1 /* $OpenBSD: server.c,v 1.6 2019/02/11 12:22:44 bluhm Exp $ */ 2 /* 3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <sys/types.h> 19 #include <sys/socket.h> 20 21 #include <err.h> 22 #include <netdb.h> 23 #include <stdio.h> 24 #include <stdlib.h> 25 #include <string.h> 26 #include <unistd.h> 27 28 #include <openssl/err.h> 29 #include <openssl/ssl.h> 30 31 #include "util.h" 32 33 void __dead usage(void); 34 35 void __dead 36 usage(void) 37 { 38 fprintf(stderr, 39 "usage: server [-svv] [-C CA] [-c crt -k key] [host port]"); 40 exit(2); 41 } 42 43 int 44 main(int argc, char *argv[]) 45 { 46 const SSL_METHOD *method; 47 SSL_CTX *ctx; 48 SSL *ssl; 49 BIO *abio, *cbio; 50 SSL_SESSION *session; 51 int ch, error, sessionreuse = 0, verify = 0; 52 char buf[256]; 53 char *ca = NULL, *crt = NULL, *key = NULL; 54 char *host_port, *host = "127.0.0.1", *port = "0"; 55 56 while ((ch = getopt(argc, argv, "C:c:k:sv")) != -1) { 57 switch (ch) { 58 case 'C': 59 ca = optarg; 60 break; 61 case 'c': 62 crt = optarg; 63 break; 64 case 'k': 65 key = optarg; 66 break; 67 case 's': 68 /* multiple reueses are possible */ 69 sessionreuse++; 70 break; 71 case 'v': 72 /* use twice to force client cert */ 73 verify++; 74 break; 75 default: 76 usage(); 77 } 78 } 79 argc -= optind; 80 argv += optind; 81 if (argc == 2) { 82 host = argv[0]; 83 port = argv[1]; 84 } else if (argc != 0) { 85 usage(); 86 } 87 if (asprintf(&host_port, strchr(host, ':') ? "[%s]:%s" : "%s:%s", 88 host, port) == -1) 89 err(1, "asprintf host port"); 90 if ((crt == NULL && key != NULL) || (crt != NULL && key == NULL)) 91 errx(1, "certificate and private key must be used together"); 92 if (crt == NULL && asprintf(&crt, "%s.crt", host) == -1) 93 err(1, "asprintf crt"); 94 if (key == NULL && asprintf(&key, "%s.key", host) == -1) 95 err(1, "asprintf key"); 96 97 SSL_library_init(); 98 SSL_load_error_strings(); 99 print_version(); 100 101 /* setup method and context */ 102 #if OPENSSL_VERSION_NUMBER >= 0x1010000f 103 method = TLS_server_method(); 104 if (method == NULL) 105 err_ssl(1, "TLS_server_method"); 106 #else 107 method = SSLv23_server_method(); 108 if (method == NULL) 109 err_ssl(1, "SSLv23_server_method"); 110 #endif 111 ctx = SSL_CTX_new(method); 112 if (ctx == NULL) 113 err_ssl(1, "SSL_CTX_new"); 114 115 /* needed when linking with OpenSSL 1.0.2p */ 116 if (SSL_CTX_set_ecdh_auto(ctx, 1) <= 0) 117 err_ssl(1, "SSL_CTX_set_ecdh_auto"); 118 119 /* load server certificate */ 120 if (SSL_CTX_use_certificate_file(ctx, crt, SSL_FILETYPE_PEM) <= 0) 121 err_ssl(1, "SSL_CTX_use_certificate_file"); 122 if (SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM) <= 0) 123 err_ssl(1, "SSL_CTX_use_PrivateKey_file"); 124 if (SSL_CTX_check_private_key(ctx) <= 0) 125 err_ssl(1, "SSL_CTX_check_private_key"); 126 127 /* request client certificate and verify it */ 128 if (ca != NULL) { 129 STACK_OF(X509_NAME) *x509stack; 130 131 x509stack = SSL_load_client_CA_file(ca); 132 if (x509stack == NULL) 133 err_ssl(1, "SSL_load_client_CA_file"); 134 SSL_CTX_set_client_CA_list(ctx, x509stack); 135 if (SSL_CTX_load_verify_locations(ctx, ca, NULL) <= 0) 136 err_ssl(1, "SSL_CTX_load_verify_locations"); 137 } 138 SSL_CTX_set_verify(ctx, 139 verify == 0 ? SSL_VERIFY_NONE : 140 verify == 1 ? SSL_VERIFY_PEER : 141 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, 142 verify_callback); 143 144 if (sessionreuse) { 145 uint32_t context; 146 147 SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER); 148 context = arc4random(); 149 if (SSL_CTX_set_session_id_context(ctx, 150 (unsigned char *)&context, sizeof(context)) <= 0) 151 err_ssl(1, "SSL_CTX_set_session_id_context"); 152 } 153 154 /* setup bio for socket operations */ 155 abio = BIO_new_accept(host_port); 156 if (abio == NULL) 157 err_ssl(1, "BIO_new_accept"); 158 159 /* bind, listen */ 160 if (BIO_do_accept(abio) <= 0) 161 err_ssl(1, "BIO_do_accept setup"); 162 printf("listen "); 163 print_sockname(abio); 164 165 /* fork to background and set timeout */ 166 if (daemon(1, 1) == -1) 167 err(1, "daemon"); 168 if ((int)alarm(10) == -1) 169 err(1, "alarm"); 170 171 do { 172 /* accept connection */ 173 if (BIO_do_accept(abio) <= 0) 174 err_ssl(1, "BIO_do_accept wait"); 175 cbio = BIO_pop(abio); 176 printf("accept "); 177 print_sockname(cbio); 178 printf("accept "); 179 print_peername(cbio); 180 181 /* do ssl server handshake */ 182 ssl = SSL_new(ctx); 183 if (ssl == NULL) 184 err_ssl(1, "SSL_new"); 185 print_ciphers(SSL_get_ciphers(ssl)); 186 SSL_set_bio(ssl, cbio, cbio); 187 if ((error = SSL_accept(ssl)) <= 0) 188 err_ssl(1, "SSL_accept %d", error); 189 printf("session %d: %s\n", sessionreuse, 190 SSL_session_reused(ssl) ? "reuse" : "new"); 191 if (fflush(stdout) != 0) 192 err(1, "fflush stdout"); 193 194 195 /* print session statistics */ 196 session = SSL_get_session(ssl); 197 if (session == NULL) 198 err_ssl(1, "SSL_get_session"); 199 if (SSL_SESSION_print_fp(stdout, session) <= 0) 200 err_ssl(1, "SSL_SESSION_print_fp"); 201 202 /* write server greeting and read client hello over TLS */ 203 strlcpy(buf, "greeting\n", sizeof(buf)); 204 printf(">>> %s", buf); 205 if (fflush(stdout) != 0) 206 err(1, "fflush stdout"); 207 if ((error = SSL_write(ssl, buf, 9)) <= 0) 208 err_ssl(1, "SSL_write %d", error); 209 if (error != 9) 210 errx(1, "write not 9 bytes greeting: %d", error); 211 if ((error = SSL_read(ssl, buf, 6)) <= 0) 212 err_ssl(1, "SSL_read %d", error); 213 if (error != 6) 214 errx(1, "read not 6 bytes hello: %d", error); 215 buf[6] = '\0'; 216 printf("<<< %s", buf); 217 if (fflush(stdout) != 0) 218 err(1, "fflush stdout"); 219 220 /* shutdown connection */ 221 if ((error = SSL_shutdown(ssl)) < 0) 222 err_ssl(1, "SSL_shutdown unidirectional %d", error); 223 if (error <= 0) { 224 if ((error = SSL_shutdown(ssl)) <= 0) 225 err_ssl(1, "SSL_shutdown bidirectional %d", 226 error); 227 } 228 229 SSL_free(ssl); 230 } while (sessionreuse--); 231 232 SSL_CTX_free(ctx); 233 234 printf("success\n"); 235 236 return 0; 237 } 238