cert_app.c 15 KB
Newer Older
1 2 3
/*
 *  Certificate reading application
 *
4
 *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
5
 *  SPDX-License-Identifier: Apache-2.0
6
 *
7 8 9
 *  Licensed under the Apache License, Version 2.0 (the "License"); you may
 *  not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
10
 *
11
 *  http://www.apache.org/licenses/LICENSE-2.0
12
 *
13 14 15 16 17
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
18
 *
19
 *  This file is part of mbed TLS (https://tls.mbed.org)
20 21
 */

22
#if !defined(MBEDTLS_CONFIG_FILE)
23
#include "mbedtls/config.h"
24
#else
25
#include MBEDTLS_CONFIG_FILE
26
#endif
27

28
#if defined(MBEDTLS_PLATFORM_C)
29
#include "mbedtls/platform.h"
30
#else
Rich Evans's avatar
Rich Evans committed
31
#include <stdio.h>
32 33 34
#include <stdlib.h>
#define mbedtls_time       time
#define mbedtls_time_t     time_t
35 36
#define mbedtls_fprintf    fprintf
#define mbedtls_printf     printf
37 38
#endif

39 40 41 42 43
#if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_ENTROPY_C) ||  \
    !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_CLI_C) || \
    !defined(MBEDTLS_NET_C) || !defined(MBEDTLS_RSA_C) ||         \
    !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_FS_IO) ||  \
    !defined(MBEDTLS_CTR_DRBG_C)
44 45
int main( void )
{
46 47 48 49 50
    mbedtls_printf("MBEDTLS_BIGNUM_C and/or MBEDTLS_ENTROPY_C and/or "
           "MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_CLI_C and/or "
           "MBEDTLS_NET_C and/or MBEDTLS_RSA_C and/or "
           "MBEDTLS_X509_CRT_PARSE_C and/or MBEDTLS_FS_IO and/or "
           "MBEDTLS_CTR_DRBG_C not defined.\n");
51 52 53 54
    return( 0 );
}
#else

55 56
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"
57
#include "mbedtls/net_sockets.h"
58 59
#include "mbedtls/ssl.h"
#include "mbedtls/x509.h"
60
#include "mbedtls/debug.h"
61

Rich Evans's avatar
Rich Evans committed
62 63 64
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
65

66 67 68 69 70 71
#define MODE_NONE               0
#define MODE_FILE               1
#define MODE_SSL                2

#define DFL_MODE                MODE_NONE
#define DFL_FILENAME            "cert.crt"
72
#define DFL_CA_FILE             ""
73
#define DFL_CRL_FILE            ""
74
#define DFL_CA_PATH             ""
75
#define DFL_SERVER_NAME         "localhost"
76
#define DFL_SERVER_PORT         "4433"
77
#define DFL_DEBUG_LEVEL         0
78
#define DFL_PERMISSIVE          0
79

Rich Evans's avatar
Rich Evans committed
80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
#define USAGE_IO \
    "    ca_file=%%s          The single file containing the top-level CA(s) you fully trust\n" \
    "                        default: \"\" (none)\n" \
    "    crl_file=%%s         The single CRL file you want to use\n" \
    "                        default: \"\" (none)\n" \
    "    ca_path=%%s          The path containing the top-level CA(s) you fully trust\n" \
    "                        default: \"\" (none) (overrides ca_file)\n"

#define USAGE \
    "\n usage: cert_app param=<>...\n"                  \
    "\n acceptable parameters:\n"                       \
    "    mode=file|ssl       default: none\n"           \
    "    filename=%%s         default: cert.crt\n"      \
    USAGE_IO                                            \
    "    server_name=%%s      default: localhost\n"     \
    "    server_port=%%d      default: 4433\n"          \
    "    debug_level=%%d      default: 0 (disabled)\n"  \
    "    permissive=%%d       default: 0 (disabled)\n"  \
    "\n"

100 101 102 103 104 105
/*
 * global options
 */
struct options
{
    int mode;                   /* the mode to run the application in   */
106 107
    const char *filename;       /* filename of the certificate file     */
    const char *ca_file;        /* the file with the CA certificate(s)  */
108
    const char *crl_file;       /* the file with the CRL to use         */
109 110
    const char *ca_path;        /* the path with the CA certificate(s) reside */
    const char *server_name;    /* hostname of the server (client only) */
111
    const char *server_port;    /* port on which the ssl service runs   */
112
    int debug_level;            /* level of debugging                   */
113
    int permissive;             /* permissive parsing                   */
114 115
} opt;

116 117 118
static void my_debug( void *ctx, int level,
                      const char *file, int line,
                      const char *str )
119
{
120 121 122 123
    ((void) level);

    mbedtls_fprintf( (FILE *) ctx, "%s:%04d: %s", file, line, str );
    fflush(  (FILE *) ctx  );
124 125
}

126
static int my_verify( void *data, mbedtls_x509_crt *crt, int depth, uint32_t *flags )
127 128 129 130
{
    char buf[1024];
    ((void) data);

131 132 133
    mbedtls_printf( "\nVerify requested for (Depth %d):\n", depth );
    mbedtls_x509_crt_info( buf, sizeof( buf ) - 1, "", crt );
    mbedtls_printf( "%s", buf );
134 135

    if ( ( *flags ) == 0 )
136
        mbedtls_printf( "  This certificate has no flags\n" );
137 138 139 140 141
    else
    {
        mbedtls_x509_crt_verify_info( buf, sizeof( buf ), "  ! ", *flags );
        mbedtls_printf( "%s\n", buf );
    }
142 143 144 145

    return( 0 );
}

146 147
int main( int argc, char *argv[] )
{
148 149
    int ret = 0;
    mbedtls_net_context server_fd;
150
    unsigned char buf[1024];
151 152 153
    mbedtls_entropy_context entropy;
    mbedtls_ctr_drbg_context ctr_drbg;
    mbedtls_ssl_context ssl;
154
    mbedtls_ssl_config conf;
155 156
    mbedtls_x509_crt cacert;
    mbedtls_x509_crl cacrl;
157
    int i, j;
158 159
    uint32_t flags;
    int verify = 0;
160
    char *p, *q;
161
    const char *pers = "cert_app";
162

163 164 165
    /*
     * Set to sane values
     */
166
    mbedtls_net_init( &server_fd );
167
    mbedtls_ctr_drbg_init( &ctr_drbg );
168
    mbedtls_ssl_init( &ssl );
169
    mbedtls_ssl_config_init( &conf );
170 171 172
    mbedtls_x509_crt_init( &cacert );
#if defined(MBEDTLS_X509_CRL_PARSE_C)
    mbedtls_x509_crl_init( &cacrl );
173 174 175
#else
    /* Zeroize structure as CRL parsing is not supported and we have to pass
       it to the verify function */
176
    memset( &cacrl, 0, sizeof(mbedtls_x509_crl) );
177
#endif
178

179 180 181
    if( argc == 0 )
    {
    usage:
182
        mbedtls_printf( USAGE );
183
        ret = 2;
184 185 186 187 188
        goto exit;
    }

    opt.mode                = DFL_MODE;
    opt.filename            = DFL_FILENAME;
189
    opt.ca_file             = DFL_CA_FILE;
190
    opt.crl_file            = DFL_CRL_FILE;
191
    opt.ca_path             = DFL_CA_PATH;
192 193 194
    opt.server_name         = DFL_SERVER_NAME;
    opt.server_port         = DFL_SERVER_PORT;
    opt.debug_level         = DFL_DEBUG_LEVEL;
195
    opt.permissive          = DFL_PERMISSIVE;
196 197 198

    for( i = 1; i < argc; i++ )
    {
199 200 201 202
        p = argv[i];
        if( ( q = strchr( p, '=' ) ) == NULL )
            goto usage;
        *q++ = '\0';
203

204
        for( j = 0; p + j < q; j++ )
205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220
        {
            if( argv[i][j] >= 'A' && argv[i][j] <= 'Z' )
                argv[i][j] |= 0x20;
        }

        if( strcmp( p, "mode" ) == 0 )
        {
            if( strcmp( q, "file" ) == 0 )
                opt.mode = MODE_FILE;
            else if( strcmp( q, "ssl" ) == 0 )
                opt.mode = MODE_SSL;
            else
                goto usage;
        }
        else if( strcmp( p, "filename" ) == 0 )
            opt.filename = q;
221 222
        else if( strcmp( p, "ca_file" ) == 0 )
            opt.ca_file = q;
223 224
        else if( strcmp( p, "crl_file" ) == 0 )
            opt.crl_file = q;
225 226
        else if( strcmp( p, "ca_path" ) == 0 )
            opt.ca_path = q;
227 228 229
        else if( strcmp( p, "server_name" ) == 0 )
            opt.server_name = q;
        else if( strcmp( p, "server_port" ) == 0 )
230
            opt.server_port = q;
231 232 233 234 235 236
        else if( strcmp( p, "debug_level" ) == 0 )
        {
            opt.debug_level = atoi( q );
            if( opt.debug_level < 0 || opt.debug_level > 65535 )
                goto usage;
        }
237 238 239 240 241 242
        else if( strcmp( p, "permissive" ) == 0 )
        {
            opt.permissive = atoi( q );
            if( opt.permissive < 0 || opt.permissive > 1 )
                goto usage;
        }
243 244 245 246
        else
            goto usage;
    }

247 248 249
    /*
     * 1.1. Load the trusted CA
     */
250
    mbedtls_printf( "  . Loading the CA root certificate ..." );
251 252 253 254
    fflush( stdout );

    if( strlen( opt.ca_path ) )
    {
255
        ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path );
256 257 258 259
        verify = 1;
    }
    else if( strlen( opt.ca_file ) )
    {
260
        ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file );
261 262 263 264 265
        verify = 1;
    }

    if( ret < 0 )
    {
266
        mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse returned -0x%x\n\n", -ret );
267 268 269
        goto exit;
    }

270
    mbedtls_printf( " ok (%d skipped)\n", ret );
271

272
#if defined(MBEDTLS_X509_CRL_PARSE_C)
273 274
    if( strlen( opt.crl_file ) )
    {
275
        if( ( ret = mbedtls_x509_crl_parse_file( &cacrl, opt.crl_file ) ) != 0 )
276
        {
277
            mbedtls_printf( " failed\n  !  mbedtls_x509_crl_parse returned -0x%x\n\n", -ret );
278 279
            goto exit;
        }
280

281
        verify = 1;
282
    }
283
#endif
284

285 286
    if( opt.mode == MODE_FILE )
    {
287 288 289
        mbedtls_x509_crt crt;
        mbedtls_x509_crt *cur = &crt;
        mbedtls_x509_crt_init( &crt );
290 291

        /*
292
         * 1.1. Load the certificate(s)
293
         */
294
        mbedtls_printf( "\n  . Loading the certificate(s) ..." );
295 296
        fflush( stdout );

297
        ret = mbedtls_x509_crt_parse_file( &crt, opt.filename );
298

299
        if( ret < 0 )
300
        {
301 302
            mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse_file returned %d\n\n", ret );
            mbedtls_x509_crt_free( &crt );
303 304 305
            goto exit;
        }

306 307
        if( opt.permissive == 0 && ret > 0 )
        {
308 309
            mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse failed to parse %d certificates\n\n", ret );
            mbedtls_x509_crt_free( &crt );
310 311 312
            goto exit;
        }

313
        mbedtls_printf( " ok\n" );
314 315

        /*
316
         * 1.2 Print the certificate(s)
317
         */
318
        while( cur != NULL )
319
        {
320 321
            mbedtls_printf( "  . Peer certificate information    ...\n" );
            ret = mbedtls_x509_crt_info( (char *) buf, sizeof( buf ) - 1, "      ",
322
                                 cur );
323 324
            if( ret == -1 )
            {
325 326
                mbedtls_printf( " failed\n  !  mbedtls_x509_crt_info returned %d\n\n", ret );
                mbedtls_x509_crt_free( &crt );
327 328 329
                goto exit;
            }

330
            mbedtls_printf( "%s\n", buf );
331 332

            cur = cur->next;
333 334
        }

335 336
        ret = 0;

337 338 339 340 341
        /*
         * 1.3 Verify the certificate
         */
        if( verify )
        {
342
            mbedtls_printf( "  . Verifying X.509 certificate..." );
343

344
            if( ( ret = mbedtls_x509_crt_verify( &crt, &cacert, &cacrl, NULL, &flags,
345
                                         my_verify, NULL ) ) != 0 )
346
            {
347
                char vrfy_buf[512];
348

349
                mbedtls_printf( " failed\n" );
350

351
                mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), "  ! ", flags );
352

353
                mbedtls_printf( "%s\n", vrfy_buf );
354 355
            }
            else
356
                mbedtls_printf( " ok\n" );
357 358
        }

359
        mbedtls_x509_crt_free( &crt );
360 361 362 363 364 365
    }
    else if( opt.mode == MODE_SSL )
    {
        /*
         * 1. Initialize the RNG and the session data
         */
366
        mbedtls_printf( "\n  . Seeding the random number generator..." );
367 368
        fflush( stdout );

369
        mbedtls_entropy_init( &entropy );
370
        if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
371 372
                                   (const unsigned char *) pers,
                                   strlen( pers ) ) ) != 0 )
373
        {
374
            mbedtls_printf( " failed\n  ! mbedtls_ctr_drbg_seed returned %d\n", ret );
375
            goto ssl_exit;
376
        }
377

378
        mbedtls_printf( " ok\n" );
379

380 381 382 383
#if defined(MBEDTLS_DEBUG_C)
        mbedtls_debug_set_threshold( opt.debug_level );
#endif

384 385 386
        /*
         * 2. Start the connection
         */
387 388
        mbedtls_printf( "  . SSL connection to tcp/%s/%s...", opt.server_name,
                                                              opt.server_port );
389 390
        fflush( stdout );

391 392
        if( ( ret = mbedtls_net_connect( &server_fd, opt.server_name,
                                 opt.server_port, MBEDTLS_NET_PROTO_TCP ) ) != 0 )
393
        {
394
            mbedtls_printf( " failed\n  ! mbedtls_net_connect returned %d\n\n", ret );
395
            goto ssl_exit;
396 397 398 399 400
        }

        /*
         * 3. Setup stuff
         */
401 402
        if( ( ret = mbedtls_ssl_config_defaults( &conf,
                        MBEDTLS_SSL_IS_CLIENT,
403 404
                        MBEDTLS_SSL_TRANSPORT_STREAM,
                        MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
405
        {
406
            mbedtls_printf( " failed\n  ! mbedtls_ssl_config_defaults returned %d\n\n", ret );
407 408 409
            goto exit;
        }

410 411
        if( verify )
        {
412 413 414
            mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_REQUIRED );
            mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL );
            mbedtls_ssl_conf_verify( &conf, my_verify, NULL );
415 416
        }
        else
417
            mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_NONE );
418

419 420
        mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
        mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );
421

422 423 424 425 426 427
        if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
        {
            mbedtls_printf( " failed\n  ! mbedtls_ssl_setup returned %d\n\n", ret );
            goto ssl_exit;
        }

428
        if( ( ret = mbedtls_ssl_set_hostname( &ssl, opt.server_name ) ) != 0 )
429
        {
430
            mbedtls_printf( " failed\n  ! mbedtls_ssl_set_hostname returned %d\n\n", ret );
431
            goto ssl_exit;
432
        }
433

434 435
        mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL );

436 437 438
        /*
         * 4. Handshake
         */
439
        while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
440
        {
441
            if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
442
            {
443
                mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned %d\n\n", ret );
444
                goto ssl_exit;
445 446 447
            }
        }

448
        mbedtls_printf( " ok\n" );
449 450 451 452

        /*
         * 5. Print the certificate
         */
453 454
        mbedtls_printf( "  . Peer certificate information    ...\n" );
        ret = mbedtls_x509_crt_info( (char *) buf, sizeof( buf ) - 1, "      ",
455
                             ssl.session->peer_cert );
456 457
        if( ret == -1 )
        {
458
            mbedtls_printf( " failed\n  !  mbedtls_x509_crt_info returned %d\n\n", ret );
459
            goto ssl_exit;
460 461
        }

462
        mbedtls_printf( "%s\n", buf );
463

464
        mbedtls_ssl_close_notify( &ssl );
465 466

ssl_exit:
467
        mbedtls_ssl_free( &ssl );
468
        mbedtls_ssl_config_free( &conf );
469 470 471 472 473 474
    }
    else
        goto usage;

exit:

475
    mbedtls_net_free( &server_fd );
476 477 478
    mbedtls_x509_crt_free( &cacert );
#if defined(MBEDTLS_X509_CRL_PARSE_C)
    mbedtls_x509_crl_free( &cacrl );
479
#endif
480 481
    mbedtls_ctr_drbg_free( &ctr_drbg );
    mbedtls_entropy_free( &entropy );
482

483
#if defined(_WIN32)
484
    mbedtls_printf( "  + Press Enter to exit this program.\n" );
485 486 487
    fflush( stdout ); getchar();
#endif

488 489 490
    if( ret < 0 )
        ret = 1;

491 492
    return( ret );
}
493 494 495
#endif /* MBEDTLS_BIGNUM_C && MBEDTLS_ENTROPY_C && MBEDTLS_SSL_TLS_C &&
          MBEDTLS_SSL_CLI_C && MBEDTLS_NET_C && MBEDTLS_RSA_C &&
          MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_FS_IO && MBEDTLS_CTR_DRBG_C */