blob: b536c22e720069706c29cfca36adb6753a00739a [file] [log] [blame]
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001/*
2 * SSL client with options
3 *
Manuel Pégourié-Gonnarda658a402015-01-23 09:45:19 +00004 * Copyright (C) 2006-2013, ARM Limited, All Rights Reserved
Paul Bakkerb60b95f2012-09-25 09:05:17 +00005 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +00006 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakkerb60b95f2012-09-25 09:05:17 +00007 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020023#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000024#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020025#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020027#endif
Paul Bakkerb60b95f2012-09-25 09:05:17 +000028
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020029#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000030#include "mbedtls/platform.h"
Rich Evansf90016a2015-01-19 14:26:37 +000031#else
Manuel Pégourié-Gonnard8a4d5712014-06-24 14:19:59 +020032#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#define mbedtls_free free
34#define mbedtls_malloc malloc
35#define mbedtls_fprintf fprintf
36#define mbedtls_printf printf
Rich Evans18b78c72015-02-11 14:06:19 +000037#endif
Manuel Pégourié-Gonnard8a4d5712014-06-24 14:19:59 +020038
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020039#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_FS_IO)
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +020040#define SNI_OPTION
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +010041#endif
42
Paul Bakkerb60b95f2012-09-25 09:05:17 +000043#if defined(_WIN32)
44#include <windows.h>
45#endif
46
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020047#if defined(MBEDTLS_ENTROPY_C) && \
48 defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_SSL_SRV_C) && \
49 defined(MBEDTLS_NET_C) && defined(MBEDTLS_CTR_DRBG_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000050#include "mbedtls/net.h"
51#include "mbedtls/ssl.h"
52#include "mbedtls/entropy.h"
53#include "mbedtls/ctr_drbg.h"
54#include "mbedtls/certs.h"
55#include "mbedtls/x509.h"
56#include "mbedtls/error.h"
57#include "mbedtls/debug.h"
Paul Bakkerb60b95f2012-09-25 09:05:17 +000058
Rich Evans18b78c72015-02-11 14:06:19 +000059#include <stdio.h>
60#include <stdlib.h>
61#include <string.h>
62#endif
63
64#if !defined(_WIN32)
65#include <signal.h>
66#endif
67
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020068#if defined(MBEDTLS_SSL_CACHE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000069#include "mbedtls/ssl_cache.h"
Paul Bakker0a597072012-09-25 21:55:46 +000070#endif
71
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020072#if defined(MBEDTLS_SSL_COOKIE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000073#include "mbedtls/ssl_cookie.h"
Manuel Pégourié-Gonnard232edd42014-07-23 16:56:27 +020074#endif
75
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020076#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000077#include "mbedtls/memory_buffer_alloc.h"
Paul Bakker82024bf2013-07-04 11:52:32 +020078#endif
79
Manuel Pégourié-Gonnard18d31f82013-12-13 16:21:41 +010080#define DFL_SERVER_ADDR NULL
Paul Bakkerb60b95f2012-09-25 09:05:17 +000081#define DFL_SERVER_PORT 4433
Paul Bakkerb60b95f2012-09-25 09:05:17 +000082#define DFL_DEBUG_LEVEL 0
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +010083#define DFL_NBIO 0
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020084#define DFL_READ_TIMEOUT 0
Paul Bakkerb60b95f2012-09-25 09:05:17 +000085#define DFL_CA_FILE ""
86#define DFL_CA_PATH ""
87#define DFL_CRT_FILE ""
88#define DFL_KEY_FILE ""
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +020089#define DFL_CRT_FILE2 ""
90#define DFL_KEY_FILE2 ""
Paul Bakkerfbb17802013-04-17 19:10:21 +020091#define DFL_PSK ""
92#define DFL_PSK_IDENTITY "Client_identity"
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +020093#define DFL_PSK_LIST NULL
Paul Bakkerb60b95f2012-09-25 09:05:17 +000094#define DFL_FORCE_CIPHER 0
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +020095#define DFL_VERSION_SUITES NULL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020096#define DFL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION_DISABLED
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +010097#define DFL_ALLOW_LEGACY -2
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +010098#define DFL_RENEGOTIATE 0
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +020099#define DFL_RENEGO_DELAY -2
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +0100100#define DFL_RENEGO_PERIOD -1
Manuel Pégourié-Gonnard67686c42014-08-15 11:17:27 +0200101#define DFL_EXCHANGES 1
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +0200102#define DFL_MIN_VERSION -1
Paul Bakkerc1516be2013-06-29 16:01:32 +0200103#define DFL_MAX_VERSION -1
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +0000104#define DFL_ARC4 -1
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +0100105#define DFL_AUTH_MODE -1
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200106#define DFL_MFL_CODE MBEDTLS_SSL_MAX_FRAG_LEN_NONE
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100107#define DFL_TRUNC_HMAC -1
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200108#define DFL_TICKETS MBEDTLS_SSL_SESSION_TICKETS_ENABLED
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100109#define DFL_TICKET_TIMEOUT -1
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100110#define DFL_CACHE_MAX -1
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100111#define DFL_CACHE_TIMEOUT -1
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100112#define DFL_SNI NULL
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200113#define DFL_ALPN_STRING NULL
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +0200114#define DFL_DHM_FILE NULL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200115#define DFL_TRANSPORT MBEDTLS_SSL_TRANSPORT_STREAM
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +0200116#define DFL_COOKIES 1
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +0200117#define DFL_ANTI_REPLAY -1
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200118#define DFL_HS_TO_MIN 0
119#define DFL_HS_TO_MAX 0
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +0200120#define DFL_BADMAC_LIMIT -1
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200121#define DFL_EXTENDED_MS -1
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100122#define DFL_ETM -1
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000123
Manuel Pégourié-Gonnard0c017a52013-07-18 14:07:36 +0200124#define LONG_RESPONSE "<p>01-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \
125 "02-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \
126 "03-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \
127 "04-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \
128 "05-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \
129 "06-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \
130 "07-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah</p>\r\n"
Manuel Pégourié-Gonnardbd7ce632013-07-17 15:34:17 +0200131
Paul Bakker8e714d72013-07-18 11:05:13 +0200132/* Uncomment LONG_RESPONSE at the end of HTTP_RESPONSE to test sending longer
133 * packets (for fragmentation purposes) */
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000134#define HTTP_RESPONSE \
135 "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \
Manuel Pégourié-Gonnard91699212015-01-22 16:26:39 +0000136 "<h2>mbed TLS Test Server</h2>\r\n" \
Manuel Pégourié-Gonnardbd7ce632013-07-17 15:34:17 +0200137 "<p>Successful connection using: %s</p>\r\n" // LONG_RESPONSE
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000138
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +0200139/*
140 * Size of the basic I/O buffer. Able to hold our default response.
141 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200142 * You will need to adapt the mbedtls_ssl_get_bytes_avail() test in ssl-opt.sh
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +0200143 * if you change this value to something outside the range <= 100 or > 500
144 */
Manuel Pégourié-Gonnarde7a3b102014-06-11 18:21:20 +0200145#define IO_BUF_LEN 200
146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200147#if defined(MBEDTLS_X509_CRT_PARSE_C)
148#if defined(MBEDTLS_FS_IO)
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000149#define USAGE_IO \
Paul Bakker1f9d02d2012-11-20 10:30:55 +0100150 " ca_file=%%s The single file containing the top-level CA(s) you fully trust\n" \
151 " default: \"\" (pre-loaded)\n" \
152 " ca_path=%%s The path containing the top-level CA(s) you fully trust\n" \
153 " default: \"\" (pre-loaded) (overrides ca_file)\n" \
154 " crt_file=%%s Your own cert and chain (in bottom to top order, top may be omitted)\n" \
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +0200155 " default: see note after key_file2\n" \
156 " key_file=%%s default: see note after key_file2\n" \
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +0200157 " crt_file2=%%s Your second cert and chain (in bottom to top order, top may be omitted)\n" \
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +0200158 " default: see note after key_file2\n" \
159 " key_file2=%%s default: see note below\n" \
160 " note: if neither crt_file/key_file nor crt_file2/key_file2 are used,\n" \
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +0200161 " preloaded certificate(s) and key(s) are used if available\n" \
162 " dhm_file=%%s File containing Diffie-Hellman parameters\n" \
163 " default: preloaded parameters\n"
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000164#else
165#define USAGE_IO \
Paul Bakkered27a042013-04-18 22:46:23 +0200166 "\n" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200167 " No file operations available (MBEDTLS_FS_IO not defined)\n" \
Paul Bakkered27a042013-04-18 22:46:23 +0200168 "\n"
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200169#endif /* MBEDTLS_FS_IO */
Paul Bakkered27a042013-04-18 22:46:23 +0200170#else
171#define USAGE_IO ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkered27a042013-04-18 22:46:23 +0200173
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200174#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Paul Bakkered27a042013-04-18 22:46:23 +0200175#define USAGE_PSK \
176 " psk=%%s default: \"\" (in hex, without 0x)\n" \
177 " psk_identity=%%s default: \"Client_identity\"\n"
178#else
179#define USAGE_PSK ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200180#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200182#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Paul Bakkera503a632013-08-14 13:48:06 +0200183#define USAGE_TICKETS \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100184 " tickets=%%d default: 1 (enabled)\n" \
185 " ticket_timeout=%%d default: ticket default (1d)\n"
Paul Bakkera503a632013-08-14 13:48:06 +0200186#else
187#define USAGE_TICKETS ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Paul Bakkera503a632013-08-14 13:48:06 +0200189
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200190#if defined(MBEDTLS_SSL_CACHE_C)
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100191#define USAGE_CACHE \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100192 " cache_max=%%d default: cache default (50)\n" \
193 " cache_timeout=%%d default: cache default (1d)\n"
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100194#else
195#define USAGE_CACHE ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200196#endif /* MBEDTLS_SSL_CACHE_C */
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100197
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +0200198#if defined(SNI_OPTION)
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100199#define USAGE_SNI \
200 " sni=%%s name1,cert1,key1[,name2,cert2,key2[,...]]\n" \
201 " default: disabled\n"
202#else
203#define USAGE_SNI ""
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +0200204#endif /* SNI_OPTION */
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200206#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Paul Bakker05decb22013-08-15 13:33:48 +0200207#define USAGE_MAX_FRAG_LEN \
208 " max_frag_len=%%d default: 16384 (tls default)\n" \
209 " options: 512, 1024, 2048, 4096\n"
210#else
211#define USAGE_MAX_FRAG_LEN ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200212#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Paul Bakker05decb22013-08-15 13:33:48 +0200213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200214#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100215#define USAGE_TRUNC_HMAC \
216 " trunc_hmac=%%d default: library default\n"
217#else
218#define USAGE_TRUNC_HMAC ""
219#endif
220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200221#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200222#define USAGE_ALPN \
223 " alpn=%%s default: \"\" (disabled)\n" \
224 " example: spdy/1,http/1.1\n"
225#else
226#define USAGE_ALPN ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200229#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +0200230#define USAGE_COOKIES \
231 " cookies=0/1/-1 default: 1 (enabled)\n" \
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +0200232 " 0: disabled, -1: library default (broken)\n"
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +0200233#else
234#define USAGE_COOKIES ""
235#endif
236
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200237#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +0200238#define USAGE_ANTI_REPLAY \
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +0200239 " anti_replay=0/1 default: (library default: enabled)\n"
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +0200240#else
241#define USAGE_ANTI_REPLAY ""
242#endif
243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200244#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +0200245#define USAGE_BADMAC_LIMIT \
246 " badmac_limit=%%d default: (library default: disabled)\n"
247#else
248#define USAGE_BADMAC_LIMIT ""
249#endif
250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200251#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200252#define USAGE_DTLS \
253 " dtls=%%d default: 0 (TLS)\n" \
254 " hs_timeout=%%d-%%d default: (library default: 1000-60000)\n" \
255 " range of DTLS handshake timeouts in millisecs\n"
256#else
257#define USAGE_DTLS ""
258#endif
259
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200260#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200261#define USAGE_EMS \
262 " extended_ms=0/1 default: (library default: on)\n"
263#else
264#define USAGE_EMS ""
265#endif
266
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200267#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100268#define USAGE_ETM \
269 " etm=0/1 default: (library default: on)\n"
270#else
271#define USAGE_ETM ""
272#endif
273
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200274#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100275#define USAGE_RENEGO \
276 " renegotiation=%%d default: 0 (disabled)\n" \
277 " renegotiate=%%d default: 0 (disabled)\n" \
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +0100278 " renego_delay=%%d default: -2 (library default)\n" \
279 " renego_period=%%d default: (library default)\n"
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100280#else
281#define USAGE_RENEGO ""
282#endif
283
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000284#define USAGE \
285 "\n usage: ssl_server2 param=<>...\n" \
286 "\n acceptable parameters:\n" \
Manuel Pégourié-Gonnard18d31f82013-12-13 16:21:41 +0100287 " server_addr=%%d default: (all interfaces)\n" \
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000288 " server_port=%%d default: 4433\n" \
289 " debug_level=%%d default: 0 (disabled)\n" \
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +0100290 " nbio=%%d default: 0 (blocking I/O)\n" \
291 " options: 1 (non-blocking), 2 (added delays)\n" \
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +0200292 " read_timeout=%%d default: 0 (no timeout)\n" \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100293 "\n" \
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200294 USAGE_DTLS \
295 USAGE_COOKIES \
296 USAGE_ANTI_REPLAY \
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +0200297 USAGE_BADMAC_LIMIT \
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200298 "\n" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +0100299 " auth_mode=%%s default: (library default: required)\n" \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100300 " options: none, optional, required\n" \
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000301 USAGE_IO \
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100302 USAGE_SNI \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100303 "\n" \
304 USAGE_PSK \
305 "\n" \
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +0100306 " allow_legacy=%%d default: (library default: no)\n" \
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100307 USAGE_RENEGO \
Manuel Pégourié-Gonnard67686c42014-08-15 11:17:27 +0200308 " exchanges=%%d default: 1\n" \
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200309 "\n" \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100310 USAGE_TICKETS \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100311 USAGE_CACHE \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100312 USAGE_MAX_FRAG_LEN \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100313 USAGE_TRUNC_HMAC \
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200314 USAGE_ALPN \
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200315 USAGE_EMS \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100316 USAGE_ETM \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100317 "\n" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +0100318 " arc4=%%d default: (library default: 0)\n" \
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +0200319 " min_version=%%s default: (library default: tls1)\n" \
320 " max_version=%%s default: (library default: tls1_2)\n" \
Paul Bakkerc1516be2013-06-29 16:01:32 +0200321 " force_version=%%s default: \"\" (none)\n" \
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100322 " options: ssl3, tls1, tls1_1, tls1_2, dtls1, dtls1_2\n" \
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +0200323 "\n" \
324 " version_suites=a,b,c,d per-version ciphersuites\n" \
325 " in order from ssl3 to tls1_2\n" \
326 " default: all enabled\n" \
327 " force_ciphersuite=<name> default: all enabled\n" \
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000328 " acceptable ciphersuite names:\n"
329
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200330#if !defined(MBEDTLS_ENTROPY_C) || \
331 !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_SRV_C) || \
332 !defined(MBEDTLS_NET_C) || !defined(MBEDTLS_CTR_DRBG_C)
Rich Evans85b05ec2015-02-12 11:37:29 +0000333#include <stdio.h>
334int main( void )
335{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200336 mbedtls_printf("MBEDTLS_ENTROPY_C and/or "
337 "MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_SRV_C and/or "
338 "MBEDTLS_NET_C and/or MBEDTLS_CTR_DRBG_C not defined.\n");
Rich Evans85b05ec2015-02-12 11:37:29 +0000339 return( 0 );
340}
341#else
342/*
343 * global options
344 */
345struct options
346{
347 const char *server_addr; /* address on which the ssl service runs */
348 int server_port; /* port on which the ssl service runs */
349 int debug_level; /* level of debugging */
350 int nbio; /* should I/O be blocking? */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200351 uint32_t read_timeout; /* timeout on mbedtls_ssl_read() in milliseconds */
Rich Evans85b05ec2015-02-12 11:37:29 +0000352 const char *ca_file; /* the file with the CA certificate(s) */
353 const char *ca_path; /* the path with the CA certificate(s) reside */
354 const char *crt_file; /* the file with the server certificate */
355 const char *key_file; /* the file with the server key */
356 const char *crt_file2; /* the file with the 2nd server certificate */
357 const char *key_file2; /* the file with the 2nd server key */
358 const char *psk; /* the pre-shared key */
359 const char *psk_identity; /* the pre-shared key identity */
360 char *psk_list; /* list of PSK id/key pairs for callback */
361 int force_ciphersuite[2]; /* protocol/ciphersuite to use, or all */
362 const char *version_suites; /* per-version ciphersuites */
363 int renegotiation; /* enable / disable renegotiation */
364 int allow_legacy; /* allow legacy renegotiation */
365 int renegotiate; /* attempt renegotiation? */
366 int renego_delay; /* delay before enforcing renegotiation */
367 int renego_period; /* period for automatic renegotiation */
368 int exchanges; /* number of data exchanges */
369 int min_version; /* minimum protocol version accepted */
370 int max_version; /* maximum protocol version accepted */
371 int arc4; /* flag for arc4 suites support */
372 int auth_mode; /* verify mode for connection */
373 unsigned char mfl_code; /* code for maximum fragment length */
374 int trunc_hmac; /* accept truncated hmac? */
375 int tickets; /* enable / disable session tickets */
376 int ticket_timeout; /* session ticket lifetime */
377 int cache_max; /* max number of session cache entries */
378 int cache_timeout; /* expiration delay of session cache entries */
379 char *sni; /* string describing sni information */
380 const char *alpn_string; /* ALPN supported protocols */
381 const char *dhm_file; /* the file with the DH parameters */
382 int extended_ms; /* allow negotiation of extended MS? */
383 int etm; /* allow negotiation of encrypt-then-MAC? */
Manuel Pégourié-Gonnardd901d172015-02-16 18:37:53 +0000384 int transport; /* TLS or DTLS? */
385 int cookies; /* Use cookies for DTLS? -1 to break them */
386 int anti_replay; /* Use anti-replay for DTLS? -1 for default */
387 uint32_t hs_to_min; /* Initial value of DTLS handshake timer */
388 uint32_t hs_to_max; /* Max value of DTLS handshake timer */
389 int badmac_limit; /* Limit of records with bad MAC */
Rich Evans85b05ec2015-02-12 11:37:29 +0000390} opt;
391
392static void my_debug( void *ctx, int level, const char *str )
393{
394 ((void) level);
395
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200396 mbedtls_fprintf( (FILE *) ctx, "%s", str );
Rich Evans85b05ec2015-02-12 11:37:29 +0000397 fflush( (FILE *) ctx );
398}
399
400/*
401 * Test recv/send functions that make sure each try returns
402 * WANT_READ/WANT_WRITE at least once before sucesseding
403 */
404static int my_recv( void *ctx, unsigned char *buf, size_t len )
405{
406 static int first_try = 1;
407 int ret;
408
409 if( first_try )
410 {
411 first_try = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200412 return( MBEDTLS_ERR_NET_WANT_READ );
Rich Evans85b05ec2015-02-12 11:37:29 +0000413 }
414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415 ret = mbedtls_net_recv( ctx, buf, len );
416 if( ret != MBEDTLS_ERR_NET_WANT_READ )
Rich Evans85b05ec2015-02-12 11:37:29 +0000417 first_try = 1; /* Next call will be a new operation */
418 return( ret );
419}
420
421static int my_send( void *ctx, const unsigned char *buf, size_t len )
422{
423 static int first_try = 1;
424 int ret;
425
426 if( first_try )
427 {
428 first_try = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200429 return( MBEDTLS_ERR_NET_WANT_WRITE );
Rich Evans85b05ec2015-02-12 11:37:29 +0000430 }
431
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200432 ret = mbedtls_net_send( ctx, buf, len );
433 if( ret != MBEDTLS_ERR_NET_WANT_WRITE )
Rich Evans85b05ec2015-02-12 11:37:29 +0000434 first_try = 1; /* Next call will be a new operation */
435 return( ret );
436}
437
Manuel Pégourié-Gonnardfdee74b2014-06-10 15:15:06 +0200438/*
439 * Used by sni_parse and psk_parse to handle coma-separated lists
440 */
441#define GET_ITEM( dst ) \
442 dst = p; \
443 while( *p != ',' ) \
444 if( ++p > end ) \
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000445 goto error; \
Manuel Pégourié-Gonnardfdee74b2014-06-10 15:15:06 +0200446 *p++ = '\0';
447
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +0200448#if defined(SNI_OPTION)
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100449typedef struct _sni_entry sni_entry;
450
451struct _sni_entry {
452 const char *name;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200453 mbedtls_x509_crt *cert;
454 mbedtls_pk_context *key;
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100455 sni_entry *next;
456};
457
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100458void sni_free( sni_entry *head )
459{
460 sni_entry *cur = head, *next;
461
462 while( cur != NULL )
463 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200464 mbedtls_x509_crt_free( cur->cert );
465 mbedtls_free( cur->cert );
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100466
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200467 mbedtls_pk_free( cur->key );
468 mbedtls_free( cur->key );
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100469
470 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200471 mbedtls_free( cur );
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100472 cur = next;
473 }
474}
475
476/*
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000477 * Parse a string of triplets name1,crt1,key1[,name2,crt2,key2[,...]]
478 * into a usable sni_entry list.
479 *
480 * Modifies the input string! This is not production quality!
481 */
482sni_entry *sni_parse( char *sni_string )
483{
484 sni_entry *cur = NULL, *new = NULL;
485 char *p = sni_string;
486 char *end = p;
487 char *crt_file, *key_file;
488
489 while( *end != '\0' )
490 ++end;
491 *end = ',';
492
493 while( p <= end )
494 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200495 if( ( new = mbedtls_malloc( sizeof( sni_entry ) ) ) == NULL )
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000496 {
497 sni_free( cur );
498 return( NULL );
499 }
500
501 memset( new, 0, sizeof( sni_entry ) );
502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200503 if( ( new->cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) ) ) == NULL ||
504 ( new->key = mbedtls_malloc( sizeof( mbedtls_pk_context ) ) ) == NULL )
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000505 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200506 mbedtls_free( new->cert );
507 mbedtls_free( new );
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000508 sni_free( cur );
509 return( NULL );
510 }
511
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200512 mbedtls_x509_crt_init( new->cert );
513 mbedtls_pk_init( new->key );
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000514
515 GET_ITEM( new->name );
516 GET_ITEM( crt_file );
517 GET_ITEM( key_file );
518
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200519 if( mbedtls_x509_crt_parse_file( new->cert, crt_file ) != 0 ||
520 mbedtls_pk_parse_keyfile( new->key, key_file, "" ) != 0 )
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000521 {
522 goto error;
523 }
524
525 new->next = cur;
526 cur = new;
527 }
528
529 return( cur );
530
531error:
532 sni_free( new );
533 sni_free( cur );
534 return( NULL );
535}
536
537/*
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100538 * SNI callback.
539 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200540int sni_callback( void *p_info, mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100541 const unsigned char *name, size_t name_len )
542{
543 sni_entry *cur = (sni_entry *) p_info;
544
545 while( cur != NULL )
546 {
547 if( name_len == strlen( cur->name ) &&
548 memcmp( name, cur->name, name_len ) == 0 )
549 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200550 return( mbedtls_ssl_set_own_cert( ssl, cur->cert, cur->key ) );
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100551 }
552
553 cur = cur->next;
554 }
555
556 return( -1 );
557}
558
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +0200559#endif /* SNI_OPTION */
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100560
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200561#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard9e271632014-06-09 19:06:00 +0200562
563#define HEX2NUM( c ) \
564 if( c >= '0' && c <= '9' ) \
565 c -= '0'; \
566 else if( c >= 'a' && c <= 'f' ) \
567 c -= 'a' - 10; \
568 else if( c >= 'A' && c <= 'F' ) \
569 c -= 'A' - 10; \
570 else \
571 return( -1 );
572
573/*
574 * Convert a hex string to bytes.
575 * Return 0 on success, -1 on error.
576 */
577int unhexify( unsigned char *output, const char *input, size_t *olen )
578{
579 unsigned char c;
580 size_t j;
581
582 *olen = strlen( input );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200583 if( *olen % 2 != 0 || *olen / 2 > MBEDTLS_PSK_MAX_LEN )
Manuel Pégourié-Gonnard9e271632014-06-09 19:06:00 +0200584 return( -1 );
585 *olen /= 2;
586
587 for( j = 0; j < *olen * 2; j += 2 )
588 {
589 c = input[j];
590 HEX2NUM( c );
591 output[ j / 2 ] = c << 4;
592
593 c = input[j + 1];
594 HEX2NUM( c );
595 output[ j / 2 ] |= c;
596 }
597
598 return( 0 );
599}
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200600
601typedef struct _psk_entry psk_entry;
602
603struct _psk_entry
604{
605 const char *name;
606 size_t key_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200607 unsigned char key[MBEDTLS_PSK_MAX_LEN];
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200608 psk_entry *next;
609};
610
611/*
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000612 * Free a list of psk_entry's
613 */
614void psk_free( psk_entry *head )
615{
616 psk_entry *next;
617
618 while( head != NULL )
619 {
620 next = head->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200621 mbedtls_free( head );
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000622 head = next;
623 }
624}
625
626/*
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200627 * Parse a string of pairs name1,key1[,name2,key2[,...]]
628 * into a usable psk_entry list.
629 *
630 * Modifies the input string! This is not production quality!
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200631 */
632psk_entry *psk_parse( char *psk_string )
633{
634 psk_entry *cur = NULL, *new = NULL;
635 char *p = psk_string;
636 char *end = p;
637 char *key_hex;
638
639 while( *end != '\0' )
640 ++end;
641 *end = ',';
642
643 while( p <= end )
644 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200645 if( ( new = mbedtls_malloc( sizeof( psk_entry ) ) ) == NULL )
Manuel Pégourié-Gonnardb1990952015-02-18 09:32:06 +0000646 goto error;
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200647
648 memset( new, 0, sizeof( psk_entry ) );
649
Manuel Pégourié-Gonnardfdee74b2014-06-10 15:15:06 +0200650 GET_ITEM( new->name );
651 GET_ITEM( key_hex );
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200652
653 if( unhexify( new->key, key_hex, &new->key_len ) != 0 )
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000654 goto error;
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200655
656 new->next = cur;
657 cur = new;
658 }
659
660 return( cur );
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200661
Manuel Pégourié-Gonnard5c078e12015-02-14 13:56:39 +0000662error:
663 psk_free( new );
664 psk_free( cur );
665 return( 0 );
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200666}
667
668/*
669 * PSK callback
670 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200671int psk_callback( void *p_info, mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200672 const unsigned char *name, size_t name_len )
673{
674 psk_entry *cur = (psk_entry *) p_info;
675
676 while( cur != NULL )
677 {
678 if( name_len == strlen( cur->name ) &&
679 memcmp( name, cur->name, name_len ) == 0 )
680 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200681 return( mbedtls_ssl_set_psk( ssl, cur->key, cur->key_len,
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200682 name, name_len ) );
683 }
684
685 cur = cur->next;
686 }
687
688 return( -1 );
689}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200690#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnard9e271632014-06-09 19:06:00 +0200691
Manuel Pégourié-Gonnarda9d7d032014-10-09 16:07:08 +0200692static int listen_fd, client_fd = -1;
Paul Bakkerbc3e54c2014-08-18 14:36:17 +0200693
694/* Interruption handler to ensure clean exit (for valgrind testing) */
695#if !defined(_WIN32)
Manuel Pégourié-Gonnarddb493302014-08-14 15:36:12 +0200696static int received_sigterm = 0;
697void term_handler( int sig )
698{
699 ((void) sig);
700 received_sigterm = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200701 mbedtls_net_close( listen_fd ); /* causes mbedtls_net_accept() to abort */
702 mbedtls_net_close( client_fd ); /* causes net_read() to abort */
Manuel Pégourié-Gonnarddb493302014-08-14 15:36:12 +0200703}
Paul Bakkerc1283d32014-08-18 11:05:51 +0200704#endif
Manuel Pégourié-Gonnarddb493302014-08-14 15:36:12 +0200705
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000706int main( int argc, char *argv[] )
707{
Manuel Pégourié-Gonnard6a0017b2015-01-22 10:33:29 +0000708 int ret = 0, len, written, frags, exchanges_left;
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +0200709 int version_suites[4][2];
Manuel Pégourié-Gonnarde7a3b102014-06-11 18:21:20 +0200710 unsigned char buf[IO_BUF_LEN];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200711#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
712 unsigned char psk[MBEDTLS_PSK_MAX_LEN];
Paul Bakkerfbb17802013-04-17 19:10:21 +0200713 size_t psk_len = 0;
Paul Bakker9b7fb6f2014-06-12 23:01:43 +0200714 psk_entry *psk_info = NULL;
Paul Bakkered27a042013-04-18 22:46:23 +0200715#endif
Paul Bakkeref3f8c72013-06-24 13:01:08 +0200716 const char *pers = "ssl_server2";
Manuel Pégourié-Gonnard336b8242014-07-22 17:57:43 +0200717 unsigned char client_ip[16] = { 0 };
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200718#if defined(MBEDTLS_SSL_COOKIE_C)
719 mbedtls_ssl_cookie_ctx cookie_ctx;
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +0200720#endif
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000721
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200722 mbedtls_entropy_context entropy;
723 mbedtls_ctr_drbg_context ctr_drbg;
724 mbedtls_ssl_context ssl;
725#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +0100726 unsigned char renego_period[8] = { 0 };
727#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200728#if defined(MBEDTLS_X509_CRT_PARSE_C)
729 mbedtls_x509_crt cacert;
730 mbedtls_x509_crt srvcert;
731 mbedtls_pk_context pkey;
732 mbedtls_x509_crt srvcert2;
733 mbedtls_pk_context pkey2;
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +0200734 int key_cert_init = 0, key_cert_init2 = 0;
Paul Bakkered27a042013-04-18 22:46:23 +0200735#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200736#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO)
737 mbedtls_dhm_context dhm;
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +0200738#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739#if defined(MBEDTLS_SSL_CACHE_C)
740 mbedtls_ssl_cache_context cache;
Paul Bakker0a597072012-09-25 21:55:46 +0000741#endif
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +0200742#if defined(SNI_OPTION)
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100743 sni_entry *sni_info = NULL;
744#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200745#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200746 const char *alpn_list[10];
747#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200748#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
Paul Bakker82024bf2013-07-04 11:52:32 +0200749 unsigned char alloc_buf[100000];
750#endif
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000751
752 int i;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000753 char *p, *q;
754 const int *list;
755
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200756#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
757 mbedtls_memory_buffer_alloc_init( alloc_buf, sizeof(alloc_buf) );
Paul Bakker82024bf2013-07-04 11:52:32 +0200758#endif
759
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000760 /*
Manuel Pégourié-Gonnard3bd2aae2013-09-20 13:10:13 +0200761 * Make sure memory references are valid in case we exit early.
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000762 */
763 listen_fd = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200764 memset( &ssl, 0, sizeof( mbedtls_ssl_context ) );
765#if defined(MBEDTLS_X509_CRT_PARSE_C)
766 mbedtls_x509_crt_init( &cacert );
767 mbedtls_x509_crt_init( &srvcert );
768 mbedtls_pk_init( &pkey );
769 mbedtls_x509_crt_init( &srvcert2 );
770 mbedtls_pk_init( &pkey2 );
Paul Bakkered27a042013-04-18 22:46:23 +0200771#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200772#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO)
773 mbedtls_dhm_init( &dhm );
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +0200774#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200775#if defined(MBEDTLS_SSL_CACHE_C)
776 mbedtls_ssl_cache_init( &cache );
Paul Bakker0a597072012-09-25 21:55:46 +0000777#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200778#if defined(MBEDTLS_SSL_ALPN)
Paul Bakker525f8752014-05-01 10:58:57 +0200779 memset( (void *) alpn_list, 0, sizeof( alpn_list ) );
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200780#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200781#if defined(MBEDTLS_SSL_COOKIE_C)
782 mbedtls_ssl_cookie_init( &cookie_ctx );
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +0200783#endif
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000784
Paul Bakkerc1283d32014-08-18 11:05:51 +0200785#if !defined(_WIN32)
Manuel Pégourié-Gonnard403a86f2014-11-17 12:46:49 +0100786 /* Abort cleanly on SIGTERM and SIGINT */
Manuel Pégourié-Gonnarddb493302014-08-14 15:36:12 +0200787 signal( SIGTERM, term_handler );
Manuel Pégourié-Gonnard403a86f2014-11-17 12:46:49 +0100788 signal( SIGINT, term_handler );
Paul Bakkerc1283d32014-08-18 11:05:51 +0200789#endif
Manuel Pégourié-Gonnarddb493302014-08-14 15:36:12 +0200790
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000791 if( argc == 0 )
792 {
793 usage:
794 if( ret == 0 )
795 ret = 1;
796
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200797 mbedtls_printf( USAGE );
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000798
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200799 list = mbedtls_ssl_list_ciphersuites();
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000800 while( *list )
801 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200802 mbedtls_printf(" %-42s", mbedtls_ssl_get_ciphersuite_name( *list ) );
Paul Bakkered27a042013-04-18 22:46:23 +0200803 list++;
804 if( !*list )
805 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200806 mbedtls_printf(" %s\n", mbedtls_ssl_get_ciphersuite_name( *list ) );
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000807 list++;
808 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200809 mbedtls_printf("\n");
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000810 goto exit;
811 }
812
Manuel Pégourié-Gonnard18d31f82013-12-13 16:21:41 +0100813 opt.server_addr = DFL_SERVER_ADDR;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000814 opt.server_port = DFL_SERVER_PORT;
815 opt.debug_level = DFL_DEBUG_LEVEL;
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +0100816 opt.nbio = DFL_NBIO;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +0200817 opt.read_timeout = DFL_READ_TIMEOUT;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000818 opt.ca_file = DFL_CA_FILE;
819 opt.ca_path = DFL_CA_PATH;
820 opt.crt_file = DFL_CRT_FILE;
821 opt.key_file = DFL_KEY_FILE;
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +0200822 opt.crt_file2 = DFL_CRT_FILE2;
823 opt.key_file2 = DFL_KEY_FILE2;
Paul Bakkerfbb17802013-04-17 19:10:21 +0200824 opt.psk = DFL_PSK;
825 opt.psk_identity = DFL_PSK_IDENTITY;
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200826 opt.psk_list = DFL_PSK_LIST;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000827 opt.force_ciphersuite[0]= DFL_FORCE_CIPHER;
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +0200828 opt.version_suites = DFL_VERSION_SUITES;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000829 opt.renegotiation = DFL_RENEGOTIATION;
830 opt.allow_legacy = DFL_ALLOW_LEGACY;
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100831 opt.renegotiate = DFL_RENEGOTIATE;
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200832 opt.renego_delay = DFL_RENEGO_DELAY;
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +0100833 opt.renego_period = DFL_RENEGO_PERIOD;
Manuel Pégourié-Gonnard67686c42014-08-15 11:17:27 +0200834 opt.exchanges = DFL_EXCHANGES;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000835 opt.min_version = DFL_MIN_VERSION;
Paul Bakkerc1516be2013-06-29 16:01:32 +0200836 opt.max_version = DFL_MAX_VERSION;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100837 opt.arc4 = DFL_ARC4;
Paul Bakker91ebfb52012-11-23 14:04:08 +0100838 opt.auth_mode = DFL_AUTH_MODE;
Manuel Pégourié-Gonnard0c017a52013-07-18 14:07:36 +0200839 opt.mfl_code = DFL_MFL_CODE;
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100840 opt.trunc_hmac = DFL_TRUNC_HMAC;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200841 opt.tickets = DFL_TICKETS;
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100842 opt.ticket_timeout = DFL_TICKET_TIMEOUT;
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100843 opt.cache_max = DFL_CACHE_MAX;
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100844 opt.cache_timeout = DFL_CACHE_TIMEOUT;
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +0100845 opt.sni = DFL_SNI;
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200846 opt.alpn_string = DFL_ALPN_STRING;
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +0200847 opt.dhm_file = DFL_DHM_FILE;
Manuel Pégourié-Gonnarde29fd4b2014-02-06 14:02:55 +0100848 opt.transport = DFL_TRANSPORT;
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +0200849 opt.cookies = DFL_COOKIES;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +0200850 opt.anti_replay = DFL_ANTI_REPLAY;
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200851 opt.hs_to_min = DFL_HS_TO_MIN;
852 opt.hs_to_max = DFL_HS_TO_MAX;
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +0200853 opt.badmac_limit = DFL_BADMAC_LIMIT;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200854 opt.extended_ms = DFL_EXTENDED_MS;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100855 opt.etm = DFL_ETM;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000856
857 for( i = 1; i < argc; i++ )
858 {
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000859 p = argv[i];
860 if( ( q = strchr( p, '=' ) ) == NULL )
861 goto usage;
862 *q++ = '\0';
863
864 if( strcmp( p, "server_port" ) == 0 )
865 {
866 opt.server_port = atoi( q );
867 if( opt.server_port < 1 || opt.server_port > 65535 )
868 goto usage;
869 }
Manuel Pégourié-Gonnard18d31f82013-12-13 16:21:41 +0100870 else if( strcmp( p, "server_addr" ) == 0 )
871 opt.server_addr = q;
Manuel Pégourié-Gonnarde29fd4b2014-02-06 14:02:55 +0100872 else if( strcmp( p, "dtls" ) == 0 )
873 {
874 int t = atoi( q );
875 if( t == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200876 opt.transport = MBEDTLS_SSL_TRANSPORT_STREAM;
Manuel Pégourié-Gonnarde29fd4b2014-02-06 14:02:55 +0100877 else if( t == 1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200878 opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
Manuel Pégourié-Gonnarde29fd4b2014-02-06 14:02:55 +0100879 else
880 goto usage;
881 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000882 else if( strcmp( p, "debug_level" ) == 0 )
883 {
884 opt.debug_level = atoi( q );
885 if( opt.debug_level < 0 || opt.debug_level > 65535 )
886 goto usage;
887 }
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +0100888 else if( strcmp( p, "nbio" ) == 0 )
889 {
890 opt.nbio = atoi( q );
891 if( opt.nbio < 0 || opt.nbio > 2 )
892 goto usage;
893 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +0200894 else if( strcmp( p, "read_timeout" ) == 0 )
895 opt.read_timeout = atoi( q );
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000896 else if( strcmp( p, "ca_file" ) == 0 )
897 opt.ca_file = q;
898 else if( strcmp( p, "ca_path" ) == 0 )
899 opt.ca_path = q;
900 else if( strcmp( p, "crt_file" ) == 0 )
901 opt.crt_file = q;
902 else if( strcmp( p, "key_file" ) == 0 )
903 opt.key_file = q;
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +0200904 else if( strcmp( p, "crt_file2" ) == 0 )
905 opt.crt_file2 = q;
906 else if( strcmp( p, "key_file2" ) == 0 )
907 opt.key_file2 = q;
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +0200908 else if( strcmp( p, "dhm_file" ) == 0 )
909 opt.dhm_file = q;
Paul Bakkerfbb17802013-04-17 19:10:21 +0200910 else if( strcmp( p, "psk" ) == 0 )
911 opt.psk = q;
912 else if( strcmp( p, "psk_identity" ) == 0 )
913 opt.psk_identity = q;
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +0200914 else if( strcmp( p, "psk_list" ) == 0 )
915 opt.psk_list = q;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000916 else if( strcmp( p, "force_ciphersuite" ) == 0 )
917 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200918 opt.force_ciphersuite[0] = mbedtls_ssl_get_ciphersuite_id( q );
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000919
Manuel Pégourié-Gonnard8de259b2014-06-11 14:19:06 +0200920 if( opt.force_ciphersuite[0] == 0 )
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000921 {
922 ret = 2;
923 goto usage;
924 }
925 opt.force_ciphersuite[1] = 0;
926 }
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +0200927 else if( strcmp( p, "version_suites" ) == 0 )
928 opt.version_suites = q;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000929 else if( strcmp( p, "renegotiation" ) == 0 )
930 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200931 opt.renegotiation = (atoi( q )) ? MBEDTLS_SSL_RENEGOTIATION_ENABLED :
932 MBEDTLS_SSL_RENEGOTIATION_DISABLED;
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000933 }
934 else if( strcmp( p, "allow_legacy" ) == 0 )
935 {
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +0100936 switch( atoi( q ) )
937 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200938 case -1: opt.allow_legacy = MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE; break;
939 case 0: opt.allow_legacy = MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION; break;
940 case 1: opt.allow_legacy = MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION; break;
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +0100941 default: goto usage;
942 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +0000943 }
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100944 else if( strcmp( p, "renegotiate" ) == 0 )
945 {
946 opt.renegotiate = atoi( q );
947 if( opt.renegotiate < 0 || opt.renegotiate > 1 )
948 goto usage;
949 }
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200950 else if( strcmp( p, "renego_delay" ) == 0 )
951 {
952 opt.renego_delay = atoi( q );
953 }
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +0100954 else if( strcmp( p, "renego_period" ) == 0 )
955 {
956 opt.renego_period = atoi( q );
957 if( opt.renego_period < 2 || opt.renego_period > 255 )
958 goto usage;
959 }
Manuel Pégourié-Gonnard67686c42014-08-15 11:17:27 +0200960 else if( strcmp( p, "exchanges" ) == 0 )
961 {
962 opt.exchanges = atoi( q );
Manuel Pégourié-Gonnard6a2bc232014-10-09 15:33:13 +0200963 if( opt.exchanges < 0 )
Manuel Pégourié-Gonnard67686c42014-08-15 11:17:27 +0200964 goto usage;
965 }
Paul Bakker1d29fb52012-09-28 13:28:45 +0000966 else if( strcmp( p, "min_version" ) == 0 )
967 {
968 if( strcmp( q, "ssl3" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200969 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_0;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000970 else if( strcmp( q, "tls1" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200971 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_1;
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100972 else if( strcmp( q, "tls1_1" ) == 0 ||
973 strcmp( q, "dtls1" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200974 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2;
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100975 else if( strcmp( q, "tls1_2" ) == 0 ||
976 strcmp( q, "dtls1_2" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200977 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000978 else
979 goto usage;
980 }
Paul Bakkerc1516be2013-06-29 16:01:32 +0200981 else if( strcmp( p, "max_version" ) == 0 )
982 {
983 if( strcmp( q, "ssl3" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200984 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_0;
Paul Bakkerc1516be2013-06-29 16:01:32 +0200985 else if( strcmp( q, "tls1" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200986 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_1;
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100987 else if( strcmp( q, "tls1_1" ) == 0 ||
988 strcmp( q, "dtls1" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200989 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2;
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100990 else if( strcmp( q, "tls1_2" ) == 0 ||
991 strcmp( q, "dtls1_2" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200992 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3;
Paul Bakkerc1516be2013-06-29 16:01:32 +0200993 else
994 goto usage;
995 }
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100996 else if( strcmp( p, "arc4" ) == 0 )
997 {
998 switch( atoi( q ) )
999 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001000 case 0: opt.arc4 = MBEDTLS_SSL_ARC4_DISABLED; break;
1001 case 1: opt.arc4 = MBEDTLS_SSL_ARC4_ENABLED; break;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01001002 default: goto usage;
1003 }
1004 }
Paul Bakkerc1516be2013-06-29 16:01:32 +02001005 else if( strcmp( p, "force_version" ) == 0 )
1006 {
1007 if( strcmp( q, "ssl3" ) == 0 )
1008 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001009 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_0;
1010 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_0;
Paul Bakkerc1516be2013-06-29 16:01:32 +02001011 }
1012 else if( strcmp( q, "tls1" ) == 0 )
1013 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001014 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_1;
1015 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_1;
Paul Bakkerc1516be2013-06-29 16:01:32 +02001016 }
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +01001017 else if( strcmp( q, "tls1_1" ) == 0 )
Paul Bakkerc1516be2013-06-29 16:01:32 +02001018 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001019 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2;
1020 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2;
Paul Bakkerc1516be2013-06-29 16:01:32 +02001021 }
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +01001022 else if( strcmp( q, "tls1_2" ) == 0 )
Paul Bakkerc1516be2013-06-29 16:01:32 +02001023 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001024 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3;
1025 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3;
Paul Bakkerc1516be2013-06-29 16:01:32 +02001026 }
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +01001027 else if( strcmp( q, "dtls1" ) == 0 )
1028 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001029 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2;
1030 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2;
1031 opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +01001032 }
1033 else if( strcmp( q, "dtls1_2" ) == 0 )
1034 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001035 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3;
1036 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3;
1037 opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +01001038 }
Paul Bakkerc1516be2013-06-29 16:01:32 +02001039 else
1040 goto usage;
1041 }
Paul Bakker91ebfb52012-11-23 14:04:08 +01001042 else if( strcmp( p, "auth_mode" ) == 0 )
1043 {
1044 if( strcmp( q, "none" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001045 opt.auth_mode = MBEDTLS_SSL_VERIFY_NONE;
Paul Bakker91ebfb52012-11-23 14:04:08 +01001046 else if( strcmp( q, "optional" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001047 opt.auth_mode = MBEDTLS_SSL_VERIFY_OPTIONAL;
Paul Bakker91ebfb52012-11-23 14:04:08 +01001048 else if( strcmp( q, "required" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001049 opt.auth_mode = MBEDTLS_SSL_VERIFY_REQUIRED;
Paul Bakker91ebfb52012-11-23 14:04:08 +01001050 else
1051 goto usage;
1052 }
Manuel Pégourié-Gonnard0c017a52013-07-18 14:07:36 +02001053 else if( strcmp( p, "max_frag_len" ) == 0 )
1054 {
1055 if( strcmp( q, "512" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001056 opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_512;
Manuel Pégourié-Gonnard0c017a52013-07-18 14:07:36 +02001057 else if( strcmp( q, "1024" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001058 opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_1024;
Manuel Pégourié-Gonnard0c017a52013-07-18 14:07:36 +02001059 else if( strcmp( q, "2048" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001060 opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_2048;
Manuel Pégourié-Gonnard0c017a52013-07-18 14:07:36 +02001061 else if( strcmp( q, "4096" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001062 opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_4096;
Manuel Pégourié-Gonnard0c017a52013-07-18 14:07:36 +02001063 else
1064 goto usage;
1065 }
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001066 else if( strcmp( p, "alpn" ) == 0 )
1067 {
1068 opt.alpn_string = q;
1069 }
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +01001070 else if( strcmp( p, "trunc_hmac" ) == 0 )
1071 {
1072 switch( atoi( q ) )
1073 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001074 case 0: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_DISABLED; break;
1075 case 1: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; break;
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +01001076 default: goto usage;
1077 }
1078 }
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001079 else if( strcmp( p, "extended_ms" ) == 0 )
1080 {
1081 switch( atoi( q ) )
1082 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001083 case 0: opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_DISABLED; break;
1084 case 1: opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; break;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001085 default: goto usage;
1086 }
1087 }
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001088 else if( strcmp( p, "etm" ) == 0 )
1089 {
1090 switch( atoi( q ) )
1091 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001092 case 0: opt.etm = MBEDTLS_SSL_ETM_DISABLED; break;
1093 case 1: opt.etm = MBEDTLS_SSL_ETM_ENABLED; break;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001094 default: goto usage;
1095 }
1096 }
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02001097 else if( strcmp( p, "tickets" ) == 0 )
1098 {
1099 opt.tickets = atoi( q );
1100 if( opt.tickets < 0 || opt.tickets > 1 )
1101 goto usage;
1102 }
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +01001103 else if( strcmp( p, "ticket_timeout" ) == 0 )
1104 {
1105 opt.ticket_timeout = atoi( q );
1106 if( opt.ticket_timeout < 0 )
1107 goto usage;
1108 }
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +01001109 else if( strcmp( p, "cache_max" ) == 0 )
1110 {
1111 opt.cache_max = atoi( q );
1112 if( opt.cache_max < 0 )
1113 goto usage;
1114 }
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001115 else if( strcmp( p, "cache_timeout" ) == 0 )
1116 {
1117 opt.cache_timeout = atoi( q );
1118 if( opt.cache_timeout < 0 )
1119 goto usage;
1120 }
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +02001121 else if( strcmp( p, "cookies" ) == 0 )
1122 {
1123 opt.cookies = atoi( q );
1124 if( opt.cookies < -1 || opt.cookies > 1)
1125 goto usage;
1126 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001127 else if( strcmp( p, "anti_replay" ) == 0 )
1128 {
1129 opt.anti_replay = atoi( q );
1130 if( opt.anti_replay < 0 || opt.anti_replay > 1)
1131 goto usage;
1132 }
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02001133 else if( strcmp( p, "badmac_limit" ) == 0 )
1134 {
1135 opt.badmac_limit = atoi( q );
1136 if( opt.badmac_limit < 0 )
1137 goto usage;
1138 }
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +02001139 else if( strcmp( p, "hs_timeout" ) == 0 )
1140 {
1141 if( ( p = strchr( q, '-' ) ) == NULL )
1142 goto usage;
1143 *p++ = '\0';
1144 opt.hs_to_min = atoi( q );
1145 opt.hs_to_max = atoi( p );
1146 if( opt.hs_to_min == 0 || opt.hs_to_max < opt.hs_to_min )
1147 goto usage;
1148 }
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01001149 else if( strcmp( p, "sni" ) == 0 )
1150 {
1151 opt.sni = q;
1152 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001153 else
1154 goto usage;
1155 }
1156
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001157#if defined(MBEDTLS_DEBUG_C)
1158 mbedtls_debug_set_threshold( opt.debug_level );
Paul Bakkerc73079a2014-04-25 16:34:30 +02001159#endif
1160
Paul Bakkerc1516be2013-06-29 16:01:32 +02001161 if( opt.force_ciphersuite[0] > 0 )
1162 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001163 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
1164 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( opt.force_ciphersuite[0] );
Paul Bakkerc1516be2013-06-29 16:01:32 +02001165
Paul Bakker5b55b792013-07-19 13:43:43 +02001166 if( opt.max_version != -1 &&
1167 ciphersuite_info->min_minor_ver > opt.max_version )
1168 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001169 mbedtls_printf("forced ciphersuite not allowed with this protocol version\n");
Paul Bakker5b55b792013-07-19 13:43:43 +02001170 ret = 2;
1171 goto usage;
1172 }
1173 if( opt.min_version != -1 &&
Paul Bakkerc1516be2013-06-29 16:01:32 +02001174 ciphersuite_info->max_minor_ver < opt.min_version )
1175 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001176 mbedtls_printf("forced ciphersuite not allowed with this protocol version\n");
Paul Bakkerc1516be2013-06-29 16:01:32 +02001177 ret = 2;
1178 goto usage;
1179 }
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +01001180
1181 /* If we select a version that's not supported by
1182 * this suite, then there will be no common ciphersuite... */
1183 if( opt.max_version == -1 ||
1184 opt.max_version > ciphersuite_info->max_minor_ver )
1185 {
Paul Bakker5b55b792013-07-19 13:43:43 +02001186 opt.max_version = ciphersuite_info->max_minor_ver;
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +01001187 }
Paul Bakker5b55b792013-07-19 13:43:43 +02001188 if( opt.min_version < ciphersuite_info->min_minor_ver )
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +01001189 {
Paul Bakker5b55b792013-07-19 13:43:43 +02001190 opt.min_version = ciphersuite_info->min_minor_ver;
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +01001191 /* DTLS starts with TLS 1.1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001192 if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
1193 opt.min_version < MBEDTLS_SSL_MINOR_VERSION_2 )
1194 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2;
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +01001195 }
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +00001196
1197 /* Enable RC4 if needed and not explicitly disabled */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001198 if( ciphersuite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +00001199 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001200 if( opt.arc4 == MBEDTLS_SSL_ARC4_DISABLED )
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +00001201 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001202 mbedtls_printf("forced RC4 ciphersuite with RC4 disabled\n");
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +00001203 ret = 2;
1204 goto usage;
1205 }
1206
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001207 opt.arc4 = MBEDTLS_SSL_ARC4_ENABLED;
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +00001208 }
Paul Bakkerc1516be2013-06-29 16:01:32 +02001209 }
1210
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +02001211 if( opt.version_suites != NULL )
1212 {
1213 const char *name[4] = { 0 };
1214
1215 /* Parse 4-element coma-separated list */
1216 for( i = 0, p = (char *) opt.version_suites;
1217 i < 4 && *p != '\0';
1218 i++ )
1219 {
1220 name[i] = p;
1221
1222 /* Terminate the current string and move on to next one */
1223 while( *p != ',' && *p != '\0' )
1224 p++;
1225 if( *p == ',' )
1226 *p++ = '\0';
1227 }
1228
1229 if( i != 4 )
1230 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001231 mbedtls_printf( "too few values for version_suites\n" );
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +02001232 ret = 1;
1233 goto exit;
1234 }
1235
1236 memset( version_suites, 0, sizeof( version_suites ) );
1237
1238 /* Get the suites identifiers from their name */
1239 for( i = 0; i < 4; i++ )
1240 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001241 version_suites[i][0] = mbedtls_ssl_get_ciphersuite_id( name[i] );
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +02001242
1243 if( version_suites[i][0] == 0 )
1244 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001245 mbedtls_printf( "unknown ciphersuite: '%s'\n", name[i] );
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +02001246 ret = 2;
1247 goto usage;
1248 }
1249 }
1250 }
1251
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001252#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001253 /*
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +02001254 * Unhexify the pre-shared key and parse the list if any given
Paul Bakkerfbb17802013-04-17 19:10:21 +02001255 */
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +02001256 if( unhexify( psk, opt.psk, &psk_len ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02001257 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001258 mbedtls_printf( "pre-shared key not valid hex\n" );
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +02001259 goto exit;
1260 }
1261
1262 if( opt.psk_list != NULL )
1263 {
1264 if( ( psk_info = psk_parse( opt.psk_list ) ) == NULL )
Paul Bakkerfbb17802013-04-17 19:10:21 +02001265 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001266 mbedtls_printf( "psk_list invalid" );
Paul Bakkerfbb17802013-04-17 19:10:21 +02001267 goto exit;
1268 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02001269 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001270#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02001271
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001272#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001273 if( opt.alpn_string != NULL )
1274 {
1275 p = (char *) opt.alpn_string;
1276 i = 0;
1277
1278 /* Leave room for a final NULL in alpn_list */
1279 while( i < (int) sizeof alpn_list - 1 && *p != '\0' )
1280 {
1281 alpn_list[i++] = p;
1282
1283 /* Terminate the current string and move on to next one */
1284 while( *p != ',' && *p != '\0' )
1285 p++;
1286 if( *p == ',' )
1287 *p++ = '\0';
1288 }
1289 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001290#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001291
Paul Bakkerfbb17802013-04-17 19:10:21 +02001292 /*
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001293 * 0. Initialize the RNG and the session data
1294 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001295 mbedtls_printf( "\n . Seeding the random number generator..." );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001296 fflush( stdout );
1297
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001298 mbedtls_entropy_init( &entropy );
1299 if( ( ret = mbedtls_ctr_drbg_init( &ctr_drbg, mbedtls_entropy_func, &entropy,
Paul Bakkeref3f8c72013-06-24 13:01:08 +02001300 (const unsigned char *) pers,
1301 strlen( pers ) ) ) != 0 )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001302 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001303 mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_init returned -0x%x\n", -ret );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001304 goto exit;
1305 }
1306
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001307 mbedtls_printf( " ok\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001308
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001309#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001310 /*
1311 * 1.1. Load the trusted CA
1312 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001313 mbedtls_printf( " . Loading the CA root certificate ..." );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001314 fflush( stdout );
1315
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001316#if defined(MBEDTLS_FS_IO)
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001317 if( strlen( opt.ca_path ) )
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001318 if( strcmp( opt.ca_path, "none" ) == 0 )
1319 ret = 0;
1320 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001321 ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001322 else if( strlen( opt.ca_file ) )
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001323 if( strcmp( opt.ca_file, "none" ) == 0 )
1324 ret = 0;
1325 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001326 ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file );
Paul Bakkerddf26b42013-09-18 13:46:23 +02001327 else
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001328#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001329#if defined(MBEDTLS_CERTS_C)
1330 for( i = 0; mbedtls_test_cas[i] != NULL; i++ )
Manuel Pégourié-Gonnard2f165062015-03-27 10:20:26 +01001331 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001332 ret = mbedtls_x509_crt_parse( &cacert,
1333 (const unsigned char *) mbedtls_test_cas[i],
1334 mbedtls_test_cas_len[i] );
Manuel Pégourié-Gonnard2f165062015-03-27 10:20:26 +01001335 if( ret != 0 )
1336 break;
1337 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001338#else
1339 {
1340 ret = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001341 mbedtls_printf("MBEDTLS_CERTS_C not defined.");
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001342 }
1343#endif
1344 if( ret < 0 )
1345 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001346 mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001347 goto exit;
1348 }
1349
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001350 mbedtls_printf( " ok (%d skipped)\n", ret );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001351
1352 /*
1353 * 1.2. Load own certificate and private key
1354 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001355 mbedtls_printf( " . Loading the server cert. and key..." );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001356 fflush( stdout );
1357
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001358#if defined(MBEDTLS_FS_IO)
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001359 if( strlen( opt.crt_file ) && strcmp( opt.crt_file, "none" ) != 0 )
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001360 {
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001361 key_cert_init++;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001362 if( ( ret = mbedtls_x509_crt_parse_file( &srvcert, opt.crt_file ) ) != 0 )
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001363 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001364 mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file returned -0x%x\n\n",
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001365 -ret );
1366 goto exit;
1367 }
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001368 }
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001369 if( strlen( opt.key_file ) && strcmp( opt.key_file, "none" ) != 0 )
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001370 {
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001371 key_cert_init++;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001372 if( ( ret = mbedtls_pk_parse_keyfile( &pkey, opt.key_file, "" ) ) != 0 )
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001373 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001374 mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001375 goto exit;
1376 }
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001377 }
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001378 if( key_cert_init == 1 )
1379 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001380 mbedtls_printf( " failed\n ! crt_file without key_file or vice-versa\n\n" );
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001381 goto exit;
1382 }
1383
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001384 if( strlen( opt.crt_file2 ) && strcmp( opt.crt_file2, "none" ) != 0 )
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001385 {
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001386 key_cert_init2++;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001387 if( ( ret = mbedtls_x509_crt_parse_file( &srvcert2, opt.crt_file2 ) ) != 0 )
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001388 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001389 mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file(2) returned -0x%x\n\n",
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001390 -ret );
1391 goto exit;
1392 }
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001393 }
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001394 if( strlen( opt.key_file2 ) && strcmp( opt.key_file2, "none" ) != 0 )
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001395 {
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001396 key_cert_init2++;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001397 if( ( ret = mbedtls_pk_parse_keyfile( &pkey2, opt.key_file2, "" ) ) != 0 )
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001398 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001399 mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile(2) returned -0x%x\n\n",
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001400 -ret );
1401 goto exit;
1402 }
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001403 }
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001404 if( key_cert_init2 == 1 )
1405 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001406 mbedtls_printf( " failed\n ! crt_file2 without key_file2 or vice-versa\n\n" );
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001407 goto exit;
1408 }
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001409#endif
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001410 if( key_cert_init == 0 &&
1411 strcmp( opt.crt_file, "none" ) != 0 &&
1412 strcmp( opt.key_file, "none" ) != 0 &&
1413 key_cert_init2 == 0 &&
1414 strcmp( opt.crt_file2, "none" ) != 0 &&
1415 strcmp( opt.key_file2, "none" ) != 0 )
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001417#if !defined(MBEDTLS_CERTS_C)
1418 mbedtls_printf( "Not certificated or key provided, and \n"
1419 "MBEDTLS_CERTS_C not defined!\n" );
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001420 goto exit;
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001421#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001422#if defined(MBEDTLS_RSA_C)
1423 if( ( ret = mbedtls_x509_crt_parse( &srvcert,
1424 (const unsigned char *) mbedtls_test_srv_crt_rsa,
1425 mbedtls_test_srv_crt_rsa_len ) ) != 0 )
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001426 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001427 mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001428 goto exit;
1429 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001430 if( ( ret = mbedtls_pk_parse_key( &pkey,
1431 (const unsigned char *) mbedtls_test_srv_key_rsa,
1432 mbedtls_test_srv_key_rsa_len, NULL, 0 ) ) != 0 )
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001433 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001434 mbedtls_printf( " failed\n ! mbedtls_pk_parse_key returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001435 goto exit;
1436 }
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001437 key_cert_init = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001438#endif /* MBEDTLS_RSA_C */
1439#if defined(MBEDTLS_ECDSA_C)
1440 if( ( ret = mbedtls_x509_crt_parse( &srvcert2,
1441 (const unsigned char *) mbedtls_test_srv_crt_ec,
1442 mbedtls_test_srv_crt_ec_len ) ) != 0 )
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001443 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001444 mbedtls_printf( " failed\n ! x509_crt_parse2 returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001445 goto exit;
1446 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001447 if( ( ret = mbedtls_pk_parse_key( &pkey2,
1448 (const unsigned char *) mbedtls_test_srv_key_ec,
1449 mbedtls_test_srv_key_ec_len, NULL, 0 ) ) != 0 )
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001450 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001451 mbedtls_printf( " failed\n ! pk_parse_key2 returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001452 goto exit;
1453 }
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001454 key_cert_init2 = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001455#endif /* MBEDTLS_ECDSA_C */
1456#endif /* MBEDTLS_CERTS_C */
Manuel Pégourié-Gonnardac8474f2013-09-25 11:35:15 +02001457 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001458
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001459 mbedtls_printf( " ok\n" );
1460#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001461
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001462#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO)
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001463 if( opt.dhm_file != NULL )
1464 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001465 mbedtls_printf( " . Loading DHM parameters..." );
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001466 fflush( stdout );
1467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001468 if( ( ret = mbedtls_dhm_parse_dhmfile( &dhm, opt.dhm_file ) ) != 0 )
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001469 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001470 mbedtls_printf( " failed\n ! mbedtls_dhm_parse_dhmfile returned -0x%04X\n\n",
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001471 -ret );
1472 goto exit;
1473 }
1474
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001475 mbedtls_printf( " ok\n" );
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001476 }
1477#endif
1478
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +02001479#if defined(SNI_OPTION)
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01001480 if( opt.sni != NULL )
1481 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001482 mbedtls_printf( " . Setting up SNI information..." );
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01001483 fflush( stdout );
1484
1485 if( ( sni_info = sni_parse( opt.sni ) ) == NULL )
1486 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001487 mbedtls_printf( " failed\n" );
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01001488 goto exit;
1489 }
1490
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001491 mbedtls_printf( " ok\n" );
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01001492 }
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +02001493#endif /* SNI_OPTION */
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01001494
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001495 /*
1496 * 2. Setup the listening TCP socket
1497 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001498 mbedtls_printf( " . Bind on %s://%s:%-4d/ ...",
1499 opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ? "tcp" : "udp",
Manuel Pégourié-Gonnard8a06d9c2014-03-23 18:23:41 +01001500 opt.server_addr ? opt.server_addr : "*",
1501 opt.server_port );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001502 fflush( stdout );
1503
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001504 if( ( ret = mbedtls_net_bind( &listen_fd, opt.server_addr, opt.server_port,
1505 opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ?
1506 MBEDTLS_NET_PROTO_TCP : MBEDTLS_NET_PROTO_UDP ) ) != 0 )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001507 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001508 mbedtls_printf( " failed\n ! mbedtls_net_bind returned -0x%x\n\n", -ret );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001509 goto exit;
1510 }
1511
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001512 mbedtls_printf( " ok\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001513
1514 /*
1515 * 3. Setup stuff
1516 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001517 mbedtls_printf( " . Setting up the SSL/TLS structure..." );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001518 fflush( stdout );
1519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001520 if( ( ret = mbedtls_ssl_init( &ssl ) ) != 0 )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001521 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001522 mbedtls_printf( " failed\n ! mbedtls_ssl_init returned -0x%x\n\n", -ret );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001523 goto exit;
1524 }
1525
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001526 mbedtls_ssl_set_endpoint( &ssl, MBEDTLS_SSL_IS_SERVER );
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001527 if( opt.auth_mode != DFL_AUTH_MODE )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001528 mbedtls_ssl_set_authmode( &ssl, opt.auth_mode );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001529
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001530#if defined(MBEDTLS_SSL_PROTO_DTLS)
1531 if( ( ret = mbedtls_ssl_set_transport( &ssl, opt.transport ) ) != 0 )
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001532 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001533 mbedtls_printf( " failed\n ! selected transport is not available\n" );
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001534 goto exit;
1535 }
1536
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +02001537 if( opt.hs_to_min != DFL_HS_TO_MIN || opt.hs_to_max != DFL_HS_TO_MAX )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001538 mbedtls_ssl_set_handshake_timeout( &ssl, opt.hs_to_min, opt.hs_to_max );
1539#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +02001540
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001541#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1542 if( ( ret = mbedtls_ssl_set_max_frag_len( &ssl, opt.mfl_code ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001543 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001544 mbedtls_printf( " failed\n ! mbedtls_ssl_set_max_frag_len returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001545 goto exit;
1546 };
Paul Bakker05decb22013-08-15 13:33:48 +02001547#endif
Manuel Pégourié-Gonnard0c017a52013-07-18 14:07:36 +02001548
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001549#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +01001550 if( opt.trunc_hmac != DFL_TRUNC_HMAC )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001551 mbedtls_ssl_set_truncated_hmac( &ssl, opt.trunc_hmac );
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +01001552#endif
1553
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001554#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001555 if( opt.extended_ms != DFL_EXTENDED_MS )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001556 mbedtls_ssl_set_extended_master_secret( &ssl, opt.extended_ms );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001557#endif
1558
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001559#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001560 if( opt.etm != DFL_ETM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001561 mbedtls_ssl_set_encrypt_then_mac( &ssl, opt.etm );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001562#endif
1563
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001564#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001565 if( opt.alpn_string != NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001566 if( ( ret = mbedtls_ssl_set_alpn_protocols( &ssl, alpn_list ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001567 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001568 mbedtls_printf( " failed\n ! mbedtls_ssl_set_alpn_protocols returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001569 goto exit;
1570 }
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001571#endif
1572
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001573 mbedtls_ssl_set_rng( &ssl, mbedtls_ctr_drbg_random, &ctr_drbg );
1574 mbedtls_ssl_set_dbg( &ssl, my_debug, stdout );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001575
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001576#if defined(MBEDTLS_SSL_CACHE_C)
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +01001577 if( opt.cache_max != -1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001578 mbedtls_ssl_cache_set_max_entries( &cache, opt.cache_max );
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +01001579
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001580 if( opt.cache_timeout != -1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001581 mbedtls_ssl_cache_set_timeout( &cache, opt.cache_timeout );
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001582
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001583 mbedtls_ssl_set_session_cache( &ssl, mbedtls_ssl_cache_get, &cache,
1584 mbedtls_ssl_cache_set, &cache );
Paul Bakker0a597072012-09-25 21:55:46 +00001585#endif
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001586
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001587#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1588 if( ( ret = mbedtls_ssl_set_session_tickets( &ssl, opt.tickets ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001589 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001590 mbedtls_printf( " failed\n ! mbedtls_ssl_set_session_tickets returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001591 goto exit;
1592 }
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +01001593
1594 if( opt.ticket_timeout != -1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001595 mbedtls_ssl_set_session_ticket_lifetime( &ssl, opt.ticket_timeout );
Paul Bakkera503a632013-08-14 13:48:06 +02001596#endif
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02001597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001598#if defined(MBEDTLS_SSL_PROTO_DTLS)
1599 if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard98545f12014-07-22 22:10:43 +02001600 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001601#if defined(MBEDTLS_SSL_COOKIE_C)
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +02001602 if( opt.cookies > 0 )
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02001603 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001604 if( ( ret = mbedtls_ssl_cookie_setup( &cookie_ctx,
1605 mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 )
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +02001606 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001607 mbedtls_printf( " failed\n ! mbedtls_ssl_cookie_setup returned %d\n\n", ret );
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +02001608 goto exit;
1609 }
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02001610
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001611 mbedtls_ssl_set_dtls_cookies( &ssl, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check,
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +02001612 &cookie_ctx );
1613 }
1614 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001615#endif /* MBEDTLS_SSL_COOKIE_C */
1616#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +02001617 if( opt.cookies == 0 )
1618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001619 mbedtls_ssl_set_dtls_cookies( &ssl, NULL, NULL, NULL );
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +02001620 }
1621 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001622#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard26820e32014-07-23 19:34:59 +02001623 {
1624 ; /* Nothing to do */
1625 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001626
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001627#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001628 if( opt.anti_replay != DFL_ANTI_REPLAY )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001629 mbedtls_ssl_set_dtls_anti_replay( &ssl, opt.anti_replay );
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02001630#endif
1631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001632#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02001633 if( opt.badmac_limit != DFL_BADMAC_LIMIT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001634 mbedtls_ssl_set_dtls_badmac_limit( &ssl, opt.badmac_limit );
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001635#endif
Manuel Pégourié-Gonnard98545f12014-07-22 22:10:43 +02001636 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001637#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard98545f12014-07-22 22:10:43 +02001638
Paul Bakker41c83d32013-03-20 14:39:14 +01001639 if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001640 mbedtls_ssl_set_ciphersuites( &ssl, opt.force_ciphersuite );
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +00001641
1642 if( opt.arc4 != DFL_ARC4 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001643 mbedtls_ssl_set_arc4_support( &ssl, opt.arc4 );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001644
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +02001645 if( opt.version_suites != NULL )
1646 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001647 mbedtls_ssl_set_ciphersuites_for_version( &ssl, version_suites[0],
1648 MBEDTLS_SSL_MAJOR_VERSION_3,
1649 MBEDTLS_SSL_MINOR_VERSION_0 );
1650 mbedtls_ssl_set_ciphersuites_for_version( &ssl, version_suites[1],
1651 MBEDTLS_SSL_MAJOR_VERSION_3,
1652 MBEDTLS_SSL_MINOR_VERSION_1 );
1653 mbedtls_ssl_set_ciphersuites_for_version( &ssl, version_suites[2],
1654 MBEDTLS_SSL_MAJOR_VERSION_3,
1655 MBEDTLS_SSL_MINOR_VERSION_2 );
1656 mbedtls_ssl_set_ciphersuites_for_version( &ssl, version_suites[3],
1657 MBEDTLS_SSL_MAJOR_VERSION_3,
1658 MBEDTLS_SSL_MINOR_VERSION_3 );
Manuel Pégourié-Gonnard6dc07812014-06-11 13:50:34 +02001659 }
1660
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001661 if( opt.allow_legacy != DFL_ALLOW_LEGACY )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001662 mbedtls_ssl_legacy_renegotiation( &ssl, opt.allow_legacy );
1663#if defined(MBEDTLS_SSL_RENEGOTIATION)
1664 mbedtls_ssl_set_renegotiation( &ssl, opt.renegotiation );
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001665
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001666 if( opt.renego_delay != DFL_RENEGO_DELAY )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001667 mbedtls_ssl_set_renegotiation_enforced( &ssl, opt.renego_delay );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001668
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001669 if( opt.renego_period != DFL_RENEGO_PERIOD )
1670 {
1671 renego_period[7] = opt.renego_period;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001672 mbedtls_ssl_set_renegotiation_period( &ssl, renego_period );
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001673 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001674#endif
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001676#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001677 if( strcmp( opt.ca_path, "none" ) != 0 &&
1678 strcmp( opt.ca_file, "none" ) != 0 )
1679 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001680 mbedtls_ssl_set_ca_chain( &ssl, &cacert, NULL, NULL );
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001681 }
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001682 if( key_cert_init )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001683 if( ( ret = mbedtls_ssl_set_own_cert( &ssl, &srvcert, &pkey ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001684 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001685 mbedtls_printf( " failed\n ! mbedtls_ssl_set_own_cert returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001686 goto exit;
1687 }
Manuel Pégourié-Gonnarda0fdf8b2013-09-25 14:05:49 +02001688 if( key_cert_init2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001689 if( ( ret = mbedtls_ssl_set_own_cert( &ssl, &srvcert2, &pkey2 ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001690 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001691 mbedtls_printf( " failed\n ! mbedtls_ssl_set_own_cert returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001692 goto exit;
1693 }
Manuel Pégourié-Gonnardb095a7b2013-09-24 21:14:51 +02001694#endif
Paul Bakkered27a042013-04-18 22:46:23 +02001695
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +02001696#if defined(SNI_OPTION)
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01001697 if( opt.sni != NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001698 mbedtls_ssl_set_sni( &ssl, sni_callback, sni_info );
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01001699#endif
1700
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001701#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnarddc019b92014-06-10 15:24:51 +02001702 if( strlen( opt.psk ) != 0 && strlen( opt.psk_identity ) != 0 )
1703 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001704 ret = mbedtls_ssl_set_psk( &ssl, psk, psk_len,
Manuel Pégourié-Gonnarddc019b92014-06-10 15:24:51 +02001705 (const unsigned char *) opt.psk_identity,
1706 strlen( opt.psk_identity ) );
1707 if( ret != 0 )
1708 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001709 mbedtls_printf( " failed\n mbedtls_ssl_set_psk returned -0x%04X\n\n", - ret );
Manuel Pégourié-Gonnarddc019b92014-06-10 15:24:51 +02001710 goto exit;
1711 }
1712 }
1713
Manuel Pégourié-Gonnard80c85532014-06-10 14:01:52 +02001714 if( opt.psk_list != NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001715 mbedtls_ssl_set_psk_cb( &ssl, psk_callback, psk_info );
Paul Bakkered27a042013-04-18 22:46:23 +02001716#endif
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001717
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001718#if defined(MBEDTLS_DHM_C)
Paul Bakker5d19f862012-09-28 07:33:00 +00001719 /*
1720 * Use different group than default DHM group
1721 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001722#if defined(MBEDTLS_FS_IO)
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001723 if( opt.dhm_file != NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001724 ret = mbedtls_ssl_set_dh_param_ctx( &ssl, &dhm );
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001725 else
1726#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001727 ret = mbedtls_ssl_set_dh_param( &ssl, MBEDTLS_DHM_RFC5114_MODP_2048_P,
1728 MBEDTLS_DHM_RFC5114_MODP_2048_G );
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001729
1730 if( ret != 0 )
1731 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001732 mbedtls_printf( " failed\n mbedtls_ssl_set_dh_param returned -0x%04X\n\n", - ret );
Manuel Pégourié-Gonnard736699c2014-06-09 11:29:50 +02001733 goto exit;
1734 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001735#endif
1736
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +02001737 if( opt.min_version != DFL_MIN_VERSION )
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001738 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001739 ret = mbedtls_ssl_set_min_version( &ssl, MBEDTLS_SSL_MAJOR_VERSION_3, opt.min_version );
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +02001740 if( ret != 0 )
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001741 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001742 mbedtls_printf( " failed\n ! selected min_version is not available\n" );
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001743 goto exit;
1744 }
1745 }
Paul Bakker1d29fb52012-09-28 13:28:45 +00001746
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +02001747 if( opt.max_version != DFL_MIN_VERSION )
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001748 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001749 ret = mbedtls_ssl_set_max_version( &ssl, MBEDTLS_SSL_MAJOR_VERSION_3, opt.max_version );
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001750 if( ret != 0 )
1751 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001752 mbedtls_printf( " failed\n ! selected max_version is not available\n" );
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001753 goto exit;
1754 }
1755 }
Paul Bakkerc1516be2013-06-29 16:01:32 +02001756
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001757 mbedtls_printf( " ok\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001758
1759reset:
Manuel Pégourié-Gonnardb6440a42014-09-20 12:03:00 +02001760#if !defined(_WIN32)
1761 if( received_sigterm )
1762 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001763 mbedtls_printf( " interrupted by SIGTERM\n" );
Manuel Pégourié-Gonnardb6440a42014-09-20 12:03:00 +02001764 ret = 0;
1765 goto exit;
1766 }
1767#endif
1768
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001769#ifdef MBEDTLS_ERROR_C
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001770 if( ret != 0 )
1771 {
1772 char error_buf[100];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001773 mbedtls_strerror( ret, error_buf, 100 );
1774 mbedtls_printf("Last error was: %d - %s\n\n", ret, error_buf );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001775 }
1776#endif
1777
1778 if( client_fd != -1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001779 mbedtls_net_close( client_fd );
Manuel Pégourié-Gonnard8a06d9c2014-03-23 18:23:41 +01001780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001781 mbedtls_ssl_session_reset( &ssl );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001782
1783 /*
1784 * 3. Wait until a client connects
1785 */
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001786 client_fd = -1;
1787
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001788 mbedtls_printf( " . Waiting for a remote connection ..." );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001789 fflush( stdout );
1790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001791 if( ( ret = mbedtls_net_accept( listen_fd, &client_fd, client_ip ) ) != 0 )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001792 {
Paul Bakkerc1283d32014-08-18 11:05:51 +02001793#if !defined(_WIN32)
Manuel Pégourié-Gonnarddb493302014-08-14 15:36:12 +02001794 if( received_sigterm )
1795 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001796 mbedtls_printf( " interrupted by signal\n" );
Manuel Pégourié-Gonnarddb493302014-08-14 15:36:12 +02001797 ret = 0;
1798 goto exit;
1799 }
Paul Bakkerc1283d32014-08-18 11:05:51 +02001800#endif
Manuel Pégourié-Gonnarddb493302014-08-14 15:36:12 +02001801
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001802 mbedtls_printf( " failed\n ! mbedtls_net_accept returned -0x%x\n\n", -ret );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001803 goto exit;
1804 }
1805
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001806 if( opt.nbio > 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001807 ret = mbedtls_net_set_nonblock( client_fd );
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001808 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001809 ret = mbedtls_net_set_block( client_fd );
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001810 if( ret != 0 )
1811 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001812 mbedtls_printf( " failed\n ! net_set_(non)block() returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001813 goto exit;
1814 }
1815
1816 if( opt.nbio == 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001817 mbedtls_ssl_set_bio_timeout( &ssl, &client_fd, my_send, my_recv, NULL, 0 );
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001818 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001819 mbedtls_ssl_set_bio_timeout( &ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv,
1820#if defined(MBEDTLS_HAVE_TIME)
1821 opt.nbio == 0 ? mbedtls_net_recv_timeout : NULL,
Manuel Pégourié-Gonnarda0148292014-09-18 16:06:04 +02001822#else
1823 NULL,
1824#endif
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02001825 opt.read_timeout );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001826
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001827#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
1828 if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard336b8242014-07-22 17:57:43 +02001829 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001830 if( ( ret = mbedtls_ssl_set_client_transport_id( &ssl, client_ip,
Manuel Pégourié-Gonnard336b8242014-07-22 17:57:43 +02001831 sizeof( client_ip ) ) ) != 0 )
1832 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001833 mbedtls_printf( " failed\n ! "
Manuel Pégourié-Gonnard336b8242014-07-22 17:57:43 +02001834 "ssl_set_client_tranport_id() returned -0x%x\n\n", -ret );
1835 goto exit;
1836 }
1837 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001838#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard336b8242014-07-22 17:57:43 +02001839
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001840 mbedtls_printf( " ok\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001841
1842 /*
Manuel Pégourié-Gonnardbd97fdb2014-09-26 16:46:36 +02001843 * With UDP, bind_fd is hijacked by client_fd, so bind a new one
1844 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001845#if defined(MBEDTLS_SSL_PROTO_DTLS)
1846 if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardbd97fdb2014-09-26 16:46:36 +02001847 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001848 mbedtls_printf( " . Re-bind on udp://%s:%-4d/ ...",
Manuel Pégourié-Gonnardbd97fdb2014-09-26 16:46:36 +02001849 opt.server_addr ? opt.server_addr : "*",
1850 opt.server_port );
1851 fflush( stdout );
1852
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001853 if( ( ret = mbedtls_net_bind( &listen_fd, opt.server_addr,
1854 opt.server_port, MBEDTLS_NET_PROTO_UDP ) ) != 0 )
Manuel Pégourié-Gonnardbd97fdb2014-09-26 16:46:36 +02001855 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001856 mbedtls_printf( " failed\n ! mbedtls_net_bind returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardbd97fdb2014-09-26 16:46:36 +02001857 goto exit;
1858 }
1859
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001860 mbedtls_printf( " ok\n" );
Manuel Pégourié-Gonnardbd97fdb2014-09-26 16:46:36 +02001861 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001862#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardbd97fdb2014-09-26 16:46:36 +02001863
1864 /*
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001865 * 4. Handshake
1866 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001867 mbedtls_printf( " . Performing the SSL/TLS handshake..." );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001868 fflush( stdout );
1869
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001870 do ret = mbedtls_ssl_handshake( &ssl );
1871 while( ret == MBEDTLS_ERR_NET_WANT_READ ||
1872 ret == MBEDTLS_ERR_NET_WANT_WRITE );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001873
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001874 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02001875 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001876 mbedtls_printf( " hello verification requested\n" );
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02001877 ret = 0;
1878 goto reset;
1879 }
1880 else if( ret != 0 )
1881 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001882 mbedtls_printf( " failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02001883 goto reset;
1884 }
1885 else /* ret == 0 */
1886 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001887 mbedtls_printf( " ok\n [ Protocol is %s ]\n [ Ciphersuite is %s ]\n",
1888 mbedtls_ssl_get_version( &ssl ), mbedtls_ssl_get_ciphersuite( &ssl ) );
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02001889 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001891 if( ( ret = mbedtls_ssl_get_record_expansion( &ssl ) ) >= 0 )
1892 mbedtls_printf( " [ Record expansion is %d ]\n", ret );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02001893 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001894 mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02001895
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001896#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001897 if( opt.alpn_string != NULL )
1898 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001899 const char *alp = mbedtls_ssl_get_alpn_protocol( &ssl );
1900 mbedtls_printf( " [ Application Layer Protocol is %s ]\n",
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001901 alp ? alp : "(none)" );
1902 }
1903#endif
1904
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001905#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001906 /*
1907 * 5. Verify the server certificate
1908 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001909 mbedtls_printf( " . Verifying peer X.509 certificate..." );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001910
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001911 if( ( ret = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001912 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001913 mbedtls_printf( " failed\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001914
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001915 if( !mbedtls_ssl_get_peer_cert( &ssl ) )
1916 mbedtls_printf( " ! no client certificate sent\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001918 if( ( ret & MBEDTLS_BADCERT_EXPIRED ) != 0 )
1919 mbedtls_printf( " ! client certificate has expired\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001921 if( ( ret & MBEDTLS_X509_BADCERT_REVOKED ) != 0 )
1922 mbedtls_printf( " ! client certificate has been revoked\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001923
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001924 if( ( ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED ) != 0 )
1925 mbedtls_printf( " ! self-signed or not signed by a trusted CA\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001927 mbedtls_printf( "\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001928 }
1929 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001930 mbedtls_printf( " ok\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001931
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001932 if( mbedtls_ssl_get_peer_cert( &ssl ) )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001933 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001934 mbedtls_printf( " . Peer certificate information ...\n" );
1935 mbedtls_x509_crt_info( (char *) buf, sizeof( buf ) - 1, " ",
1936 mbedtls_ssl_get_peer_cert( &ssl ) );
1937 mbedtls_printf( "%s\n", buf );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001938 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001939#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001940
Manuel Pégourié-Gonnard6a2bc232014-10-09 15:33:13 +02001941 if( opt.exchanges == 0 )
1942 goto close_notify;
1943
Manuel Pégourié-Gonnard6a0017b2015-01-22 10:33:29 +00001944 exchanges_left = opt.exchanges;
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02001945data_exchange:
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001946 /*
1947 * 6. Read the HTTP Request
1948 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001949 mbedtls_printf( " < Read from client:" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001950 fflush( stdout );
1951
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001952 /*
1953 * TLS and DTLS need different reading styles (stream vs datagram)
1954 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001955 if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00001956 {
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001957 do
1958 {
1959 int terminated = 0;
1960 len = sizeof( buf ) - 1;
1961 memset( buf, 0, sizeof( buf ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001962 ret = mbedtls_ssl_read( &ssl, buf, len );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001963
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001964 if( ret == MBEDTLS_ERR_NET_WANT_READ ||
1965 ret == MBEDTLS_ERR_NET_WANT_WRITE )
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001966 continue;
1967
1968 if( ret <= 0 )
1969 {
1970 switch( ret )
1971 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001972 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
1973 mbedtls_printf( " connection was closed gracefully\n" );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001974 goto close_notify;
1975
1976 case 0:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001977 case MBEDTLS_ERR_NET_CONN_RESET:
1978 mbedtls_printf( " connection was reset by peer\n" );
1979 ret = MBEDTLS_ERR_NET_CONN_RESET;
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001980 goto reset;
1981
1982 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001983 mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", -ret );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001984 goto reset;
1985 }
1986 }
1987
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001988 if( mbedtls_ssl_get_bytes_avail( &ssl ) == 0 )
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001989 {
1990 len = ret;
1991 buf[len] = '\0';
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001992 mbedtls_printf( " %d bytes read\n\n%s\n", len, (char *) buf );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02001993
1994 /* End of message should be detected according to the syntax of the
1995 * application protocol (eg HTTP), just use a dummy test here. */
1996 if( buf[len - 1] == '\n' )
1997 terminated = 1;
1998 }
1999 else
2000 {
2001 int extra_len, ori_len;
2002 unsigned char *larger_buf;
2003
2004 ori_len = ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002005 extra_len = mbedtls_ssl_get_bytes_avail( &ssl );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002006
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002007 larger_buf = mbedtls_malloc( ori_len + extra_len + 1 );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002008 if( larger_buf == NULL )
2009 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002010 mbedtls_printf( " ! memory allocation failed\n" );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002011 ret = 1;
2012 goto reset;
2013 }
2014
2015 memset( larger_buf, 0, ori_len + extra_len );
2016 memcpy( larger_buf, buf, ori_len );
2017
2018 /* This read should never fail and get the whole cached data */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002019 ret = mbedtls_ssl_read( &ssl, larger_buf + ori_len, extra_len );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002020 if( ret != extra_len ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002021 mbedtls_ssl_get_bytes_avail( &ssl ) != 0 )
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002022 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002023 mbedtls_printf( " ! mbedtls_ssl_read failed on cached data\n" );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002024 ret = 1;
2025 goto reset;
2026 }
2027
2028 larger_buf[ori_len + extra_len] = '\0';
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002029 mbedtls_printf( " %u bytes read (%u + %u)\n\n%s\n",
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002030 ori_len + extra_len, ori_len, extra_len,
2031 (char *) larger_buf );
2032
2033 /* End of message should be detected according to the syntax of the
2034 * application protocol (eg HTTP), just use a dummy test here. */
2035 if( larger_buf[ori_len + extra_len - 1] == '\n' )
2036 terminated = 1;
2037
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002038 mbedtls_free( larger_buf );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002039 }
2040
2041 if( terminated )
2042 {
2043 ret = 0;
2044 break;
2045 }
2046 }
2047 while( 1 );
2048 }
2049 else /* Not stream, so datagram */
2050 {
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002051 len = sizeof( buf ) - 1;
2052 memset( buf, 0, sizeof( buf ) );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002054 do ret = mbedtls_ssl_read( &ssl, buf, len );
2055 while( ret == MBEDTLS_ERR_NET_WANT_READ ||
2056 ret == MBEDTLS_ERR_NET_WANT_WRITE );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002057
2058 if( ret <= 0 )
2059 {
2060 switch( ret )
2061 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002062 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
2063 mbedtls_printf( " connection was closed gracefully\n" );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002064 ret = 0;
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02002065 goto close_notify;
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002066
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002067 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002068 mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", -ret );
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02002069 goto reset;
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002070 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002071 }
2072
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002073 len = ret;
2074 buf[len] = '\0';
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002075 mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf );
Manuel Pégourié-Gonnardcce220d2014-10-06 18:11:43 +02002076 ret = 0;
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002077 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002078
2079 /*
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02002080 * 7a. Request renegotiation while client is waiting for input from us.
Manuel Pégourié-Gonnarda6ace042014-10-15 12:44:41 +02002081 * (only on the first exchange, to be able to test retransmission)
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002082 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002083#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard3a173f42015-01-22 13:30:33 +00002084 if( opt.renegotiate && exchanges_left == opt.exchanges )
Manuel Pégourié-Gonnard296e3b12014-08-19 12:59:03 +02002085 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002086 mbedtls_printf( " . Requestion renegotiation..." );
Manuel Pégourié-Gonnard296e3b12014-08-19 12:59:03 +02002087 fflush( stdout );
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02002088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002089 while( ( ret = mbedtls_ssl_renegotiate( &ssl ) ) != 0 )
Manuel Pégourié-Gonnard296e3b12014-08-19 12:59:03 +02002090 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002091 if( ret != MBEDTLS_ERR_NET_WANT_READ &&
2092 ret != MBEDTLS_ERR_NET_WANT_WRITE )
Manuel Pégourié-Gonnard296e3b12014-08-19 12:59:03 +02002093 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002094 mbedtls_printf( " failed\n ! mbedtls_ssl_renegotiate returned %d\n\n", ret );
Manuel Pégourié-Gonnard296e3b12014-08-19 12:59:03 +02002095 goto reset;
2096 }
2097 }
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02002098
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002099 mbedtls_printf( " ok\n" );
Manuel Pégourié-Gonnard296e3b12014-08-19 12:59:03 +02002100 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002101#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard296e3b12014-08-19 12:59:03 +02002102
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02002103 /*
2104 * 7. Write the 200 Response
2105 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002106 mbedtls_printf( " > Write to client:" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002107 fflush( stdout );
2108
2109 len = sprintf( (char *) buf, HTTP_RESPONSE,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002110 mbedtls_ssl_get_ciphersuite( &ssl ) );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002112 if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002113 {
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002114 for( written = 0, frags = 0; written < len; written += ret, frags++ )
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002115 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002116 while( ( ret = mbedtls_ssl_write( &ssl, buf + written, len - written ) )
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002117 <= 0 )
Manuel Pégourié-Gonnardbd7ce632013-07-17 15:34:17 +02002118 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002119 if( ret == MBEDTLS_ERR_NET_CONN_RESET )
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002120 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002121 mbedtls_printf( " failed\n ! peer closed the connection\n\n" );
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002122 goto reset;
2123 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002124
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002125 if( ret != MBEDTLS_ERR_NET_WANT_READ &&
2126 ret != MBEDTLS_ERR_NET_WANT_WRITE )
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002127 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002128 mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret );
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002129 goto reset;
2130 }
Manuel Pégourié-Gonnardbd7ce632013-07-17 15:34:17 +02002131 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002132 }
2133 }
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002134 else /* Not stream, so datagram */
2135 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002136 do ret = mbedtls_ssl_write( &ssl, buf, len );
2137 while( ret == MBEDTLS_ERR_NET_WANT_READ ||
2138 ret == MBEDTLS_ERR_NET_WANT_WRITE );
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002139
2140 if( ret < 0 )
2141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002142 mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret );
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02002143 goto reset;
2144 }
2145
2146 frags = 1;
2147 written = ret;
2148 }
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002149
Manuel Pégourié-Gonnardbd7ce632013-07-17 15:34:17 +02002150 buf[written] = '\0';
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002151 mbedtls_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf );
Manuel Pégourié-Gonnarda92ed482015-01-14 10:46:08 +01002152 ret = 0;
Manuel Pégourié-Gonnardf3dc2f62013-10-29 18:17:41 +01002153
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02002154 /*
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02002155 * 7b. Continue doing data exchanges?
2156 */
Manuel Pégourié-Gonnard6a0017b2015-01-22 10:33:29 +00002157 if( --exchanges_left > 0 )
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02002158 goto data_exchange;
2159
2160 /*
2161 * 8. Done, cleanly close the connection
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02002162 */
2163close_notify:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002164 mbedtls_printf( " . Closing the connection..." );
Manuel Pégourié-Gonnard6b0d2682014-03-25 11:24:43 +01002165
Manuel Pégourié-Gonnard994f8b52014-10-09 19:56:44 +02002166 /* No error checking, the connection might be closed already */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002167 do ret = mbedtls_ssl_close_notify( &ssl );
2168 while( ret == MBEDTLS_ERR_NET_WANT_WRITE );
Manuel Pégourié-Gonnard994f8b52014-10-09 19:56:44 +02002169 ret = 0;
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02002170
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002171 mbedtls_printf( " done\n" );
Rich Evansf90016a2015-01-19 14:26:37 +00002172
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002173 goto reset;
2174
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02002175 /*
2176 * Cleanup and exit
2177 */
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002178exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002179#ifdef MBEDTLS_ERROR_C
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002180 if( ret != 0 )
2181 {
2182 char error_buf[100];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002183 mbedtls_strerror( ret, error_buf, 100 );
2184 mbedtls_printf("Last error was: -0x%X - %s\n\n", -ret, error_buf );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002185 }
2186#endif
2187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002188 mbedtls_printf( " . Cleaning up..." );
Manuel Pégourié-Gonnardf29e5de2014-11-21 11:54:41 +01002189 fflush( stdout );
2190
Paul Bakker0c226102014-04-17 16:02:36 +02002191 if( client_fd != -1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002192 mbedtls_net_close( client_fd );
Paul Bakker0c226102014-04-17 16:02:36 +02002193
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002194#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO)
2195 mbedtls_dhm_free( &dhm );
Paul Bakkera317a982014-06-18 16:44:11 +02002196#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002197#if defined(MBEDTLS_X509_CRT_PARSE_C)
2198 mbedtls_x509_crt_free( &cacert );
2199 mbedtls_x509_crt_free( &srvcert );
2200 mbedtls_pk_free( &pkey );
2201 mbedtls_x509_crt_free( &srvcert2 );
2202 mbedtls_pk_free( &pkey2 );
Paul Bakkered27a042013-04-18 22:46:23 +02002203#endif
Manuel Pégourié-Gonnard6c7af4c2015-04-03 16:41:52 +02002204#if defined(SNI_OPTION)
Manuel Pégourié-Gonnard5d917ff2014-02-21 16:52:06 +01002205 sni_free( sni_info );
2206#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002207#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard4505ed32014-06-19 20:56:52 +02002208 psk_free( psk_info );
2209#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002210#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO)
2211 mbedtls_dhm_free( &dhm );
Manuel Pégourié-Gonnard4505ed32014-06-19 20:56:52 +02002212#endif
Paul Bakkered27a042013-04-18 22:46:23 +02002213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002214 mbedtls_ssl_free( &ssl );
2215 mbedtls_ctr_drbg_free( &ctr_drbg );
2216 mbedtls_entropy_free( &entropy );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002217
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002218#if defined(MBEDTLS_SSL_CACHE_C)
2219 mbedtls_ssl_cache_free( &cache );
Paul Bakker0a597072012-09-25 21:55:46 +00002220#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002221#if defined(MBEDTLS_SSL_COOKIE_C)
2222 mbedtls_ssl_cookie_free( &cookie_ctx );
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02002223#endif
Paul Bakker0a597072012-09-25 21:55:46 +00002224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002225#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
2226#if defined(MBEDTLS_MEMORY_DEBUG)
2227 mbedtls_memory_buffer_alloc_status();
Paul Bakker82024bf2013-07-04 11:52:32 +02002228#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002229 mbedtls_memory_buffer_alloc_free();
Paul Bakker1337aff2013-09-29 14:45:34 +02002230#endif
Paul Bakker82024bf2013-07-04 11:52:32 +02002231
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002232 mbedtls_printf( " done.\n" );
Manuel Pégourié-Gonnardf29e5de2014-11-21 11:54:41 +01002233
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002234#if defined(_WIN32)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002235 mbedtls_printf( " + Press Enter to exit this program.\n" );
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002236 fflush( stdout ); getchar();
2237#endif
2238
Paul Bakkerdbd79ca2013-07-24 16:28:35 +02002239 // Shell can not handle large exit numbers -> 1 for errors
2240 if( ret < 0 )
2241 ret = 1;
2242
Paul Bakkerb60b95f2012-09-25 09:05:17 +00002243 return( ret );
2244}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002245#endif /* MBEDTLS_BIGNUM_C && MBEDTLS_ENTROPY_C && MBEDTLS_SSL_TLS_C &&
2246 MBEDTLS_SSL_SRV_C && MBEDTLS_NET_C && MBEDTLS_RSA_C &&
2247 MBEDTLS_CTR_DRBG_C */