• 运行mbedtls自带Demo ssl_client的记录

    概述：

            运行mbedtls自带  ssl demo的记录；

    操作过程：

            编译Demo，请看我专栏中的相关文章

            先运行服务端程序，运行ssl_server.exe，运行结果如下：

    1. mbedtls-3.2.1\mbedtls-3.2.1\programs\ssl> .\ssl_server.exe
    2.   . Seeding the random number generator... ok
    3.  
    4.   . Loading the server cert. and key... ok
    5.   . Bind on https://localhost:4433/ ... ok
    6.   . Setting up the SSL data.... ok
    7.   . Waiting for a remote connection ... ok
    8.   . Performing the SSL/TLS handshake... ok
    9.   < Read from client: 18 bytes read
    10.  
    11. GET / HTTP/1.0
    12.  
    13.   > Write to client: 156 bytes written
    14.  
    15. HTTP/1.0 200 OK
    16. Content-Type: text/html
    17.  
    18. mbed TLS Test Server
    19. Successful connection using: TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256
    20.  
    21.   . Closing the connection... ok
    22.   . Waiting for a remote connection ... ok
    23.   . Performing the SSL/TLS handshake... ok
    24.   < Read from client: 18 bytes read
    25.  
    26. GET / HTTP/1.0
    27.  
    28.   > Write to client: 156 bytes written
    29.  
    30. HTTP/1.0 200 OK
    31. Content-Type: text/html
    32.  
    33. mbed TLS Test Server
    34. Successful connection using: TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256
    35.  
    36.   . Closing the connection... ok
    37.   . Waiting for a remote connection ...

    再运行服务端，ssl_client1.exe, 运行结果如下;

    1. mbedtls-3.2.1\mbedtls-3.2.1\programs\ssl> .\ssl_client1.exe
    2.  
    3.   . Seeding the random number generator... ok
    4.   . Loading the CA root certificate ... ok (0 skipped)
    5.   . Connecting to tcp/localhost/4433... ok
    6.   . Setting up the SSL/TLS structure... ok
    7.   . Performing the SSL/TLS handshake...ssl_client.c:0261: got supported group(001d)
    8. ssl_client.c:0261: got supported group(0017)
    9. ssl_client.c:0261: got supported group(0018)
    10. ssl_client.c:0261: got supported group(001e)
    11. ssl_client.c:0261: got supported group(0019)
    12. ssl_client.c:0261: got supported group(001a)
    13. ssl_client.c:0261: got supported group(001b)
    14. ssl_client.c:0261: got supported group(001c)
    15.  ok
    16.   . Verifying peer X.509 certificate... ok
    17.   > Write to server: 18 bytes written
    18.  
    19. GET / HTTP/1.0
    20.  
    21.   < Read from server: 156 bytes read
    22.  
    23. HTTP/1.0 200 OK
    24. Content-Type: text/html
    25.  
    26. mbed TLS Test Server
    27. Successful connection using: TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256
    28. ssl_msg.c:3900: mbedtls_ssl_handle_message_type() returned -30848 (-0x7880)
    29. ssl_msg.c:5472: mbedtls_ssl_read_record() returned -30848 (-0x7880)
    30. PS D:\Drive\SynologyDrive\NFC\16_开源项目\mbedtls-3.2.1\mbedtls-3.2.1\programs\ssl> .\ssl_client1.exe
    31.  
    32.   . Seeding the random number generator... ok
    33.   . Loading the CA root certificate ... ok (0 skipped)
    34.   . Connecting to tcp/localhost/4433... ok
    35.   . Setting up the SSL/TLS structure... ok
    36.   . Performing the SSL/TLS handshake...ssl_client.c:0261: got supported group(001d)
    37. ssl_client.c:0261: got supported group(0017)
    38. ssl_client.c:0261: got supported group(0018)
    39. ssl_client.c:0261: got supported group(001e)
    40. ssl_client.c:0261: got supported group(0019)
    41. ssl_client.c:0261: got supported group(001a)
    42. ssl_client.c:0261: got supported group(001b)
    43. ssl_client.c:0261: got supported group(001c)
    44.  ok
    45.   . Verifying peer X.509 certificate... ok
    46.   > Write to server: 18 bytes written
    47.  
    48. GET / HTTP/1.0
    49.  
    50.   < Read from server: 156 bytes read
    51.  
    52. HTTP/1.0 200 OK
    53. Content-Type: text/html
    54.  
    55. mbed TLS Test Server
    56. Successful connection using: TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256
    57. ssl_msg.c:3900: mbedtls_ssl_handle_message_type() returned -30848 (-

    抓取SSL过程分析：

            使用wireshark 工具，可以实现抓包分析，抓取Demo的数据进行分析：

    从抓包中可以看出，在进行完TCP连接后，进行了SSL连接过程：

    Client Hello

    Server Hell

    Certification

    Server key exchange

    Server Hello done

    Client Key exchange

    Handshake 等操作

    Demo代码：

    贴出 client 端代码

    1. int main( void )
    2. {
    3.     int ret = 1, len;
    4.     int exit_code = MBEDTLS_EXIT_FAILURE;
    5.     mbedtls_net_context server_fd;
    6.     uint32_t flags;
    7.     unsigned char buf[1024];
    8.     const char *pers = "ssl_client1";
    9.  
    10.     mbedtls_entropy_context entropy;
    11.     mbedtls_ctr_drbg_context ctr_drbg;
    12.     mbedtls_ssl_context ssl;
    13.     mbedtls_ssl_config conf;
    14.     mbedtls_x509_crt cacert;
    15.  
    16. #if defined(MBEDTLS_DEBUG_C)
    17.     mbedtls_debug_set_threshold( DEBUG_LEVEL );
    18. #endif
    19.  
    20.     /*
    21.      * 0. Initialize the RNG and the session data
    22.      */
    23.     mbedtls_net_init( &server_fd );
    24.     mbedtls_ssl_init( &ssl );
    25.     mbedtls_ssl_config_init( &conf );
    26.     mbedtls_x509_crt_init( &cacert );
    27.     mbedtls_ctr_drbg_init( &ctr_drbg );
    28.  
    29.     mbedtls_printf( "\n  . Seeding the random number generator..." );
    30.     fflush( stdout );
    31.  
    32.     mbedtls_entropy_init( &entropy );
    33.     if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
    34.                                (const unsigned char *) pers,
    35.                                strlen( pers ) ) ) != 0 )
    36.     {
    37.         mbedtls_printf( " failed\n  ! mbedtls_ctr_drbg_seed returned %d\n", ret );
    38.         goto exit;
    39.     }
    40.  
    41.     mbedtls_printf( " ok\n" );
    42.  
    43.     /*
    44.      * 0. Initialize certificates
    45.      */
    46.     mbedtls_printf( "  . Loading the CA root certificate ..." );
    47.     fflush( stdout );
    48.  
    49.     ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) mbedtls_test_cas_pem,
    50.                           mbedtls_test_cas_pem_len );
    51.     if( ret < 0 )
    52.     {
    53.         mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse returned -0x%x\n\n", (unsigned int) -ret );
    54.         goto exit;
    55.     }
    56.  
    57.     mbedtls_printf( " ok (%d skipped)\n", ret );
    58.  
    59.     /*
    60.      * 1. Start the connection
    61.      */
    62.     mbedtls_printf( "  . Connecting to tcp/%s/%s...", SERVER_NAME, SERVER_PORT );
    63.     fflush( stdout );
    64.  
    65.     if( ( ret = mbedtls_net_connect( &server_fd, SERVER_NAME,
    66.                                          SERVER_PORT, MBEDTLS_NET_PROTO_TCP ) ) != 0 )
    67.     {
    68.         mbedtls_printf( " failed\n  ! mbedtls_net_connect returned %d\n\n", ret );
    69.         goto exit;
    70.     }
    71.  
    72.     mbedtls_printf( " ok\n" );
    73.  
    74.     /*
    75.      * 2. Setup stuff
    76.      */
    77.     mbedtls_printf( "  . Setting up the SSL/TLS structure..." );
    78.     fflush( stdout );
    79.  
    80.     if( ( ret = mbedtls_ssl_config_defaults( &conf,
    81.                     MBEDTLS_SSL_IS_CLIENT,
    82.                     MBEDTLS_SSL_TRANSPORT_STREAM,
    83.                     MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
    84.     {
    85.         mbedtls_printf( " failed\n  ! mbedtls_ssl_config_defaults returned %d\n\n", ret );
    86.         goto exit;
    87.     }
    88.  
    89.     mbedtls_printf( " ok\n" );
    90.  
    91.     /* OPTIONAL is not optimal for security,
    92.      * but makes interop easier in this simplified example */
    93.     mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_OPTIONAL );
    94.     mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL );
    95.     mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
    96.     mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );
    97.  
    98.     if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
    99.     {
    100.         mbedtls_printf( " failed\n  ! mbedtls_ssl_setup returned %d\n\n", ret );
    101.         goto exit;
    102.     }
    103.  
    104.     if( ( ret = mbedtls_ssl_set_hostname( &ssl, SERVER_NAME ) ) != 0 )
    105.     {
    106.         mbedtls_printf( " failed\n  ! mbedtls_ssl_set_hostname returned %d\n\n", ret );
    107.         goto exit;
    108.     }
    109.  
    110.     mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
    111.  
    112.     /*
    113.      * 4. Handshake
    114.      */
    115.     mbedtls_printf( "  . Performing the SSL/TLS handshake..." );
    116.     fflush( stdout );
    117.  
    118.     while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
    119.     {
    120.         if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
    121.         {
    122.             mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned -0x%x\n\n", (unsigned int) -ret );
    123.             goto exit;
    124.         }
    125.     }
    126.  
    127.     mbedtls_printf( " ok\n" );
    128.  
    129.     /*
    130.      * 5. Verify the server certificate
    131.      */
    132.     mbedtls_printf( "  . Verifying peer X.509 certificate..." );
    133.  
    134.     /* In real life, we probably want to bail out when ret != 0 */
    135.     if( ( flags = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 )
    136.     {
    137. #if !defined(MBEDTLS_X509_REMOVE_INFO)
    138.         char vrfy_buf[512];
    139. #endif
    140.  
    141.         mbedtls_printf( " failed\n" );
    142.  
    143. #if !defined(MBEDTLS_X509_REMOVE_INFO)
    144.         mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), "  ! ", flags );
    145.  
    146.         mbedtls_printf( "%s\n", vrfy_buf );
    147. #endif
    148.     }
    149.     else
    150.         mbedtls_printf( " ok\n" );
    151.  
    152.     /*
    153.      * 3. Write the GET request
    154.      */
    155.     mbedtls_printf( "  > Write to server:" );
    156.     fflush( stdout );
    157.  
    158.     len = sprintf( (char *) buf, GET_REQUEST );
    159.  
    160.     while( ( ret = mbedtls_ssl_write( &ssl, buf, len ) ) <= 0 )
    161.     {
    162.         if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
    163.         {
    164.             mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned %d\n\n", ret );
    165.             goto exit;
    166.         }
    167.     }
    168.  
    169.     len = ret;
    170.     mbedtls_printf( " %d bytes written\n\n%s", len, (char *) buf );
    171.  
    172.     /*
    173.      * 7. Read the HTTP response
    174.      */
    175.     mbedtls_printf( "  < Read from server:" );
    176.     fflush( stdout );
    177.  
    178.     do
    179.     {
    180.         len = sizeof( buf ) - 1;
    181.         memset( buf, 0, sizeof( buf ) );
    182.         ret = mbedtls_ssl_read( &ssl, buf, len );
    183.  
    184.         if( ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE )
    185.             continue;
    186.  
    187.         if( ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY )
    188.             break;
    189.  
    190.         if( ret < 0 )
    191.         {
    192.             mbedtls_printf( "failed\n  ! mbedtls_ssl_read returned %d\n\n", ret );
    193.             break;
    194.         }
    195.  
    196.         if( ret == 0 )
    197.         {
    198.             mbedtls_printf( "\n\nEOF\n\n" );
    199.             break;
    200.         }
    201.  
    202.         len = ret;
    203.         mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf );
    204.     }
    205.     while( 1 );
    206.  
    207.     mbedtls_ssl_close_notify( &ssl );
    208.  
    209.     exit_code = MBEDTLS_EXIT_SUCCESS;
    210.  
    211. exit:
    212.  
    213. #ifdef MBEDTLS_ERROR_C
    214.     if( exit_code != MBEDTLS_EXIT_SUCCESS )
    215.     {
    216.         char error_buf[100];
    217.         mbedtls_strerror( ret, error_buf, 100 );
    218.         mbedtls_printf("Last error was: %d - %s\n\n", ret, error_buf );
    219.     }
    220. #endif
    221.  
    222.     mbedtls_net_free( &server_fd );
    223.  
    224.     mbedtls_x509_crt_free( &cacert );
    225.     mbedtls_ssl_free( &ssl );
    226.     mbedtls_ssl_config_free( &conf );
    227.     mbedtls_ctr_drbg_free( &ctr_drbg );
    228.     mbedtls_entropy_free( &entropy );
    229.  
    230.     mbedtls_exit( exit_code );
    231. }

    Demo代码比较简单，

  • 相关阅读:
    尚硅谷尚优选项目教程发布
    JVM源码解析Java Attach处理流程
    Elasticsearch高级之-集群搭建，数据分片
    MySQ之备份与恢复
    Android 11编译第三弹 ADB开启ROOT权限
    鸿鹄工程项目管理系统em Spring Cloud+Spring Boot+前后端分离构建工程项目管理系统
    【Maven】SpringBoot多模块项目利用reversion占位符,进行版本管理.打包时版本号不能识别问题
    docker搭建私有仓库
    linux 时间和北京时间对不上
    分库分表知识内容
  • 原文地址：https://blog.csdn.net/wangzhiqin365/article/details/127878899