• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  *  Certificate reading application
3  *
4  *  Copyright The Mbed TLS Contributors
5  *  SPDX-License-Identifier: Apache-2.0
6  *
7  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
8  *  not use this file except in compliance with the License.
9  *  You may obtain a copy of the License at
10  *
11  *  http://www.apache.org/licenses/LICENSE-2.0
12  *
13  *  Unless required by applicable law or agreed to in writing, software
14  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  *  See the License for the specific language governing permissions and
17  *  limitations under the License.
18  */
19 
20 #include "mbedtls/build_info.h"
21 
22 #if defined(MBEDTLS_PLATFORM_C)
23 #include "mbedtls/platform.h"
24 #else
25 #include <stdio.h>
26 #include <stdlib.h>
27 #define mbedtls_time            time
28 #define mbedtls_time_t          time_t
29 #define mbedtls_fprintf         fprintf
30 #define mbedtls_printf          printf
31 #define mbedtls_exit            exit
32 #define MBEDTLS_EXIT_SUCCESS    EXIT_SUCCESS
33 #define MBEDTLS_EXIT_FAILURE    EXIT_FAILURE
34 #endif /* MBEDTLS_PLATFORM_C */
35 
36 #if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_ENTROPY_C) ||  \
37     !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_CLI_C) || \
38     !defined(MBEDTLS_NET_C) || !defined(MBEDTLS_RSA_C) ||         \
39     !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_FS_IO) ||  \
40     !defined(MBEDTLS_CTR_DRBG_C) || defined(MBEDTLS_X509_REMOVE_INFO)
main(void)41 int main( void )
42 {
43     mbedtls_printf("MBEDTLS_BIGNUM_C and/or MBEDTLS_ENTROPY_C and/or "
44            "MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_CLI_C and/or "
45            "MBEDTLS_NET_C and/or MBEDTLS_RSA_C and/or "
46            "MBEDTLS_X509_CRT_PARSE_C and/or MBEDTLS_FS_IO and/or "
47            "MBEDTLS_CTR_DRBG_C not defined and/or MBEDTLS_X509_REMOVE_INFO defined.\n");
48     mbedtls_exit( 0 );
49 }
50 #else
51 
52 #include "mbedtls/entropy.h"
53 #include "mbedtls/ctr_drbg.h"
54 #include "mbedtls/net_sockets.h"
55 #include "mbedtls/ssl.h"
56 #include "mbedtls/x509.h"
57 #include "mbedtls/debug.h"
58 
59 #include <stdio.h>
60 #include <stdlib.h>
61 #include <string.h>
62 
63 #define MODE_NONE               0
64 #define MODE_FILE               1
65 #define MODE_SSL                2
66 
67 #define DFL_MODE                MODE_NONE
68 #define DFL_FILENAME            "cert.crt"
69 #define DFL_CA_FILE             ""
70 #define DFL_CRL_FILE            ""
71 #define DFL_CA_PATH             ""
72 #define DFL_SERVER_NAME         "localhost"
73 #define DFL_SERVER_PORT         "4433"
74 #define DFL_DEBUG_LEVEL         0
75 #define DFL_PERMISSIVE          0
76 
77 #define USAGE_IO \
78     "    ca_file=%%s          The single file containing the top-level CA(s) you fully trust\n" \
79     "                        default: \"\" (none)\n" \
80     "    crl_file=%%s         The single CRL file you want to use\n" \
81     "                        default: \"\" (none)\n" \
82     "    ca_path=%%s          The path containing the top-level CA(s) you fully trust\n" \
83     "                        default: \"\" (none) (overrides ca_file)\n"
84 
85 #define USAGE \
86     "\n usage: cert_app param=<>...\n"                  \
87     "\n acceptable parameters:\n"                       \
88     "    mode=file|ssl       default: none\n"           \
89     "    filename=%%s         default: cert.crt\n"      \
90     USAGE_IO                                            \
91     "    server_name=%%s      default: localhost\n"     \
92     "    server_port=%%d      default: 4433\n"          \
93     "    debug_level=%%d      default: 0 (disabled)\n"  \
94     "    permissive=%%d       default: 0 (disabled)\n"  \
95     "\n"
96 
97 
98 /*
99  * global options
100  */
101 struct options
102 {
103     int mode;                   /* the mode to run the application in   */
104     const char *filename;       /* filename of the certificate file     */
105     const char *ca_file;        /* the file with the CA certificate(s)  */
106     const char *crl_file;       /* the file with the CRL to use         */
107     const char *ca_path;        /* the path with the CA certificate(s) reside */
108     const char *server_name;    /* hostname of the server (client only) */
109     const char *server_port;    /* port on which the ssl service runs   */
110     int debug_level;            /* level of debugging                   */
111     int permissive;             /* permissive parsing                   */
112 } opt;
113 
my_debug(void * ctx,int level,const char * file,int line,const char * str)114 static void my_debug( void *ctx, int level,
115                       const char *file, int line,
116                       const char *str )
117 {
118     ((void) level);
119 
120     mbedtls_fprintf( (FILE *) ctx, "%s:%04d: %s", file, line, str );
121     fflush(  (FILE *) ctx  );
122 }
123 
my_verify(void * data,mbedtls_x509_crt * crt,int depth,uint32_t * flags)124 static int my_verify( void *data, mbedtls_x509_crt *crt, int depth, uint32_t *flags )
125 {
126     char buf[1024];
127     ((void) data);
128 
129     mbedtls_printf( "\nVerify requested for (Depth %d):\n", depth );
130     mbedtls_x509_crt_info( buf, sizeof( buf ) - 1, "", crt );
131     mbedtls_printf( "%s", buf );
132 
133     if ( ( *flags ) == 0 )
134         mbedtls_printf( "  This certificate has no flags\n" );
135     else
136     {
137         mbedtls_x509_crt_verify_info( buf, sizeof( buf ), "  ! ", *flags );
138         mbedtls_printf( "%s\n", buf );
139     }
140 
141     return( 0 );
142 }
143 
main(int argc,char * argv[])144 int main( int argc, char *argv[] )
145 {
146     int ret = 1;
147     int exit_code = MBEDTLS_EXIT_FAILURE;
148     mbedtls_net_context server_fd;
149     unsigned char buf[1024];
150     mbedtls_entropy_context entropy;
151     mbedtls_ctr_drbg_context ctr_drbg;
152     mbedtls_ssl_context ssl;
153     mbedtls_ssl_config conf;
154     mbedtls_x509_crt cacert;
155     mbedtls_x509_crl cacrl;
156     int i, j;
157     uint32_t flags;
158     int verify = 0;
159     char *p, *q;
160     const char *pers = "cert_app";
161 
162     /*
163      * Set to sane values
164      */
165     mbedtls_net_init( &server_fd );
166     mbedtls_ctr_drbg_init( &ctr_drbg );
167     mbedtls_ssl_init( &ssl );
168     mbedtls_ssl_config_init( &conf );
169     mbedtls_x509_crt_init( &cacert );
170 #if defined(MBEDTLS_X509_CRL_PARSE_C)
171     mbedtls_x509_crl_init( &cacrl );
172 #else
173     /* Zeroize structure as CRL parsing is not supported and we have to pass
174        it to the verify function */
175     memset( &cacrl, 0, sizeof(mbedtls_x509_crl) );
176 #endif
177 
178     if( argc == 0 )
179     {
180     usage:
181         mbedtls_printf( USAGE );
182         goto exit;
183     }
184 
185     opt.mode                = DFL_MODE;
186     opt.filename            = DFL_FILENAME;
187     opt.ca_file             = DFL_CA_FILE;
188     opt.crl_file            = DFL_CRL_FILE;
189     opt.ca_path             = DFL_CA_PATH;
190     opt.server_name         = DFL_SERVER_NAME;
191     opt.server_port         = DFL_SERVER_PORT;
192     opt.debug_level         = DFL_DEBUG_LEVEL;
193     opt.permissive          = DFL_PERMISSIVE;
194 
195     for( i = 1; i < argc; i++ )
196     {
197         p = argv[i];
198         if( ( q = strchr( p, '=' ) ) == NULL )
199             goto usage;
200         *q++ = '\0';
201 
202         for( j = 0; p + j < q; j++ )
203         {
204             if( argv[i][j] >= 'A' && argv[i][j] <= 'Z' )
205                 argv[i][j] |= 0x20;
206         }
207 
208         if( strcmp( p, "mode" ) == 0 )
209         {
210             if( strcmp( q, "file" ) == 0 )
211                 opt.mode = MODE_FILE;
212             else if( strcmp( q, "ssl" ) == 0 )
213                 opt.mode = MODE_SSL;
214             else
215                 goto usage;
216         }
217         else if( strcmp( p, "filename" ) == 0 )
218             opt.filename = q;
219         else if( strcmp( p, "ca_file" ) == 0 )
220             opt.ca_file = q;
221         else if( strcmp( p, "crl_file" ) == 0 )
222             opt.crl_file = q;
223         else if( strcmp( p, "ca_path" ) == 0 )
224             opt.ca_path = q;
225         else if( strcmp( p, "server_name" ) == 0 )
226             opt.server_name = q;
227         else if( strcmp( p, "server_port" ) == 0 )
228             opt.server_port = q;
229         else if( strcmp( p, "debug_level" ) == 0 )
230         {
231             opt.debug_level = atoi( q );
232             if( opt.debug_level < 0 || opt.debug_level > 65535 )
233                 goto usage;
234         }
235         else if( strcmp( p, "permissive" ) == 0 )
236         {
237             opt.permissive = atoi( q );
238             if( opt.permissive < 0 || opt.permissive > 1 )
239                 goto usage;
240         }
241         else
242             goto usage;
243     }
244 
245     /*
246      * 1.1. Load the trusted CA
247      */
248     mbedtls_printf( "  . Loading the CA root certificate ..." );
249     fflush( stdout );
250 
251     if( strlen( opt.ca_path ) )
252     {
253         if( ( ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path ) ) < 0 )
254         {
255             mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse_path returned -0x%x\n\n", (unsigned int) -ret );
256             goto exit;
257         }
258 
259         verify = 1;
260     }
261     else if( strlen( opt.ca_file ) )
262     {
263         if( ( ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ) ) < 0 )
264         {
265             mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse_file returned -0x%x\n\n", (unsigned int) -ret );
266             goto exit;
267         }
268 
269         verify = 1;
270     }
271 
272     mbedtls_printf( " ok (%d skipped)\n", ret );
273 
274 #if defined(MBEDTLS_X509_CRL_PARSE_C)
275     if( strlen( opt.crl_file ) )
276     {
277         if( ( ret = mbedtls_x509_crl_parse_file( &cacrl, opt.crl_file ) ) != 0 )
278         {
279             mbedtls_printf( " failed\n  !  mbedtls_x509_crl_parse returned -0x%x\n\n", (unsigned int) -ret );
280             goto exit;
281         }
282 
283         verify = 1;
284     }
285 #endif
286 
287     if( opt.mode == MODE_FILE )
288     {
289         mbedtls_x509_crt crt;
290         mbedtls_x509_crt *cur = &crt;
291         mbedtls_x509_crt_init( &crt );
292 
293         /*
294          * 1.1. Load the certificate(s)
295          */
296         mbedtls_printf( "\n  . Loading the certificate(s) ..." );
297         fflush( stdout );
298 
299         ret = mbedtls_x509_crt_parse_file( &crt, opt.filename );
300 
301         if( ret < 0 )
302         {
303             mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse_file returned %d\n\n", ret );
304             mbedtls_x509_crt_free( &crt );
305             goto exit;
306         }
307 
308         if( opt.permissive == 0 && ret > 0 )
309         {
310             mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse failed to parse %d certificates\n\n", ret );
311             mbedtls_x509_crt_free( &crt );
312             goto exit;
313         }
314 
315         mbedtls_printf( " ok\n" );
316 
317         /*
318          * 1.2 Print the certificate(s)
319          */
320         while( cur != NULL )
321         {
322             mbedtls_printf( "  . Peer certificate information    ...\n" );
323             ret = mbedtls_x509_crt_info( (char *) buf, sizeof( buf ) - 1, "      ",
324                                  cur );
325             if( ret == -1 )
326             {
327                 mbedtls_printf( " failed\n  !  mbedtls_x509_crt_info returned %d\n\n", ret );
328                 mbedtls_x509_crt_free( &crt );
329                 goto exit;
330             }
331 
332             mbedtls_printf( "%s\n", buf );
333 
334             cur = cur->next;
335         }
336 
337         /*
338          * 1.3 Verify the certificate
339          */
340         if( verify )
341         {
342             mbedtls_printf( "  . Verifying X.509 certificate..." );
343 
344             if( ( ret = mbedtls_x509_crt_verify( &crt, &cacert, &cacrl, NULL, &flags,
345                                          my_verify, NULL ) ) != 0 )
346             {
347                 char vrfy_buf[512];
348 
349                 mbedtls_printf( " failed\n" );
350 
351                 mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), "  ! ", flags );
352 
353                 mbedtls_printf( "%s\n", vrfy_buf );
354             }
355             else
356                 mbedtls_printf( " ok\n" );
357         }
358 
359         mbedtls_x509_crt_free( &crt );
360     }
361     else if( opt.mode == MODE_SSL )
362     {
363         /*
364          * 1. Initialize the RNG and the session data
365          */
366         mbedtls_printf( "\n  . Seeding the random number generator..." );
367         fflush( stdout );
368 
369         mbedtls_entropy_init( &entropy );
370         if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
371                                    (const unsigned char *) pers,
372                                    strlen( pers ) ) ) != 0 )
373         {
374             mbedtls_printf( " failed\n  ! mbedtls_ctr_drbg_seed returned %d\n", ret );
375             goto ssl_exit;
376         }
377 
378         mbedtls_printf( " ok\n" );
379 
380 #if defined(MBEDTLS_DEBUG_C)
381         mbedtls_debug_set_threshold( opt.debug_level );
382 #endif
383 
384         /*
385          * 2. Start the connection
386          */
387         mbedtls_printf( "  . SSL connection to tcp/%s/%s...", opt.server_name,
388                                                               opt.server_port );
389         fflush( stdout );
390 
391         if( ( ret = mbedtls_net_connect( &server_fd, opt.server_name,
392                                  opt.server_port, MBEDTLS_NET_PROTO_TCP ) ) != 0 )
393         {
394             mbedtls_printf( " failed\n  ! mbedtls_net_connect returned %d\n\n", ret );
395             goto ssl_exit;
396         }
397 
398         /*
399          * 3. Setup stuff
400          */
401         if( ( ret = mbedtls_ssl_config_defaults( &conf,
402                         MBEDTLS_SSL_IS_CLIENT,
403                         MBEDTLS_SSL_TRANSPORT_STREAM,
404                         MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
405         {
406             mbedtls_printf( " failed\n  ! mbedtls_ssl_config_defaults returned %d\n\n", ret );
407             goto exit;
408         }
409 
410         if( verify )
411         {
412             mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_REQUIRED );
413             mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL );
414             mbedtls_ssl_conf_verify( &conf, my_verify, NULL );
415         }
416         else
417             mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_NONE );
418 
419         mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
420         mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );
421 
422         if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
423         {
424             mbedtls_printf( " failed\n  ! mbedtls_ssl_setup returned %d\n\n", ret );
425             goto ssl_exit;
426         }
427 
428         if( ( ret = mbedtls_ssl_set_hostname( &ssl, opt.server_name ) ) != 0 )
429         {
430             mbedtls_printf( " failed\n  ! mbedtls_ssl_set_hostname returned %d\n\n", ret );
431             goto ssl_exit;
432         }
433 
434         mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
435 
436         /*
437          * 4. Handshake
438          */
439         while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
440         {
441             if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
442             {
443                 mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned %d\n\n", ret );
444                 goto ssl_exit;
445             }
446         }
447 
448         mbedtls_printf( " ok\n" );
449 
450         /*
451          * 5. Print the certificate
452          */
453 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
454         mbedtls_printf( "  . Peer certificate information    ... skipped\n" );
455 #else
456         mbedtls_printf( "  . Peer certificate information    ...\n" );
457         ret = mbedtls_x509_crt_info( (char *) buf, sizeof( buf ) - 1, "      ",
458                                      mbedtls_ssl_get_peer_cert( &ssl ) );
459         if( ret == -1 )
460         {
461             mbedtls_printf( " failed\n  !  mbedtls_x509_crt_info returned %d\n\n", ret );
462             goto ssl_exit;
463         }
464 
465         mbedtls_printf( "%s\n", buf );
466 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
467 
468         mbedtls_ssl_close_notify( &ssl );
469 
470 ssl_exit:
471         mbedtls_ssl_free( &ssl );
472         mbedtls_ssl_config_free( &conf );
473     }
474     else
475         goto usage;
476 
477     exit_code = MBEDTLS_EXIT_SUCCESS;
478 
479 exit:
480 
481     mbedtls_net_free( &server_fd );
482     mbedtls_x509_crt_free( &cacert );
483 #if defined(MBEDTLS_X509_CRL_PARSE_C)
484     mbedtls_x509_crl_free( &cacrl );
485 #endif
486     mbedtls_ctr_drbg_free( &ctr_drbg );
487     mbedtls_entropy_free( &entropy );
488 
489 #if defined(_WIN32)
490     mbedtls_printf( "  + Press Enter to exit this program.\n" );
491     fflush( stdout ); getchar();
492 #endif
493 
494     mbedtls_exit( exit_code );
495 }
496 #endif /* MBEDTLS_BIGNUM_C && MBEDTLS_ENTROPY_C && MBEDTLS_SSL_TLS_C &&
497           MBEDTLS_SSL_CLI_C && MBEDTLS_NET_C && MBEDTLS_RSA_C &&
498           MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_FS_IO && MBEDTLS_CTR_DRBG_C */
499