Client and Server communication using ssl c/c++ - SSL protocol don't works
I\'m trying use an SSL client/server example from:http://simplestcodings.blogspot.com.br/2010/08/secure-server-client-using-openssl-in-c.html to create a secure connection u
-
you must to modify your code (server side): your code:
int main() { SSL_CTX *ctx; int server; **char portnum[]="5000";** char CertFile[] = "/home/myCA/mycert.pem"; char KeyFile[] = "/home/myCA/mycert.pem"; SSL_library_init(); **portnum = strings[1];**instead you should use this:
int main(int argc, char **argv) { SSL_CTX *ctx; int server; //char portnum[]="5000"; ---> You can pass it as an argument char CertFile[] = "/home/myCA/mycert.pem"; char KeyFile[] = "/home/myCA/mycert.pem"; SSL_library_init(); //portnum = strings[1]; portnum = argv[1]; // ---> You can pass port number here, instead of put it in the codeI got this output (client):
toc@UnixServer:~$ ./ssl_client Connected with AES256-SHA encryption Server certificates: Subject: /C=FR/ST=Some-State/L=PARIS/O=TOC/OU=TOC/CN=TOC/emailAddress=toc@toc.com Issuer: /C=FR/ST=Some-State/L=PARIS/O=TOC/OU=TOC/CN=TOC/emailAddress=toc@toc.com Received: "<html><body><pre>Hello???</pre></body></html> "And this output (server):
Connection: 127.0.0.1:59066 Server certificates: Subject: /C=FR/ST=Some-State/L=PARIS/O=TOC/OU=TOC/CN=TOC/emailAddress=toc@toc.com Issuer: /C=FR/ST=Some-State/L=PARIS/O=TOC/OU=TOC/CN=TOC/emailAddress=toc@toc.com Client msg: "Hello???"When you use a tool like ssldump (http://www.rtfm.com/ssldump/) (on unix box), you can see clearly what's going on:
toc@UnixServer:~$sudo ssldump -i lo port 5000 New TCP connection #1: localhost(59071) <-> localhost(5000) 1 1 0.0012 (0.0012) C>S Handshake ClientHello Version 3.0 cipher suites Unknown value 0xc014 Unknown value 0xc00a SSL_DHE_RSA_WITH_AES_256_CBC_SHA SSL_DHE_DSS_WITH_AES_256_CBC_SHA Unknown value 0x88 Unknown value 0x87 Unknown value 0xc00f Unknown value 0xc005 SSL_RSA_WITH_AES_256_CBC_SHA Unknown value 0x84 Unknown value 0xc012 Unknown value 0xc008 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA Unknown value 0xc00d Unknown value 0xc003 SSL_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0xc013 Unknown value 0xc009 SSL_DHE_RSA_WITH_AES_128_CBC_SHA SSL_DHE_DSS_WITH_AES_128_CBC_SHA Unknown value 0x9a Unknown value 0x99 Unknown value 0x45 Unknown value 0x44 Unknown value 0xc00e Unknown value 0xc004 SSL_RSA_WITH_AES_128_CBC_SHA Unknown value 0x96 Unknown value 0x41 Unknown value 0xc011 Unknown value 0xc007 Unknown value 0xc00c Unknown value 0xc002 SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 Unknown value 0xff compression methods unknown value NULL 1 2 0.0019 (0.0006) S>C Handshake ServerHello Version 3.0 session_id[32]= 13 e2 5a f0 10 93 18 56 c8 66 54 94 29 ab 8b 2d 7b c6 9c 3b 7b ea c7 54 e6 86 7d 3a 56 8c 96 14 cipherSuite SSL_RSA_WITH_AES_256_CBC_SHA compressionMethod unknown value 1 3 0.0019 (0.0000) S>C Handshake Certificate 1 4 0.0019 (0.0000) S>C Handshake CertificateRequest certificate_types rsa_sign certificate_types dss_sign ServerHelloDone 1 5 0.0155 (0.0136) C>S Handshake Certificate 1 6 0.0155 (0.0000) C>S Handshake ClientKeyExchange 1 7 0.0155 (0.0000) C>S Handshake CertificateVerify Signature[128]= ac 94 31 89 64 75 20 5f 4f 00 73 4e e8 de 51 b7 f1 bb 16 da 63 b1 8d e9 15 9b af f8 32 d7 84 f5 b5 7d 4f 48 1c 2b 41 58 81 d3 a8 50 40 25 90 95 44 de 9d bb c4 79 5c 64 a8 a9 28 f4 16 7c 0e 17 b2 77 cf b0 8c a9 90 50 34 a5 76 a2 57 39 8d 37 12 d8 a5 8d f4 08 3a 1e 83 7e 6c 0a e9 75 ec 85 3d 56 f2 2e 4a 7d 71 88 29 26 99 40 43 4e f3 29 26 bf eb 15 be 36 22 72 f3 d9 be 4a e3 c9 0b cc 1 8 0.0155 (0.0000) C>S ChangeCipherSpec 1 9 0.0155 (0.0000) C>S Handshake 1 10 0.0245 (0.0089) S>C ChangeCipherSpec 1 11 0.0245 (0.0000) S>C Handshake 1 12 0.0250 (0.0005) C>S application_data 1 13 0.0250 (0.0000) C>S application_data 1 14 0.0258 (0.0007) S>C application_data 1 15 0.0258 (0.0000) S>C application_data 1 0.0261 (0.0002) C>S TCP FIN 1 0.0275 (0.0013) S>C TCP FINRegards.
讨论(0) -
As I was saying in comments to one of your previous question, the fact that you get "Malformed Packet: GSM over IP" or something odd here is normal.
You're using port 5000, which is normally reserved for protocol
commplex-main. Therefore, without any extra information, Wireshark tries to analyse the traffic it sees with thecommplex-maindecoders.Of course, since the data you're exchanging on that port is in fact SSL/TLS (because you're using a port that's not normally used for that), decoding it as if it was
commplex-mainleads to a number of odd messages regarding malformed packets.Wireshark only guesses the protocol using the port number it sees. You have to tell it to try a different decoder, if you're not using the standard port for that protocol.
More specifically, right click on a packet and choose Decode As... -> Transport -> SSL.
讨论(0) -
With the above server and client programs, I was getting the following error:
140671281543104:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:3292:
I had generated self-signed certificates using the procedure mentioned in https://help.ubuntu.com/community/OpenSSL.
After juggling with the error for one day, i found that the error was because the self-generated CA was not in the trust chain of the machine I was using.
To add the CA to the trust chain in RHEL-7, one can follow the below procedure:
To add a certificate in the simple PEM or DER file formats to the list of CAs trusted on the system: Copy it to the /etc/pki/ca-trust/source/anchors/ subdirectory, and run the update-ca-trust command. If your certificate is in the extended BEGIN TRUSTED file format, then place it into the main source/ directory instead.I think the above procedure can be followed for fedora too. If this does not work, it might be useful to explore the commands like "update-ca-certificates". Hope this will be useful to someone.
讨论(0)
加载中...
- 热议问题