificate..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1910 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1911 | if( ( ret = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1912 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1913 | mbedtls_printf( " failed\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1914 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1915 | if( !mbedtls_ssl_get_peer_cert( &ssl ) ) |
| 1916 | mbedtls_printf( " ! no client certificate sent\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1917 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1918 | if( ( ret & MBEDTLS_BADCERT_EXPIRED ) != 0 ) |
| 1919 | mbedtls_printf( " ! client certificate has expired\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1920 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1921 | if( ( ret & MBEDTLS_X509_BADCERT_REVOKED ) != 0 ) |
| 1922 | mbedtls_printf( " ! client certificate has been revoked\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1923 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1924 | if( ( ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED ) != 0 ) |
| 1925 | mbedtls_printf( " ! self-signed or not signed by a trusted CA\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1926 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1927 | mbedtls_printf( "\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1928 | } |
| 1929 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1930 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1931 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1932 | if( mbedtls_ssl_get_peer_cert( &ssl ) ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1933 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1934 | mbedtls_printf( " . Peer certificate information ...\n" ); |
| 1935 | mbedtls_x509_crt_info( (char *) buf, sizeof( buf ) - 1, " ", |
| 1936 | mbedtls_ssl_get_peer_cert( &ssl ) ); |
| 1937 | mbedtls_printf( "%s\n", buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1938 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1939 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1940 | |
Manuel Pégourié-Gonnard | 6a2bc23 | 2014-10-09 15:33:13 +0200 | [diff] [blame] | 1941 | if( opt.exchanges == 0 ) |
| 1942 | goto close_notify; |
| 1943 | |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 1944 | exchanges_left = opt.exchanges; |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 1945 | data_exchange: |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1946 | /* |
| 1947 | * 6. Read the HTTP Request |
| 1948 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1949 | mbedtls_printf( " < Read from client:" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1950 | fflush( stdout ); |
| 1951 | |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1952 | /* |
| 1953 | * TLS and DTLS need different reading styles (stream vs datagram) |
| 1954 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1955 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1956 | { |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1957 | do |
| 1958 | { |
| 1959 | int terminated = 0; |
| 1960 | len = sizeof( buf ) - 1; |
| 1961 | memset( buf, 0, sizeof( buf ) ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1962 | ret = mbedtls_ssl_read( &ssl, buf, len ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1963 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1964 | if( ret == MBEDTLS_ERR_NET_WANT_READ || |
| 1965 | ret == MBEDTLS_ERR_NET_WANT_WRITE ) |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1966 | continue; |
| 1967 | |
| 1968 | if( ret <= 0 ) |
| 1969 | { |
| 1970 | switch( ret ) |
| 1971 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1972 | case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: |
| 1973 | mbedtls_printf( " connection was closed gracefully\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1974 | goto close_notify; |
| 1975 | |
| 1976 | case 0: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1977 | case MBEDTLS_ERR_NET_CONN_RESET: |
| 1978 | mbedtls_printf( " connection was reset by peer\n" ); |
| 1979 | ret = MBEDTLS_ERR_NET_CONN_RESET; |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1980 | goto reset; |
| 1981 | |
| 1982 | default: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1983 | mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", -ret ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1984 | goto reset; |
| 1985 | } |
| 1986 | } |
| 1987 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1988 | if( mbedtls_ssl_get_bytes_avail( &ssl ) == 0 ) |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1989 | { |
| 1990 | len = ret; |
| 1991 | buf[len] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 1992 | mbedtls_printf( " %d bytes read\n\n%s\n", len, (char *) buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 1993 | |
| 1994 | /* End of message should be detected according to the syntax of the |
| 1995 | * application protocol (eg HTTP), just use a dummy test here. */ |
| 1996 | if( buf[len - 1] == '\n' ) |
| 1997 | terminated = 1; |
| 1998 | } |
| 1999 | else |
| 2000 | { |
| 2001 | int extra_len, ori_len; |
| 2002 | unsigned char *larger_buf; |
| 2003 | |
| 2004 | ori_len = ret; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2005 | extra_len = mbedtls_ssl_get_bytes_avail( &ssl ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2006 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2007 | larger_buf = mbedtls_malloc( ori_len + extra_len + 1 ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2008 | if( larger_buf == NULL ) |
| 2009 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2010 | mbedtls_printf( " ! memory allocation failed\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2011 | ret = 1; |
| 2012 | goto reset; |
| 2013 | } |
| 2014 | |
| 2015 | memset( larger_buf, 0, ori_len + extra_len ); |
| 2016 | memcpy( larger_buf, buf, ori_len ); |
| 2017 | |
| 2018 | /* This read should never fail and get the whole cached data */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2019 | ret = mbedtls_ssl_read( &ssl, larger_buf + ori_len, extra_len ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2020 | if( ret != extra_len || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2021 | mbedtls_ssl_get_bytes_avail( &ssl ) != 0 ) |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2022 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2023 | mbedtls_printf( " ! mbedtls_ssl_read failed on cached data\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2024 | ret = 1; |
| 2025 | goto reset; |
| 2026 | } |
| 2027 | |
| 2028 | larger_buf[ori_len + extra_len] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2029 | mbedtls_printf( " %u bytes read (%u + %u)\n\n%s\n", |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2030 | ori_len + extra_len, ori_len, extra_len, |
| 2031 | (char *) larger_buf ); |
| 2032 | |
| 2033 | /* End of message should be detected according to the syntax of the |
| 2034 | * application protocol (eg HTTP), just use a dummy test here. */ |
| 2035 | if( larger_buf[ori_len + extra_len - 1] == '\n' ) |
| 2036 | terminated = 1; |
| 2037 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2038 | mbedtls_free( larger_buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2039 | } |
| 2040 | |
| 2041 | if( terminated ) |
| 2042 | { |
| 2043 | ret = 0; |
| 2044 | break; |
| 2045 | } |
| 2046 | } |
| 2047 | while( 1 ); |
| 2048 | } |
| 2049 | else /* Not stream, so datagram */ |
| 2050 | { |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2051 | len = sizeof( buf ) - 1; |
| 2052 | memset( buf, 0, sizeof( buf ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2053 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2054 | do ret = mbedtls_ssl_read( &ssl, buf, len ); |
| 2055 | while( ret == MBEDTLS_ERR_NET_WANT_READ || |
| 2056 | ret == MBEDTLS_ERR_NET_WANT_WRITE ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2057 | |
| 2058 | if( ret <= 0 ) |
| 2059 | { |
| 2060 | switch( ret ) |
| 2061 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2062 | case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: |
| 2063 | mbedtls_printf( " connection was closed gracefully\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2064 | ret = 0; |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2065 | goto close_notify; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2066 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2067 | default: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2068 | mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", -ret ); |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2069 | goto reset; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2070 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2071 | } |
| 2072 | |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2073 | len = ret; |
| 2074 | buf[len] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2075 | mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 2076 | ret = 0; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2077 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2078 | |
| 2079 | /* |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2080 | * 7a. Request renegotiation while client is waiting for input from us. |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 2081 | * (only on the first exchange, to be able to test retransmission) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2082 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2083 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 3a173f4 | 2015-01-22 13:30:33 +0000 | [diff] [blame] | 2084 | if( opt.renegotiate && exchanges_left == opt.exchanges ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2085 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2086 | mbedtls_printf( " . Requestion renegotiation..." ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2087 | fflush( stdout ); |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2088 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2089 | while( ( ret = mbedtls_ssl_renegotiate( &ssl ) ) != 0 ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2090 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2091 | if( ret != MBEDTLS_ERR_NET_WANT_READ && |
| 2092 | ret != MBEDTLS_ERR_NET_WANT_WRITE ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2093 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2094 | mbedtls_printf( " failed\n ! mbedtls_ssl_renegotiate returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2095 | goto reset; |
| 2096 | } |
| 2097 | } |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2098 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2099 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2100 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2101 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 2102 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2103 | /* |
| 2104 | * 7. Write the 200 Response |
| 2105 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2106 | mbedtls_printf( " > Write to client:" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2107 | fflush( stdout ); |
| 2108 | |
| 2109 | len = sprintf( (char *) buf, HTTP_RESPONSE, |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2110 | mbedtls_ssl_get_ciphersuite( &ssl ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2111 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2112 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2113 | { |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2114 | for( written = 0, frags = 0; written < len; written += ret, frags++ ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2115 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2116 | while( ( ret = mbedtls_ssl_write( &ssl, buf + written, len - written ) ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2117 | <= 0 ) |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 2118 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2119 | if( ret == MBEDTLS_ERR_NET_CONN_RESET ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2120 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2121 | mbedtls_printf( " failed\n ! peer closed the connection\n\n" ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2122 | goto reset; |
| 2123 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2124 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2125 | if( ret != MBEDTLS_ERR_NET_WANT_READ && |
| 2126 | ret != MBEDTLS_ERR_NET_WANT_WRITE ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2127 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2128 | mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2129 | goto reset; |
| 2130 | } |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 2131 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2132 | } |
| 2133 | } |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2134 | else /* Not stream, so datagram */ |
| 2135 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2136 | do ret = mbedtls_ssl_write( &ssl, buf, len ); |
| 2137 | while( ret == MBEDTLS_ERR_NET_WANT_READ || |
| 2138 | ret == MBEDTLS_ERR_NET_WANT_WRITE ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2139 | |
| 2140 | if( ret < 0 ) |
| 2141 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2142 | mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 2143 | goto reset; |
| 2144 | } |
| 2145 | |
| 2146 | frags = 1; |
| 2147 | written = ret; |
| 2148 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2149 | |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 2150 | buf[written] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2151 | mbedtls_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf ); |
Manuel Pégourié-Gonnard | a92ed48 | 2015-01-14 10:46:08 +0100 | [diff] [blame] | 2152 | ret = 0; |
Manuel Pégourié-Gonnard | f3dc2f6 | 2013-10-29 18:17:41 +0100 | [diff] [blame] | 2153 | |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2154 | /* |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2155 | * 7b. Continue doing data exchanges? |
| 2156 | */ |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 2157 | if( --exchanges_left > 0 ) |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 2158 | goto data_exchange; |
| 2159 | |
| 2160 | /* |
| 2161 | * 8. Done, cleanly close the connection |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2162 | */ |
| 2163 | close_notify: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2164 | mbedtls_printf( " . Closing the connection..." ); |
Manuel Pégourié-Gonnard | 6b0d268 | 2014-03-25 11:24:43 +0100 | [diff] [blame] | 2165 | |
Manuel Pégourié-Gonnard | 994f8b5 | 2014-10-09 19:56:44 +0200 | [diff] [blame] | 2166 | /* No error checking, the connection might be closed already */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2167 | do ret = mbedtls_ssl_close_notify( &ssl ); |
| 2168 | while( ret == MBEDTLS_ERR_NET_WANT_WRITE ); |
Manuel Pégourié-Gonnard | 994f8b5 | 2014-10-09 19:56:44 +0200 | [diff] [blame] | 2169 | ret = 0; |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2170 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2171 | mbedtls_printf( " done\n" ); |
Rich Evans | f90016a | 2015-01-19 14:26:37 +0000 | [diff] [blame] | 2172 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2173 | goto reset; |
| 2174 | |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 2175 | /* |
| 2176 | * Cleanup and exit |
| 2177 | */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2178 | exit: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2179 | #ifdef MBEDTLS_ERROR_C |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2180 | if( ret != 0 ) |
| 2181 | { |
| 2182 | char error_buf[100]; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2183 | mbedtls_strerror( ret, error_buf, 100 ); |
| 2184 | mbedtls_printf("Last error was: -0x%X - %s\n\n", -ret, error_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2185 | } |
| 2186 | #endif |
| 2187 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2188 | mbedtls_printf( " . Cleaning up..." ); |
Manuel Pégourié-Gonnard | f29e5de | 2014-11-21 11:54:41 +0100 | [diff] [blame] | 2189 | fflush( stdout ); |
| 2190 | |
Paul Bakker | 0c22610 | 2014-04-17 16:02:36 +0200 | [diff] [blame] | 2191 | if( client_fd != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2192 | mbedtls_net_close( client_fd ); |
Paul Bakker | 0c22610 | 2014-04-17 16:02:36 +0200 | [diff] [blame] | 2193 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2194 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 2195 | mbedtls_dhm_free( &dhm ); |
Paul Bakker | a317a98 | 2014-06-18 16:44:11 +0200 | [diff] [blame] | 2196 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2197 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 2198 | mbedtls_x509_crt_free( &cacert ); |
| 2199 | mbedtls_x509_crt_free( &srvcert ); |
| 2200 | mbedtls_pk_free( &pkey ); |
| 2201 | mbedtls_x509_crt_free( &srvcert2 ); |
| 2202 | mbedtls_pk_free( &pkey2 ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 2203 | #endif |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 2204 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2205 | sni_free( sni_info ); |
| 2206 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2207 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Manuel Pégourié-Gonnard | 4505ed3 | 2014-06-19 20:56:52 +0200 | [diff] [blame] | 2208 | psk_free( psk_info ); |
| 2209 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2210 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 2211 | mbedtls_dhm_free( &dhm ); |
Manuel Pégourié-Gonnard | 4505ed3 | 2014-06-19 20:56:52 +0200 | [diff] [blame] | 2212 | #endif |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 2213 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2214 | mbedtls_ssl_free( &ssl ); |
| 2215 | mbedtls_ctr_drbg_free( &ctr_drbg ); |
| 2216 | mbedtls_entropy_free( &entropy ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2217 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2218 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 2219 | mbedtls_ssl_cache_free( &cache ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 2220 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2221 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 2222 | mbedtls_ssl_cookie_free( &cookie_ctx ); |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 2223 | #endif |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 2224 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2225 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
| 2226 | #if defined(MBEDTLS_MEMORY_DEBUG) |
| 2227 | mbedtls_memory_buffer_alloc_status(); |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 2228 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2229 | mbedtls_memory_buffer_alloc_free(); |
Paul Bakker | 1337aff | 2013-09-29 14:45:34 +0200 | [diff] [blame] | 2230 | #endif |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 2231 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2232 | mbedtls_printf( " done.\n" ); |
Manuel Pégourié-Gonnard | f29e5de | 2014-11-21 11:54:41 +0100 | [diff] [blame] | 2233 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2234 | #if defined(_WIN32) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2235 | mbedtls_printf( " + Press Enter to exit this program.\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2236 | fflush( stdout ); getchar(); |
| 2237 | #endif |
| 2238 | |
Paul Bakker | dbd79ca | 2013-07-24 16:28:35 +0200 | [diff] [blame] | 2239 | // Shell can not handle large exit numbers -> 1 for errors |
| 2240 | if( ret < 0 ) |
| 2241 | ret = 1; |
| 2242 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2243 | return( ret ); |
| 2244 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame^] | 2245 | #endif /* MBEDTLS_BIGNUM_C && MBEDTLS_ENTROPY_C && MBEDTLS_SSL_TLS_C && |
| 2246 | MBEDTLS_SSL_SRV_C && MBEDTLS_NET_C && MBEDTLS_RSA_C && |
| 2247 | MBEDTLS_CTR_DRBG_C */ |