openssl双向验证
2016-03-31 15:46
204 查看
接上文生成证书之后,双向验证c/s ssl通信
源代码来源openssl
服务端源代码:serv.cpp
客户端源代码:cli.cpp
g++ serv.cpp -lssl -lcrypto -o serv
.[gfj@KFJK ssl]$ ./serv
Enter PEM pass phrase:
Connection from 631212ac, port 5904
SSL connection using AES256-SHA
Client certificate:
subject: /C=CA/ST=hubei/O=no/OU=1/CN=1/emailAddress=1
issuer: /C=CA/ST=hubei/L=guangzhou/O=no/OU=11/CN=11/emailAddress=11
Got 12 chars:'Hello World!'
客户端编译:
g++ cli.cpp -lssl -lcrypto -o cli
[gfj@KFJK ssl]$ ./cli
Enter PEM pass phrase:
SSL connection using AES256-SHA
Server certificate:
subject: /C=CA/ST=hubei/O=no/OU=no/CN=no/emailAddress=fjgui@sina.com
issuer: /C=CA/ST=hubei/L=guangzhou/O=no/OU=11/CN=11/emailAddress=11
Got 11 chars:'I hear you.'
源代码来源openssl
服务端源代码:serv.cpp
/* serv.cpp - Minimal ssleay server for Unix 30.9.1996, Sampo Kellomaki <sampo@iki.fi> */ /* mangled to work with SSLeay-0.9.0b and OpenSSL 0.9.2b Simplified to be even more minimal 12/98 - 4/99 Wade Scholine <wades@mail.cybg.com> */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> #include <memory.h> #include <errno.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <openssl/rsa.h> /* SSLeay stuff */ #include <openssl/crypto.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/ssl.h> #include <openssl/err.h> /* define HOME to be dir for key and cert files... */ #define HOME "./" /* Make these what you want for cert & key files */ #define CA HOME "ca.crt" #define CERTF HOME "server.crt" #define KEYF HOME "server.key" #define CHK_NULL(x) if ((x)==NULL) exit (1) #define CHK_ERR(err,s) if ((err)==-1) { perror(s); exit(1); } #define CHK_SSL(err) if ((err)==-1) { ERR_print_errors_fp(stderr); exit(2); } int main () { int err; int listen_sd; int sd; struct sockaddr_in sa_serv; struct sockaddr_in sa_cli; socklen_t client_len; SSL_CTX* ctx; SSL* ssl; X509* client_cert; char* str; char buf [4096]; //SSL_METHOD *meth; /* SSL preliminaries. We keep the certificate and key with the context. */ SSL_load_error_strings(); SSLeay_add_ssl_algorithms(); //meth = SSLv23_server_method(); ctx = SSL_CTX_new (SSLv23_server_method()); if (!ctx) { ERR_print_errors_fp(stderr); exit(2); } SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL); SSL_CTX_load_verify_locations(ctx, CA, NULL); if (SSL_CTX_use_certificate_file(ctx, CERTF, SSL_FILETYPE_PEM) <= 0) { ERR_print_errors_fp(stderr); exit(3); } if (SSL_CTX_use_PrivateKey_file(ctx, KEYF, SSL_FILETYPE_PEM) <= 0) { ERR_print_errors_fp(stderr); exit(4); } if (!SSL_CTX_check_private_key(ctx)) { fprintf(stderr,"Private key does not match the certificate public key\n"); exit(5); } /* ----------------------------------------------- */ /* Prepare TCP socket for receiving connections */ listen_sd = socket (AF_INET, SOCK_STREAM, 0); CHK_ERR(listen_sd, "socket"); memset (&sa_serv, '\0', sizeof(sa_serv)); sa_serv.sin_family = AF_INET; sa_serv.sin_addr.s_addr = INADDR_ANY; sa_serv.sin_port = htons (1111); /* Server Port number */ err = bind(listen_sd, (struct sockaddr*) &sa_serv, sizeof (sa_serv)); CHK_ERR(err, "bind"); /* Receive a TCP connection. */ err = listen (listen_sd, 5); CHK_ERR(err, "listen"); client_len = sizeof(sa_cli); sd = accept (listen_sd, (struct sockaddr*)&sa_cli, &client_len); CHK_ERR(sd, "accept"); close (listen_sd); printf ("Connection from %lx, port %x\n", sa_cli.sin_addr.s_addr, sa_cli.sin_port); /* ----------------------------------------------- */ /* TCP connection is ready. Do server side SSL. */ ssl = SSL_new (ctx); CHK_NULL(ssl); SSL_set_fd (ssl, sd); err = SSL_accept (ssl); CHK_SSL(err); /* Get the cipher - opt */ printf ("SSL connection using %s\n", SSL_get_cipher (ssl)); /* Get client's certificate (note: beware of dynamic allocation) - opt */ client_cert = SSL_get_peer_certificate (ssl); CHK_NULL(client_cert); if (client_cert != NULL) { printf ("Client certificate:\n"); str = X509_NAME_oneline (X509_get_subject_name (client_cert), 0, 0); CHK_NULL(str); printf ("\t subject: %s\n", str); OPENSSL_free (str); str = X509_NAME_oneline (X509_get_issuer_name (client_cert), 0, 0); CHK_NULL(str); printf ("\t issuer: %s\n", str); OPENSSL_free (str); /* We could do all sorts of certificate verification stuff here before deallocating the certificate. */ X509_free (client_cert); } else printf ("Client does not have certificate.\n"); /* DATA EXCHANGE - Receive message and send reply. */ err = SSL_read (ssl, buf, sizeof(buf) - 1); CHK_SSL(err); buf[err] = '\0'; printf ("Got %d chars:'%s'\n", err, buf); err = SSL_write (ssl, "I hear you.", strlen("I hear you.")); CHK_SSL(err); /* Clean up. */ close (sd); SSL_free (ssl); SSL_CTX_free (ctx); return 0; } /* EOF - serv.cpp */
客户端源代码:cli.cpp
/* cli.cpp - Minimal ssleay client for Unix 30.9.1996, Sampo Kellomaki <sampo@iki.fi> */ /* mangled to work with SSLeay-0.9.0b and OpenSSL 0.9.2b Simplified to be even more minimal 12/98 - 4/99 Wade Scholine <wades@mail.cybg.com> */ #include <stdio.h> #include <memory.h> #include <errno.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <unistd.h> #include <openssl/crypto.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/ssl.h> #include <openssl/err.h> /* define HOME to be dir for key and cert files... */ #define HOME "./" /* Make these what you want for cert & key files */ #define CA HOME "ca.crt" #define CERTF HOME "client.crt" #define KEYF HOME "client.key" #define CHK_NULL(x) if ((x)==NULL) exit (1) #define CHK_ERR(err,s) if ((err)==-1) { perror(s); exit(1); } #define CHK_SSL(err) if ((err)==-1) { ERR_print_errors_fp(stderr); exit(2); } int main () { int err; int sd; struct sockaddr_in sa; SSL_CTX* ctx; SSL* ssl; X509* server_cert; char* str; char buf [4096]; // SSL_METHOD *meth; SSL_library_init(); SSLeay_add_ssl_algorithms(); // meth = SSLv2_client_method(); SSL_load_error_strings(); ctx = SSL_CTX_new (SSLv23_client_method()); CHK_NULL(ctx); CHK_SSL(err); if (!ctx) { ERR_print_errors_fp(stderr); exit(2); } SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL); SSL_CTX_load_verify_locations(ctx, CA, NULL); if (SSL_CTX_use_certificate_file(ctx, CERTF, SSL_FILETYPE_PEM) <= 0) { ERR_print_errors_fp(stderr); exit(3); } if (SSL_CTX_use_PrivateKey_file(ctx, KEYF, SSL_FILETYPE_PEM) <= 0) { ERR_print_errors_fp(stderr); exit(4); } if (!SSL_CTX_check_private_key(ctx)) { fprintf(stderr,"Private key does not match the certificate public key\n"); exit(5); } /* ----------------------------------------------- */ /* Create a socket and connect to server using normal socket calls. */ sd = socket (AF_INET, SOCK_STREAM, 0); CHK_ERR(sd, "socket"); memset (&sa, '\0', sizeof(sa)); sa.sin_family = AF_INET; sa.sin_addr.s_addr = inet_addr ("172.18.18.99"); /* Server IP */ sa.sin_port = htons (1111); /* Server Port number */ err = connect(sd, (struct sockaddr*) &sa, sizeof(sa)); CHK_ERR(err, "connect"); /* ----------------------------------------------- */ /* Now we have TCP conncetion. Start SSL negotiation. */ ssl = SSL_new (ctx); CHK_NULL(ssl); SSL_set_fd (ssl, sd); err = SSL_connect (ssl); CHK_SSL(err); /* Following two steps are optional and not required for data exchange to be successful. */ /* Get the cipher - opt */ printf ("SSL connection using %s\n", SSL_get_cipher (ssl)); /* Get server's certificate (note: beware of dynamic allocation) - opt */ server_cert = SSL_get_peer_certificate (ssl); CHK_NULL(server_cert); printf ("Server certificate:\n"); str = X509_NAME_oneline (X509_get_subject_name (server_cert),0,0); CHK_NULL(str); printf ("\t subject: %s\n", str); OPENSSL_free (str); str = X509_NAME_oneline (X509_get_issuer_name (server_cert),0,0); CHK_NULL(str); printf ("\t issuer: %s\n", str); OPENSSL_free (str); /* We could do all sorts of certificate verification stuff here before deallocating the certificate. */ X509_free (server_cert); /* --------------------------------------------------- */ /* DATA EXCHANGE - Send a message and receive a reply. */ err = SSL_write (ssl, "Hello World!", strlen("Hello World!")); CHK_SSL(err); err = SSL_read (ssl, buf, sizeof(buf) - 1); CHK_SSL(err); buf[err] = '\0'; printf ("Got %d chars:'%s'\n", err, buf); SSL_shutdown (ssl); /* send SSL/ 4000 TLS close_notify */ /* Clean up. */ close (sd); SSL_free (ssl); SSL_CTX_free (ctx); return 0; } /* EOF - cli.cpp */服务端编译:
g++ serv.cpp -lssl -lcrypto -o serv
.[gfj@KFJK ssl]$ ./serv
Enter PEM pass phrase:
Connection from 631212ac, port 5904
SSL connection using AES256-SHA
Client certificate:
subject: /C=CA/ST=hubei/O=no/OU=1/CN=1/emailAddress=1
issuer: /C=CA/ST=hubei/L=guangzhou/O=no/OU=11/CN=11/emailAddress=11
Got 12 chars:'Hello World!'
客户端编译:
g++ cli.cpp -lssl -lcrypto -o cli
[gfj@KFJK ssl]$ ./cli
Enter PEM pass phrase:
SSL connection using AES256-SHA
Server certificate:
subject: /C=CA/ST=hubei/O=no/OU=no/CN=no/emailAddress=fjgui@sina.com
issuer: /C=CA/ST=hubei/L=guangzhou/O=no/OU=11/CN=11/emailAddress=11
Got 11 chars:'I hear you.'
相关文章推荐
- Flask、uWSGI and Nginx on Ubuntu 14.04
- 实验六:分析Linux内核创建一个新进程的过程
- 网站的高性能架构
- Linux centos 下在线安装mysql
- bash脚本编程(三)
- JDeveloper 开发环境配置
- 【OpenCV】OpenCV3的第三天——OpenCV常用函数清单(更新中)
- 抓取网站数据不再是难事了,Fizzler(So Easy)全能搞定
- Linux下Ant编译Hadoop-eclipse-plugin-2.x.x.jar插件
- Github docker源码之代码文件docker/image的解读
- GDB十分钟教程
- BZOJ 1798 维护序列 (多校连萌,对线段树进行加乘混合操作)
- Vim使用小结
- Linux下Java获取本机IP地址
- linuxGPIO驱动示例
- Shell for循环用法总结
- Virtual Memory Usage from Java under Linux, too much memory used
- apache + tomcat 负载均衡分布式集群配置
- AOP从理论到实践(一)
- Linux下c++调用自己编写的matlab函数:通过mcc动态链接库.so实现