基于BearSSL实现自签名证书双向认证测试代码

清疚 2022-12-07 04:28 146阅读 0赞

客户端、服务器端双向认证大致过程：可以参考：https://blog.csdn.net/fengbingchun/article/details/106856332

(1). 客户端发起连接请求；

(2). 服务器端返回消息，包含服务器端证书server.crt；

(3). 客户端验证服务器端证书server.crt的合法性；

(4). 客户端向服务器端发送客户端证书client.crt；

(5). 服务器端验证客户端证书client.crt，并将选定的加密方案发给客户端；

(6). 客户端发送随机生成的对称公钥给服务器端；

(7). 服务器端获取客户端发送的对称公钥；

接下来双方即可进行数据传输。

  1.     **使用OpenSSL****生成自签名证书**：可以参考：[https://blog.csdn.net/fengbingchun/article/details/107386847][https_blog.csdn.net_fengbingchun_article_details_107386847]
  3.     1. 生成自签名服务器端证书：

(1). 产生长度为3072的rsa私钥server.key;

(2). 创建服务器端证书签名请求(Certificate Signing Request)文件server.csr: CN填写本地测试机的IP，或域名，这里填写的IP或域名需要与代码中保持一致，填写域名可能需要修改本地/etc/hosts文件;

(3). 创建服务器端证书server.crt;

执行命令如下：

  1. LD_LIBRARY_PATH=../lib ./openssl genrsa -out server.key 3072
  2. LD_LIBRARY_PATH=../lib ./openssl req -new -out server.csr -key server.key -subj  "/C=cn/ST=beijing/L=haidian/O=FBC/OU=test/CN=10.4.96.33/emailAddress=fengbingchun@163.com"
  3. LD_LIBRARY_PATH=../lib ./openssl x509 -req -in server.csr -out server.crt -signkey server.key -days 3650
  1. 生成自签名客户端证书：

(1). 产生长度为3072的rsa私钥client.key;

(2). 创建客户端端证书签名请求client.csr;

(3). 创建客户端证书client.crt;

执行命令如下：

  1. LD_LIBRARY_PATH=../lib ./openssl genrsa -out client.key 3072
  2. LD_LIBRARY_PATH=../lib ./openssl req -new -out client.csr -key client.key -subj "/C=cn/ST=beijing/L=haidian/O=Spring/OU=server_test/CN=XXXX/emailAddress=Spring@client_test.com"
  3. LD_LIBRARY_PATH=../lib ./openssl x509 -req -in client.csr -out client.crt -signkey client.key -days 3650

通过bearssl**的工具brssl将相关证书文件生成bearssl支持的C**代码：

(1). 将服务端证书server.crt生成trust anchors，将其存放在trust_anchors.inc文件中；

(2). 将服务器端证书server.crt生成server chain，将其存放在chain.inc文件中；

(3). 将服务器端私钥server.key生成server rsa，将其存放在key.inc文件中；

(4). 将客户端证书client.crt生成trust anchors，将其存放在trust_anchors.inc文件中；

(5). 将客户端证书client.crt生成client chain，将其存放在chain.inc文件中；

(6). 将客户端私钥client.key生成client rsa，将其存放在key.inc文件中；

执行命令如下：

  1. ./brssl ta server.crt
  2. ./brssl chain server.crt
  3. ./brssl skey -C server.key
  4. ./brssl ta client.crt
  5. ./brssl chain client.crt
  6. ./brssl skey -C client.key

测试代码段如下：

  1. namespace {
  3. // reference: bearssl/samples: client_basic.c/server_basic.c
  4. // 客户端连接服务器：host为服务器端ipv4或域名，port为端口号
  5. SOCKET client_connect(const char *host, const char *port)
  6. {
  7.     struct addrinfo hints, *si;
  8.     memset(&hints, 0, sizeof hints);
  9.     hints.ai_family = AF_INET;
  10.     hints.ai_socktype = SOCK_STREAM;
  11.     // getaddrinfo: 获取主机信息，既支持ipv4也支持ipv6
  12.     auto err = getaddrinfo(host, port, &hints, &si);
  13.     if (err != 0) {
  14.         fprintf(stderr, "fail to getaddrinfo: %s\n", gai_strerror(err));
  15.         return INVALID_SOCKET;
  16.     }
  18.     SOCKET fd = INVALID_SOCKET;
  19.     struct addrinfo* p = nullptr;
  20.     for (p = si; p != nullptr; p = p->ai_next) {
  21.         struct sockaddr* sa = (struct sockaddr *)p->ai_addr;
  22.         if (sa->sa_family != AF_INET) // 仅处理AF_INET
  23.             continue;
  25.         struct in_addr addr;
  26.         addr.s_addr = ((struct sockaddr_in *)(p->ai_addr))->sin_addr.s_addr;
  27.         // inet_ntoa: 将二进制类型的IP地址转换为字符串类型
  28.         fprintf(stdout, "server ip: %s, family: %d, socktype: %d, protocol: %d\n",
  29.             inet_ntoa(addr), p->ai_family, p->ai_socktype, p->ai_protocol);
  31.         // 创建流式套接字
  32.         fd = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
  33.         if (fd < 0 || fd == INVALID_SOCKET) {
  34.             auto err_code = get_error_code();
  35.             std::error_code ec(err_code, std::system_category());
  36.             fprintf(stderr, "fail to socket: %d, error code: %d, message: %s\n", fd, err_code, ec.message().c_str());
  37.             continue;
  38.         }
  40.         // 连接，connect函数的第二参数是一个指向数据结构sockaddr的指针，其中包括客户端需要连接的服务器的目的端口和IP地址，以及协议类型
  41. #ifdef __linux__
  42.         auto ret = connect(fd, p->ai_addr, p->ai_addrlen); // 在windows上直接调用此语句会返回-1，还未查到原因?
  43. #else
  44.         struct sockaddr_in server_addr;
  45.         memset(&server_addr, 0, sizeof(server_addr));
  46.         server_addr.sin_family = AF_INET;
  47.         server_addr.sin_port = htons(server_port_);
  48.         auto ret = inet_pton(AF_INET, server_ip_, &server_addr.sin_addr);
  49.         if (ret != 1) {
  50.             fprintf(stderr, "fail to inet_pton: %d\n", ret);
  51.             return -1;
  52.         }
  53.         ret = connect(fd, (struct sockaddr*)&server_addr, sizeof(server_addr));
  54. #endif
  55.         if ( ret < 0) {
  56.             auto err_code = get_error_code();
  57.             std::error_code ec(err_code, std::system_category());
  58.             fprintf(stderr, "fail to connect: %d, error code: %d, message: %s\n", ret, err_code, ec.message().c_str());
  59.             close(fd);
  60.             continue;
  61.         }
  63.         break;
  64.     }
  66.     if (p == nullptr) {
  67.         freeaddrinfo(si);
  68.         fprintf(stderr, "fail to socket or connect\n");
  69.         return INVALID_SOCKET;
  70.     }
  72.     freeaddrinfo(si);
  73.     return fd;
  74. }
  76. // 接收数据
  77. int sock_read(void *ctx, unsigned char *buf, size_t len)
  78. {
  79.     for (;;) {
  80. #ifdef _MSC_VER
  81.         auto rlen = recv(*(int*)ctx, (char*)buf, len, 0);
  82. #else
  83.         auto rlen = recv(*(int*)ctx, (char*)buf, len, 0);
  84. #endif
  85.         //fprintf(stderr, "recv length: %d\n", rlen);
  86.         if (rlen <= 0) {
  87.             if (rlen < 0 && errno == EINTR) {
  88.                 continue;
  89.             }
  91.             auto err_code = get_error_code();
  92.             std::error_code ec(err_code, std::system_category());
  93.             fprintf(stderr, "fail to recv: %d, err code: %d, message: %s\n", rlen, err_code, ec.message().c_str());
  94.             return -1;
  95.         }
  96.         return (int)rlen;
  97.     }
  98. }
  100. // 发送数据
  101. int sock_write(void *ctx, const unsigned char *buf, size_t len)
  102. {
  103.     for (;;) {
  104. #ifdef _MSC_VER
  105.         auto wlen = send(*(int *)ctx, (const char*)buf, len, 0);
  106. #else
  107.         // MSG_NOSIGNAL: 禁止send函数向系统发送异常消息
  108.         auto wlen = send(*(int *)ctx, buf, len, MSG_NOSIGNAL);
  109. #endif
  110.         //fprintf(stderr, "send length: %d\n", wlen);
  111.         if (wlen <= 0) {
  112.             if (wlen < 0 && errno == EINTR) {
  113.                 continue;
  114.             }
  116.             auto err_code = get_error_code();
  117.             std::error_code ec(err_code, std::system_category());
  118.             fprintf(stderr, "fail to send: %d, err code: %d, message: %s\n", wlen, err_code, ec.message().c_str());
  119.             return -1;
  120.         }
  121.         return (int)wlen;
  122.     }
  123. }
  125. // 服务器端绑定、监听
  126. SOCKET server_bind_listen(const char *host, const char *port)
  127. {
  128.     struct addrinfo hints, *si;
  129.     memset(&hints, 0, sizeof hints);
  130.     hints.ai_family = AF_INET;
  131.     hints.ai_socktype = SOCK_STREAM;
  132.     auto ret = getaddrinfo(host, port, &hints, &si);
  133.     if (ret != 0) {
  134.         fprintf(stderr, "fail to getaddrinfo: %s\n", gai_strerror(ret));
  135.         return INVALID_SOCKET;
  136.     }
  138.     SOCKET fd = INVALID_SOCKET;
  139.     struct addrinfo* p = nullptr;
  140.     for (p = si; p != nullptr; p = p->ai_next) {
  141.         struct sockaddr *sa = (struct sockaddr *)p->ai_addr;
  142.         if (sa->sa_family != AF_INET) // 仅处理AF_INET
  143.             continue;
  145.         struct in_addr addr;
  146.         addr.s_addr = ((struct sockaddr_in *)(p->ai_addr))->sin_addr.s_addr;
  147.         // inet_ntoa: 将二进制类型的IP地址转换为字符串类型
  148.         fprintf(stdout, "server ip: %s, family: %d, socktype: %d, protocol: %d\n",
  149.             inet_ntoa(addr), p->ai_family, p->ai_socktype, p->ai_protocol);
  151.         // 创建流式套接字
  152.         fd = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
  153.         if (fd < 0 || fd == INVALID_SOCKET) {
  154.             auto err_code = get_error_code();
  155.             std::error_code ec(err_code, std::system_category());
  156.             fprintf(stderr, "fail to socket: %d, error code: %d, message: %s\n", fd, err_code, ec.message().c_str());
  157.             continue;
  158.         }
  160.         int opt = 1;
  161. #ifdef _MSC_VER
  162.         ret = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char*)&opt, sizeof opt);
  163. #else
  164.         ret = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof opt);
  165. #endif
  166.         if (ret < 0) {
  167.             fprintf(stderr, "fail to setsockopt: send\n");
  168.             return INVALID_SOCKET;
  169.         }
  171.         // 绑定地址端口
  172.         ret = bind(fd, sa, sizeof(*sa));
  173.         if (ret < 0) {
  174.             auto err_code = get_error_code();
  175.             std::error_code ec(err_code, std::system_category());
  176.             fprintf(stderr, "fail to bind: %d, error code: %d, message: %s\n", ret, err_code, ec.message().c_str());
  177.             close(fd);
  178.             continue;
  179.         }
  181.         break;
  182.     }
  184.     if (p == nullptr) {
  185.         freeaddrinfo(si);
  186.         fprintf(stderr, "fail to socket or bind\n");
  187.         return INVALID_SOCKET;
  188.     }
  190.     freeaddrinfo(si);
  192.     ret = listen(fd, server_listen_queue_length_);
  193.     if (ret < 0) {
  194.         auto err_code = get_error_code();
  195.         std::error_code ec(err_code, std::system_category());
  196.         fprintf(stderr, "fail to listen: %d, error code: %d, message: %s\n", ret, err_code, ec.message().c_str());
  197.         close(fd);
  198.         return INVALID_SOCKET;
  199.     }
  201.     return fd;
  202. }
  204. // 服务器端接收客户端的连接
  205. SOCKET server_accept(SOCKET server_fd)
  206. {
  207.     struct sockaddr_in sa;
  208.     socklen_t sa_len = sizeof sa;
  209.     auto fd = accept(server_fd, (struct sockaddr*)&sa, &sa_len);
  210.     if (fd < 0) {
  211.         auto err_code = get_error_code();
  212.         std::error_code ec(err_code, std::system_category());
  213.         fprintf(stderr, "fail to accept: %d, error code: %d, message: %s\n", fd, err_code, ec.message().c_str());
  214.         return -1;
  215.     }
  217.     if (sa.sin_family != AF_INET) {
  218.         fprintf(stderr, "fail: sa_family should be equal AF_INET: %d\n", sa.sin_family);
  219.         return -1;
  220.     }
  222.     struct in_addr addr;
  223.     addr.s_addr = sa.sin_addr.s_addr;
  224.     // inet_ntoa: 将二进制类型的IP地址转换为字符串类型
  225.     fprintf(stdout, "client ip: %s\n", inet_ntoa(addr));
  226.     return fd;
  227. }
  229. // Check whether we closed properly or not
  230. void check_ssl_error(const br_ssl_client_context& sc)
  231. {
  232.     if (br_ssl_engine_current_state(&sc.eng) == BR_SSL_CLOSED) {
  233.         auto ret = br_ssl_engine_last_error(&sc.eng);
  234.         if (ret == 0) {
  235.             fprintf(stdout, "closed properly\n");
  236.         } else {
  237.             fprintf(stderr, "SSL error %d\n", ret);
  238.         }
  239.     } else {
  240.         fprintf(stderr, "socket closed without proper SSL termination\n");
  241.     }
  242. }
  244. void check_ssl_error(const br_ssl_server_context& ss)
  245. {
  246.     if (br_ssl_engine_current_state(&ss.eng) == BR_SSL_CLOSED) {
  247.         auto ret = br_ssl_engine_last_error(&ss.eng);
  248.         if (ret == 0) {
  249.             fprintf(stdout, "closed properly\n");
  250.         } else {
  251.             fprintf(stderr, "SSL error %d\n", ret);
  252.         }
  253.     } else {
  254.         fprintf(stderr, "socket closed without proper SSL termination\n");
  255.     }
  256. }
  258. // reference: bearssl/samples/custom_profile.c
  259. void set_ssl_engine_suites(br_ssl_client_context sc)
  260. {
  261.     static const uint16_t suites[] = {
  262.         BR_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
  263.         BR_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
  264.         BR_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
  265.         BR_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
  266.         BR_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
  267.         BR_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
  268.         BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
  269.         BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
  270.         BR_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
  271.         BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
  272.         BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
  273.         BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
  274.         BR_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
  275.         BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
  276.         BR_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
  277.         BR_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
  278.         BR_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
  279.         BR_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
  280.         BR_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
  281.         BR_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
  282.         BR_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
  283.         BR_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
  284.         BR_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
  285.         BR_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
  286.         BR_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
  287.         BR_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
  288.         BR_TLS_RSA_WITH_AES_128_GCM_SHA256,
  289.         BR_TLS_RSA_WITH_AES_256_GCM_SHA384,
  290.         BR_TLS_RSA_WITH_AES_128_CBC_SHA256,
  291.         BR_TLS_RSA_WITH_AES_256_CBC_SHA256,
  292.         BR_TLS_RSA_WITH_AES_128_CBC_SHA,
  293.         BR_TLS_RSA_WITH_AES_256_CBC_SHA,
  294.         BR_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
  295.         BR_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
  296.         BR_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
  297.         BR_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
  298.         BR_TLS_RSA_WITH_3DES_EDE_CBC_SHA
  299.     };
  301.     br_ssl_engine_set_suites(&sc.eng, suites, (sizeof suites) / (sizeof suites[0]));
  302. }
  304. } // namespace
  306. int test_bearssl_self_signed_certificate_client()
  307. {
  308. #ifdef _MSC_VER
  309.     init_server_trust_anchors();
  310. #endif
  312.     const char* host = server_ip_;
  313.     const char* port = std::to_string(server_port_).c_str();
  315.     // Open the socket to the target server
  316.     SOCKET fd = client_connect(host, port);
  317.     if (fd < 0 || fd == INVALID_SOCKET) {
  318.         fprintf(stderr, "fail to client connect: %d\n", fd);
  319.         return -1;
  320.     }
  322.     // Initialise the client context
  323.     br_ssl_client_context sc;
  324.     br_x509_minimal_context xc;
  325.     br_ssl_client_init_full(&sc, &xc, SERVER_TAs, SERVER_TAs_NUM);
  327.     set_ssl_engine_suites(sc);
  329.     // 以下单条语句用于双向认证中
  330.     br_ssl_client_set_single_rsa(&sc, CLIENT_CHAIN, CLIENT_CHAIN_LEN, &CLIENT_RSA, br_rsa_pkcs1_sign_get_default());
  332.     // Set the I/O buffer to the provided array
  333.     unsigned char iobuf[BR_SSL_BUFSIZE_BIDI];
  334.     br_ssl_engine_set_buffer(&sc.eng, iobuf, sizeof iobuf, 1);
  336.     // Reset the client context, for a new handshake
  337.     // 若设置br_ssl_client_reset函数的第二个参数为nullptr，则客户端无需验证服务器端的ip或域名,
  338.     // 若第二个参数不为nullptr，则这里的host与使用命令生成server.csr时的CN要保持一致
  339.     auto ret = br_ssl_client_reset(&sc, host/*nullptr*/, 0);
  340.     if ( ret == 0) {
  341.         check_ssl_error(sc);
  342.         fprintf(stderr, "fail to br_ssl_client_reset: %d\n", ret);
  343.         return -1;
  344.     }
  346.     // Initialise the simplified I/O wrapper context
  347.     br_sslio_context ioc;
  348.     br_sslio_init(&ioc, &sc.eng, sock_read, &fd, sock_write, &fd);
  350.     // Write application data unto a SSL connection
  351.     const char* source_buffer = "https://blog.csdn.net/fengbingchun";
  352.     auto length = strlen(source_buffer) + 1; // 以空字符作为发送结束的标志
  353.     ret = br_sslio_write_all(&ioc, source_buffer, length);
  354.     if (ret < 0) {
  355.         check_ssl_error(sc);
  356.         fprintf(stderr, "fail to br_sslio_write_all: %d\n", ret);
  357.         return -1;
  358.     }
  360.     // SSL is a buffered protocol: we make sure that all our request bytes are sent onto the wire
  361.     ret = br_sslio_flush(&ioc);
  362.     if (ret < 0) {
  363.         check_ssl_error(sc);
  364.         fprintf(stderr, "fail to br_sslio_flush: %d\n", ret);
  365.         return -1;
  366.     }
  368.     // Read the server's response
  369.     std::vector<char> vec;
  370.     for (;;) {
  371.         unsigned char tmp[512];
  372.         ret = br_sslio_read(&ioc, tmp, sizeof tmp);
  373.         if (ret < 0) {
  374.             check_ssl_error(sc);
  375.             fprintf(stderr, "fail to br_sslio_read: %d\n", ret);
  376.             return -1;
  377.         }
  379.         bool flag = false;
  380.         std::for_each(tmp, tmp + ret, [&flag, &vec](const char& c) {
  381.             if (c == '\0') flag = true; // 以空字符作为接收结束的标志
  382.             else vec.emplace_back(c);
  383.         });
  385.         if (flag == true) break;
  386.     }
  388.     fprintf(stdout, "server's response: ");
  389.     std::for_each(vec.data(), vec.data() + vec.size(), [](const char& c){
  390.         fprintf(stdout, "%c", c);
  391.     });
  392.     fprintf(stdout, "\n");
  394.     // Close the SSL connection
  395.     if (fd >= 0) {
  396.         ret = br_sslio_close(&ioc);
  397.         if (ret < 0) {
  398.             check_ssl_error(sc);
  399.             fprintf(stderr, "fail to br_sslio_close: %d\n", ret);
  400.             return -1;
  401.         }
  402.     }
  404.     // Close the socket
  405.     close(fd);
  407.     return 0;
  408. }
  410. int test_bearssl_self_signed_certificate_server()
  411. {
  412. #ifdef _MSC_VER
  413.     init_client_trust_anchors();
  414. #endif
  416.     // Open the server socket
  417.     SOCKET fd = server_bind_listen(server_ip_, std::to_string(server_port_).c_str());
  418.     if (fd < 0 || fd == INVALID_SOCKET) {
  419.         fprintf(stderr, "fail to server_bind_listen: %d\n", fd);
  420.         return -1;
  421.     }
  423.     // Process each client, one at a time
  424.     for (;;) {
  425.         SOCKET fd2 = server_accept(fd);
  426.         if (fd2 < 0 || fd2 == INVALID_SOCKET) {
  427.             fprintf(stderr, "fail to server_accept: %d\n", fd2);
  428.             return -1;
  429.         }
  431.         // Initialise the context with the cipher suites and algorithms
  432.         // SSL server profile: full_rsa
  433.         br_ssl_server_context sc;
  434.         br_ssl_server_init_full_rsa(&sc, SERVER_CHAIN, SERVER_CHAIN_LEN, &SERVER_RSA);
  436.         // 以下8条语句用于双向认证中
  437.         br_x509_minimal_context xc;
  438.         br_x509_minimal_init(&xc, &br_sha1_vtable, CLIENT_TAs, CLIENT_TAs_NUM);
  439.         br_ssl_engine_set_default_rsavrfy(&sc.eng);
  440.         br_ssl_engine_set_default_ecdsa(&sc.eng);
  441.         br_x509_minimal_set_rsa(&xc, br_rsa_pkcs1_vrfy_get_default());
  442.         br_x509_minimal_set_ecdsa(&xc, br_ec_get_default(), br_ecdsa_vrfy_asn1_get_default());
  443.         br_ssl_engine_set_x509(&sc.eng, &xc.vtable);
  444.         br_ssl_server_set_trust_anchor_names_alt(&sc, CLIENT_TAs, CLIENT_TAs_NUM);
  446.         // Set the I/O buffer to the provided array
  447.         unsigned char iobuf[BR_SSL_BUFSIZE_BIDI];
  448.         br_ssl_engine_set_buffer(&sc.eng, iobuf, sizeof iobuf, 1);
  450.         // Reset the server context, for a new handshake
  451.         auto ret = br_ssl_server_reset(&sc);
  452.         if (ret == 0) {
  453.             check_ssl_error(sc);
  454.             fprintf(stderr, "fail to br_ssl_server_reset: %d\n", ret);
  455.             return -1;
  456.         }
  458.         // Initialise the simplified I/O wrapper context
  459.         br_sslio_context ioc;
  460.         br_sslio_init(&ioc, &sc.eng, sock_read, &fd2, sock_write, &fd2);
  462.         std::vector<char> vec;
  463.         for (;;) {
  464.             unsigned char tmp[512];
  465.             ret = br_sslio_read(&ioc, tmp, sizeof tmp);
  466.             if (ret < 0) {
  467.                 check_ssl_error(sc);
  468.                 fprintf(stderr, "fail to br_sslio_read: %d\n", ret);
  469.                 return -1;
  470.             }
  472.             bool flag = false;
  473.             std::for_each(tmp, tmp + ret, [&flag, &vec](const char& c) {
  474.                 if (c == '\0') flag = true; // 以空字符作为接收结束的标志
  475.                 else vec.emplace_back(c);
  476.             });
  478.             if (flag == true) break;
  479.         }
  481.         fprintf(stdout, "message from the client: ");
  482.         std::for_each(vec.data(), vec.data() + vec.size(), [](const char& c){
  483.             fprintf(stdout, "%c", c);
  484.         });
  485.         fprintf(stdout, "\n");
  487.         // Write a response and close the connection
  488.         auto str = std::to_string(vec.size());
  489.         std::vector<char> vec2(str.size() + 1);
  490.         memcpy(vec2.data(), str.data(), str.size());
  491.         vec2[str.size()] = '\0'; // 以空字符作为发送结束的标志
  492.         ret = br_sslio_write_all(&ioc, vec2.data(), vec2.size());
  493.         if (ret < 0) {
  494.             check_ssl_error(sc);
  495.             fprintf(stderr, "fail to br_sslio_write_all: %d\n", ret);
  496.             return -1;
  497.         }
  498.         ret = br_sslio_close(&ioc);
  499.         if (ret < 0) {
  500.             check_ssl_error(sc);
  501.             fprintf(stderr, "fail to br_sslio_close: %d\n", ret);
  502.             return -1;
  503.         }
  505.         close(fd2);
  506.     }
  508.     return 0;
  509. }

执行结果如下：服务器端为linux，客户端为windows,客户端发送”https://blog.csdn.net/fengbingchun“,并以空格作为结束标志，服务器端接收后计算字符串的长度，然后将长度返回给客户端，客户端将从服务器端收到的信息print。以上代码中注释掉br_ssl_client_set_single_rsa和br_ssl_server_set_trust_anchor_names_alt等函数即可实现单向认证。

20200915101351677.png

以上测试的完整代码见：GitHub OpenSSL_Test/funset_bearssl.cpp

GitHub：https://github.com/fengbingchun/OpenSSL_Test

发表评论

表情：
评论列表 （有 0 条评论，146人围观）

还没有评论，来说两句吧...

相关阅读