| /* |
| * Simple DTLS server demonstration program |
| * |
| * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
| * Copyright 2019 NXP |
| * SPDX-License-Identifier: Apache-2.0 |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| * not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| * |
| * This file is part of mbed TLS (https://tls.mbed.org) |
| */ |
| |
| #if !defined(MBEDTLS_CONFIG_FILE) |
| #include "mbedtls/config.h" |
| #else |
| #include MBEDTLS_CONFIG_FILE |
| #endif |
| |
| #if defined(MBEDTLS_PLATFORM_C) |
| #include "mbedtls/platform.h" |
| #else |
| #include <stdio.h> |
| #define mbedtls_printf printf |
| #define mbedtls_fprintf fprintf |
| #define mbedtls_time_t time_t |
| #endif |
| |
| #if !defined(MBEDTLS_SSL_SRV_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) || !defined(MBEDTLS_SSL_COOKIE_C) || \ |
| !defined(MBEDTLS_NET_C) || !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_CTR_DRBG_C) || \ |
| !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_CERTS_C) || \ |
| !defined(MBEDTLS_PEM_PARSE_C) || !defined(MBEDTLS_TIMING_C) |
| |
| int main(void) |
| { |
| printf( |
| "MBEDTLS_SSL_SRV_C and/or MBEDTLS_SSL_PROTO_DTLS and/or " |
| "MBEDTLS_SSL_COOKIE_C and/or MBEDTLS_NET_C and/or " |
| "MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C and/or " |
| "MBEDTLS_X509_CRT_PARSE_C and/or MBEDTLS_RSA_C and/or " |
| "MBEDTLS_CERTS_C and/or MBEDTLS_PEM_PARSE_C and/or " |
| "MBEDTLS_TIMING_C not defined.\n"); |
| return (0); |
| } |
| #else |
| |
| #if defined(_WIN32) |
| #include <windows.h> |
| #endif |
| |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| |
| #include "mbedtls/certs.h" |
| #include "mbedtls/ctr_drbg.h" |
| #include "mbedtls/debug.h" |
| #include "mbedtls/entropy.h" |
| #include "mbedtls/error.h" |
| #include "mbedtls/net_sockets.h" |
| #include "mbedtls/ssl.h" |
| #include "mbedtls/ssl_cookie.h" |
| #include "mbedtls/timing.h" |
| #include "mbedtls/x509.h" |
| |
| #if defined(MBEDTLS_SSL_CACHE_C) |
| #include "mbedtls/ssl_cache.h" |
| #endif |
| |
| #define READ_TIMEOUT_MS 10000 /* 5 seconds */ |
| |
| #define DFL_DEBUG_LEVEL 0 |
| #define DFL_CRT_FILE "" |
| #define DFL_KEY_FILE "" |
| #define DFL_CA_FILE "" |
| #define DFL_MIN_VERSION -1 |
| #define DFL_MAJ_VERSION -1 |
| |
| #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| #if defined(MBEDTLS_FS_IO) |
| #define USAGE_IO \ |
| " ca_file=%%s The single file containing the top-level CA(s) " \ |
| "you fully trust\n" \ |
| " default: \"\" (pre-loaded)\n" |
| #else |
| #define USAGE_IO " No file operations available (MBEDTLS_FS_IO not defined)\n" |
| #endif /* MBEDTLS_FS_IO */ |
| #else |
| #define USAGE_IO "" |
| #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
| |
| #define USAGE " debug_level=%%d default: 0 (disabled)\n" USAGE_IO |
| |
| /* |
| * global options |
| */ |
| struct options |
| { |
| int debug_level; /* level of debugging */ |
| const char *crt_file; /* the file with the server certificate */ |
| const char *key_file; /* the file with the server key */ |
| const char *ca_file; /* the file with the server key */ |
| int min_version; /* minimum protocol version accepted */ |
| int max_version; /* minimum protocol version accepted */ |
| } opt; |
| |
| static void my_debug(void *ctx, int level, const char *file, int line, const char *str) |
| { |
| ((void)level); |
| |
| mbedtls_fprintf((FILE *)ctx, "%s:%04d: %s", file, line, str); |
| fflush((FILE *)ctx); |
| } |
| |
| int main(int argc, char *argv[]) |
| { |
| int ret = 0, len, i; |
| mbedtls_net_context listen_fd, client_fd; |
| unsigned char buf[1024]; |
| const char *pers = "dtls_server"; |
| unsigned char client_ip[16] = {0}; |
| size_t cliip_len; |
| mbedtls_ssl_cookie_ctx cookie_ctx; |
| |
| mbedtls_entropy_context entropy; |
| mbedtls_ctr_drbg_context ctr_drbg; |
| mbedtls_ssl_context ssl; |
| mbedtls_ssl_config conf; |
| mbedtls_x509_crt srvcert; |
| mbedtls_x509_crt cacert; |
| mbedtls_pk_context pkey; |
| mbedtls_timing_delay_context timer; |
| #if defined(MBEDTLS_SSL_CACHE_C) |
| mbedtls_ssl_cache_context cache; |
| #endif |
| |
| char *p, *q; |
| |
| mbedtls_net_init(&listen_fd); |
| mbedtls_net_init(&client_fd); |
| mbedtls_ssl_init(&ssl); |
| mbedtls_ssl_config_init(&conf); |
| mbedtls_ssl_cookie_init(&cookie_ctx); |
| #if defined(MBEDTLS_SSL_CACHE_C) |
| mbedtls_ssl_cache_init(&cache); |
| #endif |
| mbedtls_x509_crt_init(&srvcert); |
| mbedtls_x509_crt_init(&cacert); |
| mbedtls_pk_init(&pkey); |
| mbedtls_entropy_init(&entropy); |
| mbedtls_ctr_drbg_init(&ctr_drbg); |
| |
| if (argc == 1) { |
| usage: |
| if (ret == 0) |
| ret = 1; |
| |
| mbedtls_printf(USAGE_IO); |
| |
| mbedtls_printf("\n"); |
| goto exit; |
| } |
| |
| opt.debug_level = DFL_DEBUG_LEVEL; |
| opt.crt_file = DFL_CRT_FILE; |
| opt.key_file = DFL_KEY_FILE; |
| opt.ca_file = DFL_CA_FILE; |
| opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| opt.max_version = MBEDTLS_SSL_MAJOR_VERSION_3; |
| |
| for (i = 1; i < argc; i++) { |
| p = argv[i]; |
| if ((q = strchr(p, '=')) == NULL) |
| goto usage; |
| *q++ = '\0'; |
| |
| if (strcmp(p, "debug_level") == 0) { |
| opt.debug_level = atoi(q); |
| if (opt.debug_level < 0 || opt.debug_level > 65535) |
| goto usage; |
| } |
| else if (strcmp(p, "crt_file") == 0) |
| opt.crt_file = q; |
| else if (strcmp(p, "key_file") == 0) |
| opt.key_file = q; |
| else if (strcmp(p, "ca_file") == 0) |
| opt.ca_file = q; |
| else |
| continue; |
| } |
| |
| #if defined(MBEDTLS_DEBUG_C) |
| mbedtls_debug_set_threshold(opt.debug_level); |
| #endif |
| |
| /* |
| * 1. Load the certificates and private RSA key |
| */ |
| printf("\n . Loading the server cert. and key..."); |
| fflush(stdout); |
| |
| /* |
| * This demonstration program uses embedded test certificates. |
| * Instead, you may want to use mbedtls_x509_crt_parse_file() to read the |
| * server and CA certificates, as well as mbedtls_pk_parse_keyfile(). |
| */ |
| |
| /*Server-Certificate load Start*/ |
| #if defined(MBEDTLS_FS_IO) |
| |
| if (strlen(opt.crt_file)) { |
| if (strcmp(opt.crt_file, "none") == 0) |
| ret = 0; |
| else { |
| ret = mbedtls_x509_crt_parse_file(&srvcert, opt.crt_file); |
| if (ret != 0) { |
| printf(" failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret); |
| goto exit; |
| } |
| } |
| } |
| else |
| #endif |
| #if defined(MBEDTLS_CERTS_C) |
| { |
| ret = mbedtls_x509_crt_parse(&srvcert, (const unsigned char *)mbedtls_test_srv_crt, mbedtls_test_srv_crt_len); |
| if (ret != 0) { |
| printf(" failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret); |
| goto exit; |
| } |
| } |
| #else |
| { |
| ret = 1; |
| mbedtls_printf("MBEDTLS_CERTS_C not defined."); |
| } |
| #endif |
| |
| /*Server-Certificate load end*/ |
| |
| /*Server-key load start*/ |
| #if defined(MBEDTLS_FS_IO) |
| |
| if (strlen(opt.key_file)) { |
| if (strcmp(opt.key_file, "none") == 0) |
| ret = 0; |
| else { |
| ret = mbedtls_pk_parse_keyfile(&pkey, opt.key_file, NULL); |
| if (ret != 0) { |
| printf(" failed\n ! mbedtls_pk_parse_key returned %d\n\n", ret); |
| goto exit; |
| } |
| } |
| } |
| else |
| #endif |
| #if defined(MBEDTLS_CERTS_C) |
| { |
| |
| ret = |
| mbedtls_pk_parse_key(&pkey, (const unsigned char *)mbedtls_test_srv_key, mbedtls_test_srv_key_len, NULL, 0); |
| if (ret != 0) { |
| printf(" failed\n ! mbedtls_pk_parse_key returned %d\n\n", ret); |
| goto exit; |
| } |
| } |
| #else |
| { |
| ret = 1; |
| mbedtls_printf("MBEDTLS_CERTS_C not defined."); |
| } |
| #endif |
| /*Server-key load end*/ |
| |
| /*Load CA Certificate*/ |
| #if defined(MBEDTLS_FS_IO) |
| |
| if (strlen(opt.ca_file)) { |
| if (strcmp(opt.ca_file, "none") == 0) |
| ret = 0; |
| else { |
| ret = mbedtls_x509_crt_parse_file(&cacert, opt.ca_file); |
| if (ret != 0) { |
| printf(" failed\n ! mbedtls_pk_parse_key returned %d\n\n", ret); |
| goto exit; |
| } |
| } |
| } |
| else |
| #endif |
| #if defined(MBEDTLS_CERTS_C) |
| { |
| ret = mbedtls_x509_crt_parse(&cacert, (const unsigned char *)mbedtls_test_cas[i], mbedtls_test_cas_len[i]); |
| |
| if (ret != 0) { |
| printf(" failed\n ! mbedtls_pk_parse_key returned %d\n\n", ret); |
| goto exit; |
| } |
| } |
| #else |
| { |
| ret = 1; |
| mbedtls_printf("MBEDTLS_CERTS_C not defined."); |
| } |
| #endif |
| /*End Load CA Certificate*/ |
| |
| printf(" ok\n"); |
| |
| /* |
| * 2. Setup the "listening" UDP socket |
| */ |
| printf(" . Bind on udp/*/4433 ..."); |
| fflush(stdout); |
| |
| if ((ret = mbedtls_net_bind(&listen_fd, "127.0.0.1", "4433", MBEDTLS_NET_PROTO_UDP)) != 0) { |
| printf(" failed\n ! mbedtls_net_bind returned %d\n\n", ret); |
| goto exit; |
| } |
| |
| printf(" ok\n"); |
| |
| /* |
| * 3. Seed the RNG |
| */ |
| printf(" . Seeding the random number generator..."); |
| fflush(stdout); |
| |
| if ((ret = mbedtls_ctr_drbg_seed( |
| &ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char *)pers, strlen(pers))) != 0) { |
| printf(" failed\n ! mbedtls_ctr_drbg_seed returned %d\n", ret); |
| goto exit; |
| } |
| |
| printf(" ok\n"); |
| |
| /* |
| * 4. Setup stuff |
| */ |
| printf(" . Setting up the DTLS data..."); |
| fflush(stdout); |
| |
| if ((ret = mbedtls_ssl_config_defaults( |
| &conf, MBEDTLS_SSL_IS_SERVER, MBEDTLS_SSL_TRANSPORT_DATAGRAM, MBEDTLS_SSL_PRESET_DEFAULT)) != 0) { |
| mbedtls_printf(" failed\n ! mbedtls_ssl_config_defaults returned %d\n\n", ret); |
| goto exit; |
| } |
| |
| mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg); |
| mbedtls_ssl_conf_dbg(&conf, my_debug, stdout); |
| |
| #if defined(MBEDTLS_SSL_CACHE_C) |
| mbedtls_ssl_conf_session_cache(&conf, &cache, mbedtls_ssl_cache_get, mbedtls_ssl_cache_set); |
| #endif |
| |
| mbedtls_ssl_conf_ca_chain(&conf, &cacert, NULL); |
| if ((ret = mbedtls_ssl_conf_own_cert(&conf, &srvcert, &pkey)) != 0) { |
| printf(" failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret); |
| goto exit; |
| } |
| |
| if (opt.min_version != DFL_MIN_VERSION) |
| mbedtls_ssl_conf_min_version(&conf, MBEDTLS_SSL_MAJOR_VERSION_3, opt.min_version); |
| |
| if (opt.max_version != DFL_MAJ_VERSION) |
| mbedtls_ssl_conf_max_version(&conf, MBEDTLS_SSL_MAJOR_VERSION_3, opt.max_version); |
| |
| if ((ret = mbedtls_ssl_cookie_setup(&cookie_ctx, mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) { |
| printf(" failed\n ! mbedtls_ssl_cookie_setup returned %d\n\n", ret); |
| goto exit; |
| } |
| |
| mbedtls_ssl_conf_dtls_cookies(&conf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, &cookie_ctx); |
| |
| if ((ret = mbedtls_ssl_setup(&ssl, &conf)) != 0) { |
| printf(" failed\n ! mbedtls_ssl_setup returned %d\n\n", ret); |
| goto exit; |
| } |
| |
| mbedtls_ssl_set_timer_cb(&ssl, &timer, mbedtls_timing_set_delay, mbedtls_timing_get_delay); |
| |
| printf(" ok\n"); |
| |
| reset: |
| #ifdef MBEDTLS_ERROR_C |
| if (ret != 0) { |
| char error_buf[100]; |
| mbedtls_strerror(ret, error_buf, 100); |
| printf("Last error was: %d - %s\n\n", ret, error_buf); |
| } |
| #endif |
| |
| mbedtls_net_free(&client_fd); |
| |
| mbedtls_ssl_session_reset(&ssl); |
| |
| /* |
| * 3. Wait until a client connects |
| */ |
| printf(" . Waiting for a remote connection ..."); |
| fflush(stdout); |
| |
| if ((ret = mbedtls_net_accept(&listen_fd, &client_fd, client_ip, sizeof(client_ip), &cliip_len)) != 0) { |
| printf(" failed\n ! mbedtls_net_accept returned %d\n\n", ret); |
| goto exit; |
| } |
| |
| /* For HelloVerifyRequest cookies */ |
| if ((ret = mbedtls_ssl_set_client_transport_id(&ssl, client_ip, cliip_len)) != 0) { |
| printf( |
| " failed\n ! " |
| "mbedtls_ssl_set_client_transport_id() returned -0x%x\n\n", |
| -ret); |
| goto exit; |
| } |
| |
| mbedtls_ssl_set_bio(&ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, mbedtls_net_recv_timeout); |
| |
| printf(" ok\n"); |
| |
| /* |
| * 5. Handshake |
| */ |
| printf(" . Performing the DTLS handshake..."); |
| fflush(stdout); |
| |
| do |
| ret = mbedtls_ssl_handshake(&ssl); |
| while (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE); |
| |
| if (ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED) { |
| printf(" hello verification requested\n"); |
| ret = 0; |
| goto reset; |
| } |
| else if (ret != 0) { |
| printf(" failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret); |
| goto reset; |
| } |
| |
| printf(" ok\n"); |
| |
| /* |
| * 6. Read the echo Request |
| */ |
| printf(" < Read from client:"); |
| fflush(stdout); |
| |
| len = sizeof(buf) - 1; |
| memset(buf, 0, sizeof(buf)); |
| |
| do |
| ret = mbedtls_ssl_read(&ssl, buf, len); |
| while (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE); |
| |
| if (ret <= 0) { |
| switch (ret) { |
| case MBEDTLS_ERR_SSL_TIMEOUT: |
| printf(" timeout\n\n"); |
| goto reset; |
| |
| case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: |
| printf(" connection was closed gracefully\n"); |
| ret = 0; |
| goto close_notify; |
| |
| default: |
| printf(" mbedtls_ssl_read returned -0x%x\n\n", -ret); |
| goto reset; |
| } |
| } |
| |
| len = ret; |
| printf(" %d bytes read\n\n%s\n\n", len, buf); |
| |
| /* |
| * 7. Write the 200 Response |
| */ |
| printf(" > Write to client:"); |
| fflush(stdout); |
| |
| do |
| ret = mbedtls_ssl_write(&ssl, buf, len); |
| while (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE); |
| |
| if (ret < 0) { |
| printf(" failed\n ! mbedtls_ssl_write returned %d\n\n", ret); |
| goto exit; |
| } |
| |
| len = ret; |
| printf(" %d bytes written\n\n%s\n\n", len, buf); |
| |
| /* |
| * 8. Done, cleanly close the connection |
| */ |
| close_notify: |
| printf(" . Closing the connection..."); |
| |
| /* No error checking, the connection might be closed already */ |
| do |
| ret = mbedtls_ssl_close_notify(&ssl); |
| while (ret == MBEDTLS_ERR_SSL_WANT_WRITE); |
| ret = 0; |
| |
| printf(" done\n"); |
| #ifdef _WIN32 |
| { |
| Sleep(1000); |
| } |
| #endif |
| goto reset; |
| |
| /* |
| * Final clean-ups and exit |
| */ |
| exit: |
| |
| #ifdef MBEDTLS_ERROR_C |
| if (ret != 0) { |
| char error_buf[100]; |
| mbedtls_strerror(ret, error_buf, 100); |
| printf("Last error was: %d - %s\n\n", ret, error_buf); |
| } |
| #endif |
| |
| mbedtls_net_free(&client_fd); |
| mbedtls_net_free(&listen_fd); |
| |
| mbedtls_x509_crt_free(&srvcert); |
| mbedtls_pk_free(&pkey); |
| mbedtls_ssl_free(&ssl); |
| mbedtls_ssl_config_free(&conf); |
| mbedtls_ssl_cookie_free(&cookie_ctx); |
| #if defined(MBEDTLS_SSL_CACHE_C) |
| mbedtls_ssl_cache_free(&cache); |
| #endif |
| mbedtls_ctr_drbg_free(&ctr_drbg); |
| mbedtls_entropy_free(&entropy); |
| |
| #if defined(_WIN32) |
| printf(" Press Enter to exit this program.\n"); |
| fflush(stdout); |
| getchar(); |
| #endif |
| |
| /* Shell can not handle large exit numbers -> 1 for errors */ |
| if (ret < 0) { |
| ret = 1; |
| printf("Failed"); |
| } |
| else { |
| printf("Passed"); |
| } |
| |
| return (ret); |
| } |
| #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_DTLS && |
| MBEDTLS_SSL_COOKIE_C && MBEDTLS_NET_C && MBEDTLS_ENTROPY_C && |
| MBEDTLS_CTR_DRBG_C && MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_RSA_C |
| && MBEDTLS_CERTS_C && MBEDTLS_PEM_PARSE_C && MBEDTLS_TIMING_C */ |