1 /*
2 * SSL server demonstration program using fork() for handling multiple clients
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "mbedtls/build_info.h"
9
10 #include "mbedtls/platform.h"
11
12 #if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_ENTROPY_C) || \
13 !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_SRV_C) || \
14 !defined(MBEDTLS_NET_C) || !defined(MBEDTLS_RSA_C) || \
15 !defined(MBEDTLS_CTR_DRBG_C) || !defined(MBEDTLS_X509_CRT_PARSE_C) || \
16 !defined(MBEDTLS_TIMING_C) || !defined(MBEDTLS_FS_IO) || \
17 !defined(MBEDTLS_PEM_PARSE_C)
main(int argc,char * argv[])18 int main(int argc, char *argv[])
19 {
20 ((void) argc);
21 ((void) argv);
22
23 mbedtls_printf("MBEDTLS_BIGNUM_C and/or MBEDTLS_ENTROPY_C "
24 "and/or MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_SRV_C and/or "
25 "MBEDTLS_NET_C and/or MBEDTLS_RSA_C and/or "
26 "MBEDTLS_CTR_DRBG_C and/or MBEDTLS_X509_CRT_PARSE_C and/or "
27 "MBEDTLS_TIMING_C and/or MBEDTLS_PEM_PARSE_C not defined.\n");
28 mbedtls_exit(0);
29 }
30 #elif defined(_WIN32)
main(void)31 int main(void)
32 {
33 mbedtls_printf("_WIN32 defined. This application requires fork() and signals "
34 "to work correctly.\n");
35 mbedtls_exit(0);
36 }
37 #else
38
39 #include "mbedtls/entropy.h"
40 #include "mbedtls/ctr_drbg.h"
41 #include "test/certs.h"
42 #include "mbedtls/x509.h"
43 #include "mbedtls/ssl.h"
44 #include "mbedtls/net_sockets.h"
45 #include "mbedtls/timing.h"
46
47 #include <string.h>
48 #include <signal.h>
49
50 #if !defined(_MSC_VER) || defined(EFIX64) || defined(EFI32)
51 #include <unistd.h>
52 #endif
53
54 #define HTTP_RESPONSE \
55 "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \
56 "<h2>Mbed TLS Test Server</h2>\r\n" \
57 "<p>Successful connection using: %s</p>\r\n"
58
59 #define DEBUG_LEVEL 0
60
61
my_debug(void * ctx,int level,const char * file,int line,const char * str)62 static void my_debug(void *ctx, int level,
63 const char *file, int line,
64 const char *str)
65 {
66 ((void) level);
67
68 mbedtls_fprintf((FILE *) ctx, "%s:%04d: %s", file, line, str);
69 fflush((FILE *) ctx);
70 }
71
main(void)72 int main(void)
73 {
74 int ret = 1, len, cnt = 0, pid;
75 int exit_code = MBEDTLS_EXIT_FAILURE;
76 mbedtls_net_context listen_fd, client_fd;
77 unsigned char buf[1024];
78 const char *pers = "ssl_fork_server";
79
80 mbedtls_entropy_context entropy;
81 mbedtls_ctr_drbg_context ctr_drbg;
82 mbedtls_ssl_context ssl;
83 mbedtls_ssl_config conf;
84 mbedtls_x509_crt srvcert;
85 mbedtls_pk_context pkey;
86
87 mbedtls_net_init(&listen_fd);
88 mbedtls_net_init(&client_fd);
89 mbedtls_ssl_init(&ssl);
90 mbedtls_ssl_config_init(&conf);
91 mbedtls_entropy_init(&entropy);
92 mbedtls_pk_init(&pkey);
93 mbedtls_x509_crt_init(&srvcert);
94 mbedtls_ctr_drbg_init(&ctr_drbg);
95
96 #if defined(MBEDTLS_USE_PSA_CRYPTO)
97 psa_status_t status = psa_crypto_init();
98 if (status != PSA_SUCCESS) {
99 mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n",
100 (int) status);
101 goto exit;
102 }
103 #endif /* MBEDTLS_USE_PSA_CRYPTO */
104
105 signal(SIGCHLD, SIG_IGN);
106
107 /*
108 * 0. Initial seeding of the RNG
109 */
110 mbedtls_printf("\n . Initial seeding of the random generator...");
111 fflush(stdout);
112
113 if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
114 (const unsigned char *) pers,
115 strlen(pers))) != 0) {
116 mbedtls_printf(" failed! mbedtls_ctr_drbg_seed returned %d\n\n", ret);
117 goto exit;
118 }
119
120 mbedtls_printf(" ok\n");
121
122 /*
123 * 1. Load the certificates and private RSA key
124 */
125 mbedtls_printf(" . Loading the server cert. and key...");
126 fflush(stdout);
127
128 /*
129 * This demonstration program uses embedded test certificates.
130 * Instead, you may want to use mbedtls_x509_crt_parse_file() to read the
131 * server and CA certificates, as well as mbedtls_pk_parse_keyfile().
132 */
133 ret = mbedtls_x509_crt_parse(&srvcert, (const unsigned char *) mbedtls_test_srv_crt,
134 mbedtls_test_srv_crt_len);
135 if (ret != 0) {
136 mbedtls_printf(" failed! mbedtls_x509_crt_parse returned %d\n\n", ret);
137 goto exit;
138 }
139
140 ret = mbedtls_x509_crt_parse(&srvcert, (const unsigned char *) mbedtls_test_cas_pem,
141 mbedtls_test_cas_pem_len);
142 if (ret != 0) {
143 mbedtls_printf(" failed! mbedtls_x509_crt_parse returned %d\n\n", ret);
144 goto exit;
145 }
146
147 ret = mbedtls_pk_parse_key(&pkey, (const unsigned char *) mbedtls_test_srv_key,
148 mbedtls_test_srv_key_len, NULL, 0,
149 mbedtls_ctr_drbg_random, &ctr_drbg);
150 if (ret != 0) {
151 mbedtls_printf(" failed! mbedtls_pk_parse_key returned %d\n\n", ret);
152 goto exit;
153 }
154
155 mbedtls_printf(" ok\n");
156
157 /*
158 * 1b. Prepare SSL configuration
159 */
160 mbedtls_printf(" . Configuring SSL...");
161 fflush(stdout);
162
163 if ((ret = mbedtls_ssl_config_defaults(&conf,
164 MBEDTLS_SSL_IS_SERVER,
165 MBEDTLS_SSL_TRANSPORT_STREAM,
166 MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
167 mbedtls_printf(" failed! mbedtls_ssl_config_defaults returned %d\n\n", ret);
168 goto exit;
169 }
170
171 mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg);
172 mbedtls_ssl_conf_dbg(&conf, my_debug, stdout);
173
174 mbedtls_ssl_conf_ca_chain(&conf, srvcert.next, NULL);
175 if ((ret = mbedtls_ssl_conf_own_cert(&conf, &srvcert, &pkey)) != 0) {
176 mbedtls_printf(" failed! mbedtls_ssl_conf_own_cert returned %d\n\n", ret);
177 goto exit;
178 }
179
180 mbedtls_printf(" ok\n");
181
182 /*
183 * 2. Setup the listening TCP socket
184 */
185 mbedtls_printf(" . Bind on https://localhost:4433/ ...");
186 fflush(stdout);
187
188 if ((ret = mbedtls_net_bind(&listen_fd, NULL, "4433", MBEDTLS_NET_PROTO_TCP)) != 0) {
189 mbedtls_printf(" failed! mbedtls_net_bind returned %d\n\n", ret);
190 goto exit;
191 }
192
193 mbedtls_printf(" ok\n");
194
195 while (1) {
196 /*
197 * 3. Wait until a client connects
198 */
199 mbedtls_net_init(&client_fd);
200 mbedtls_ssl_init(&ssl);
201
202 mbedtls_printf(" . Waiting for a remote connection ...\n");
203 fflush(stdout);
204
205 if ((ret = mbedtls_net_accept(&listen_fd, &client_fd,
206 NULL, 0, NULL)) != 0) {
207 mbedtls_printf(" failed! mbedtls_net_accept returned %d\n\n", ret);
208 goto exit;
209 }
210
211 /*
212 * 3.5. Forking server thread
213 */
214
215 mbedtls_printf(" . Forking to handle connection ...");
216 fflush(stdout);
217
218 pid = fork();
219
220 if (pid < 0) {
221 mbedtls_printf(" failed! fork returned %d\n\n", pid);
222 goto exit;
223 }
224
225 if (pid != 0) {
226 mbedtls_printf(" ok\n");
227 mbedtls_net_close(&client_fd);
228
229 if ((ret = mbedtls_ctr_drbg_reseed(&ctr_drbg,
230 (const unsigned char *) "parent",
231 6)) != 0) {
232 mbedtls_printf(" failed! mbedtls_ctr_drbg_reseed returned %d\n\n", ret);
233 goto exit;
234 }
235
236 continue;
237 }
238
239 mbedtls_net_close(&listen_fd);
240
241 pid = getpid();
242
243 /*
244 * 4. Setup stuff
245 */
246 mbedtls_printf("pid %d: Setting up the SSL data.\n", pid);
247 fflush(stdout);
248
249 if ((ret = mbedtls_ctr_drbg_reseed(&ctr_drbg,
250 (const unsigned char *) "child",
251 5)) != 0) {
252 mbedtls_printf(
253 "pid %d: SSL setup failed! mbedtls_ctr_drbg_reseed returned %d\n\n",
254 pid, ret);
255 goto exit;
256 }
257
258 if ((ret = mbedtls_ssl_setup(&ssl, &conf)) != 0) {
259 mbedtls_printf(
260 "pid %d: SSL setup failed! mbedtls_ssl_setup returned %d\n\n",
261 pid, ret);
262 goto exit;
263 }
264
265 mbedtls_ssl_set_bio(&ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, NULL);
266
267 mbedtls_printf("pid %d: SSL setup ok\n", pid);
268
269 /*
270 * 5. Handshake
271 */
272 mbedtls_printf("pid %d: Performing the SSL/TLS handshake.\n", pid);
273 fflush(stdout);
274
275 while ((ret = mbedtls_ssl_handshake(&ssl)) != 0) {
276 if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
277 mbedtls_printf(
278 "pid %d: SSL handshake failed! mbedtls_ssl_handshake returned %d\n\n",
279 pid, ret);
280 goto exit;
281 }
282 }
283
284 mbedtls_printf("pid %d: SSL handshake ok\n", pid);
285
286 /*
287 * 6. Read the HTTP Request
288 */
289 mbedtls_printf("pid %d: Start reading from client.\n", pid);
290 fflush(stdout);
291
292 do {
293 len = sizeof(buf) - 1;
294 memset(buf, 0, sizeof(buf));
295 ret = mbedtls_ssl_read(&ssl, buf, len);
296
297 if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
298 continue;
299 }
300
301 if (ret <= 0) {
302 switch (ret) {
303 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
304 mbedtls_printf("pid %d: connection was closed gracefully\n", pid);
305 break;
306
307 case MBEDTLS_ERR_NET_CONN_RESET:
308 mbedtls_printf("pid %d: connection was reset by peer\n", pid);
309 break;
310
311 default:
312 mbedtls_printf("pid %d: mbedtls_ssl_read returned %d\n", pid, ret);
313 break;
314 }
315
316 break;
317 }
318
319 len = ret;
320 mbedtls_printf("pid %d: %d bytes read\n\n%s", pid, len, (char *) buf);
321
322 if (ret > 0) {
323 break;
324 }
325 } while (1);
326
327 /*
328 * 7. Write the 200 Response
329 */
330 mbedtls_printf("pid %d: Start writing to client.\n", pid);
331 fflush(stdout);
332
333 len = sprintf((char *) buf, HTTP_RESPONSE,
334 mbedtls_ssl_get_ciphersuite(&ssl));
335
336 while (cnt++ < 100) {
337 while ((ret = mbedtls_ssl_write(&ssl, buf, len)) <= 0) {
338 if (ret == MBEDTLS_ERR_NET_CONN_RESET) {
339 mbedtls_printf(
340 "pid %d: Write failed! peer closed the connection\n\n", pid);
341 goto exit;
342 }
343
344 if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
345 mbedtls_printf(
346 "pid %d: Write failed! mbedtls_ssl_write returned %d\n\n",
347 pid, ret);
348 goto exit;
349 }
350 }
351 len = ret;
352 mbedtls_printf("pid %d: %d bytes written\n\n%s\n", pid, len, (char *) buf);
353
354 mbedtls_net_usleep(1000000);
355 }
356
357 mbedtls_ssl_close_notify(&ssl);
358 goto exit;
359 }
360
361 exit_code = MBEDTLS_EXIT_SUCCESS;
362
363 exit:
364 mbedtls_net_free(&client_fd);
365 mbedtls_net_free(&listen_fd);
366 mbedtls_x509_crt_free(&srvcert);
367 mbedtls_pk_free(&pkey);
368 mbedtls_ssl_free(&ssl);
369 mbedtls_ssl_config_free(&conf);
370 mbedtls_ctr_drbg_free(&ctr_drbg);
371 mbedtls_entropy_free(&entropy);
372 #if defined(MBEDTLS_USE_PSA_CRYPTO)
373 mbedtls_psa_crypto_free();
374 #endif /* MBEDTLS_USE_PSA_CRYPTO */
375
376 mbedtls_exit(exit_code);
377 }
378 #endif /* MBEDTLS_BIGNUM_C && MBEDTLS_ENTROPY_C &&
379 MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_SRV_C && MBEDTLS_NET_C &&
380 MBEDTLS_RSA_C && MBEDTLS_CTR_DRBG_C && MBEDTLS_PEM_PARSE_C &&
381 ! _WIN32 */
382
