TLS1.3上的网络数据包读取问题|Openssl C语言程序

xuo3flqw  于 2022-11-14  发布在  其他
关注(0)|答案(1)|浏览(247)

openssl_1.1.1_perl_dump.txt
我们正在尝试升级Openssl版本1.1.1，安全层从TLS 1.2升级到TLS 1.3。
我们的代码库执行SSL握手，然后使用send & read/recv函数传输数据。* 注意-它在TLS 1.2中运行良好。但是，当我们切换到TLS 1.3时，send & read/recv无法接收数据包，但仅在使用SSL_write和SSL_read时才能正常工作。
下面我们试着制作一个服务器和客户端程序的例子，在成功的SSL连接后，我们使用send & read/recv函数，在这里它也适用于TLS 1.2，但是在TLS 1.3的情况下，收到的数据包会有延迟，服务器的第一个响应是空白的，请参考下面的输出configdata.pm。使用本参考文章https://help.ubuntu.com/community/OpenSSL中提到的步骤创建SSL证书。
server.c

  1. #include <errno.h>
  2. #include <unistd.h>
  3. #include <malloc.h>
  4. #include <string.h>
  5. #include <arpa/inet.h>
  6. #include <sys/socket.h>
  7. #include <sys/types.h>
  8. #include <netinet/in.h>
  9. #include <resolv.h>
  10. #include "/usr/include/openssl/ssl.h"
  11. #include "/usr/include/openssl/crypto.h"
  12. #include "/usr/include/openssl/err.h"
  14. #define FAIL    -1
  16. int OpenListener(int port)
  17. {   int sd;
  18.     struct sockaddr_in addr;
  20.     sd = socket(PF_INET, SOCK_STREAM, 0);
  21.     bzero(&addr, sizeof(addr));
  22.     addr.sin_family = AF_INET;
  23.     addr.sin_port = htons(port);
  24.     addr.sin_addr.s_addr = INADDR_ANY;
  25.     if ( bind(sd, (struct sockaddr*)&addr, sizeof(addr)) != 0 )
  26.     {
  27.         perror("can't bind port");
  28.         abort();
  29.     }
  30.     if ( listen(sd, 10) != 0 )
  31.     {
  32.         perror("Can't configure listening port");
  33.         abort();
  34.     }
  35.     return sd;
  36. }
  38. int isRoot()
  39. {
  40.     if (getuid() != 0)
  41.     {
  42.         return 0;
  43.     }
  44.     else
  45.     {
  46.         return 1;
  47.     }
  49. }
  50. SSL_CTX* InitServerCTX(void)
  51. {   SSL_METHOD *method;
  52.     SSL_CTX *ctx;
  54.     OpenSSL_add_all_algorithms();  /* load & register all cryptos, etc. */
  55.     SSL_load_error_strings();   /* load all error messages */
  57.     char *imethod=getenv("TLS_METHOD");
  58.     if(imethod!=NULL && strncmp(imethod, "1.3", 3)==0){
  59.        printf("\nSetting TLS1.3 method\n");
  60.        fflush(stdout);
  61.        method = TLS_server_method();  /* create new server-method instance */
  62.     }
  63.     else{
  64.        printf("\nSetting TLS1.2 method\n");
  65.        fflush(stdout);
  66.        method = TLSv1_2_server_method();  /* create new server-method instance */
  67.     }
  68.     ctx = SSL_CTX_new(method);   /* create new context from method */
  69.     if ( ctx == NULL )
  70.     {
  71.         ERR_print_errors_fp(stderr);
  72.         abort();
  73.     }
  75.     if(imethod!=NULL && strncmp(imethod, "1.3", 3)==0)
  76.       SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2);
  78.     return ctx;
  79. }
  81. void LoadCertificates(SSL_CTX* ctx, char* CertFile, char* KeyFile)
  82. {
  83.     SSL_CTX_load_verify_locations(ctx, "01.pem", "/home/qarun/aparopka/myCA/signedcerts");
  84.     /* set the local certificate from CertFile */
  85.     if ( SSL_CTX_use_certificate_file(ctx, CertFile, SSL_FILETYPE_PEM) <= 0 )
  86.     {
  87.         ERR_print_errors_fp(stderr);
  88.         abort();
  89.     }
  90.     /* set the private key from KeyFile (may be the same as CertFile) */
  91.     if ( SSL_CTX_use_PrivateKey_file(ctx, KeyFile, SSL_FILETYPE_PEM) <= 0 )
  92.     {
  93.         ERR_print_errors_fp(stderr);
  94.         abort();
  95.     }
  96.     /* verify private key */
  97.     if ( !SSL_CTX_check_private_key(ctx) )
  98.     {
  99.         fprintf(stderr, "Private key does not match the public certificate\n");
  100.         abort();
  101.     }
  103.     //New lines - Force the client-side have a certificate
  104.     /*SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, NULL);
  105.     SSL_CTX_set_verify_depth(ctx, 2);*/
  106.     //End new lines
  107. }
  109. void ShowCerts(SSL* ssl)
  110. {   X509 *cert;
  111.     char *line;
  113.     cert = SSL_get_peer_certificate(ssl); /* Get certificates (if available) */
  114.     if ( cert != NULL )
  115.     {
  116.         printf("Server certificates:\n");
  117.         line = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
  118.         printf("Subject: %s\n", line);
  119.         free(line);
  120.         line = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
  121.         printf("Issuer: %s\n", line);
  122.         free(line);
  123.         X509_free(cert);
  124.     }
  125.     else
  126.         printf("No certificates.\n");
  127. }
  129. void Servlet(SSL* ssl) /* Serve the connection -- threadable */
  130. {   char buf[1024];
  131.     char reply[1024];
  132.     int sd, bytes;
  133.     const char* HTMLecho="<html><body><pre>%s</pre></body></html>\n\n";
  135.     sd = SSL_get_fd(ssl);       /* get socket connection */
  136.     printf("\nsd: <%d>", sd);
  137.     if ( SSL_accept(ssl) == FAIL )     /* do SSL-protocol accept */
  138.         ERR_print_errors_fp(stderr);
  139.     else
  140.     {
  141.         /*if(SSL_do_handshake(ssl) <= 0){
  142.             printf("\n SSL_do_handshake failed....\n");
  143.         }*/
  144.         ShowCerts(ssl);        /* get any certificates */
  145.         do{
  146.                 //bytes = SSL_read(ssl, buf, sizeof(buf)); /* get request */
  147.                 //bytes = read(sd, buf, sizeof(buf));
  148.                 bytes = recv(sd, buf, sizeof(buf), 0);
  149.                 if ( bytes > 0 )
  150.                 {
  151.                         buf[bytes] = 0;
  152.                         printf("Client msg: \"%s\"\n", buf);
  153.                         sprintf(reply, HTMLecho, buf);   /* construct reply */
  154.                         //SSL_write(ssl, reply, strlen(reply)); /* send reply */
  155.                         send(sd, reply, strlen(reply), 0); // MSG_NOSIGNAL | MSG_DONTWAIT); //MSG_CONFIRM);
  156.                 }
  157.                 else
  158.                         ERR_print_errors_fp(stderr);
  159.         }while(bytes>0);
  160.     }
  161.     SSL_free(ssl);         /* release SSL state */
  162.     close(sd);          /* close connection */
  163. }
  165. int main(int count, char *strings[])
  166. {   SSL_CTX *ctx;
  167.     int server;
  168.     char *portnum;
  170.     if(!isRoot())
  171.     {
  172.         printf("This program must be run as root/sudo user!!");
  173.         //exit(0);
  174.     }
  175.     if ( count != 2 )
  176.     {
  177.         printf("Usage: %s <portnum>\n", strings[0]);
  178.         exit(0);
  179.     }
  180.     SSL_library_init();
  182.     portnum = strings[1];
  183.     ctx = InitServerCTX();        /* initialize SSL */
  184.     LoadCertificates(ctx, "/home/qarun/aparopka/myCA/server_crt.pem", "/home/qarun/aparopka/myCA/server_key.pem"); /* load certs */
  185.     server = OpenListener(atoi(portnum));    /* create server socket */
  186.     while (1)
  187.     {   struct sockaddr_in addr;
  188.         socklen_t len = sizeof(addr);
  189.         SSL *ssl;
  191.         int client = accept(server, (struct sockaddr*)&addr, &len);  /* accept connection as usual */
  192.         printf("Connection: %s:%d\n",inet_ntoa(addr.sin_addr), ntohs(addr.sin_port));
  193.         ssl = SSL_new(ctx);              /* get new SSL state with context */
  194.         SSL_set_fd(ssl, client);      /* set connection socket to SSL state */
  195.         Servlet(ssl);         /* service connection */
  196.     }
  197.     close(server);          /* close server socket */
  198.     SSL_CTX_free(ctx);         /* release context */
  199. }

client.c

  1. #include <stdio.h>
  2. #include <errno.h>
  3. #include <unistd.h>
  4. #include <malloc.h>
  5. #include <string.h>
  6. #include <sys/socket.h>
  7. #include <resolv.h>
  8. #include <netdb.h>
  9. #include <openssl/ssl.h>
  10. #include <openssl/err.h>
  12. #define FAIL    -1
  14. //Added the LoadCertificates how in the server-side makes.
  15. void LoadCertificates(SSL_CTX* ctx, char* CertFile, char* KeyFile)
  16. {
  17.  /* set the local certificate from CertFile */
  18.     if ( SSL_CTX_use_certificate_chain_file(ctx, CertFile ) <= 0 )
  19.     {
  20.         ERR_print_errors_fp(stderr);
  21.         abort();
  22.     }
  23.     /* set the private key from KeyFile (may be the same as CertFile) */
  24.     if ( SSL_CTX_use_PrivateKey_file(ctx, KeyFile, SSL_FILETYPE_PEM) <= 0 )
  25.     {
  26.         ERR_print_errors_fp(stderr);
  27.         abort();
  28.     }
  29.     /* verify private key */
  30.     if ( !SSL_CTX_check_private_key(ctx) )
  31.     {
  32.         fprintf(stderr, "Private key does not match the public certificate\n");
  33.         abort();
  34.     }
  35. }
  37. int OpenConnection(const char *hostname, int port)
  38. {   int sd;
  39.     struct hostent *host;
  40.     struct sockaddr_in addr;
  42.     if ( (host = gethostbyname(hostname)) == NULL )
  43.     {
  44.         perror(hostname);
  45.         abort();
  46.     }
  47.     sd = socket(PF_INET, SOCK_STREAM, 0);
  48.     bzero(&addr, sizeof(addr));
  49.     addr.sin_family = AF_INET;
  50.     addr.sin_port = htons(port);
  51.     addr.sin_addr.s_addr = *(long*)(host->h_addr);
  52.     if ( connect(sd, (struct sockaddr*)&addr, sizeof(addr)) != 0 )
  53.     {
  54.         close(sd);
  55.         perror(hostname);
  56.         abort();
  57.     }
  58.     return sd;
  59. }
  61. SSL_CTX* InitCTX(void)
  62. {   SSL_METHOD *method;
  63.     SSL_CTX *ctx;
  65.     OpenSSL_add_all_algorithms();  /* Load cryptos, et.al. */
  66.     SSL_load_error_strings();   /* Bring in and register error messages */
  67.     char *imethod=getenv("TLS_METHOD");
  68.     if(imethod!=NULL && strncmp(imethod, "1.3", 3)==0){
  69.        printf("\nSetting TLS1.3 method\n");
  70.        fflush(stdout);
  71.        method = TLS_client_method();  /* create new server-method instance */
  72.     }
  73.     else{
  74.        printf("\nSetting TLS1.2 method\n");
  75.        fflush(stdout);
  76.        method = TLSv1_2_client_method();  /* create new server-method instance */
  77.     }
  79.     ctx = SSL_CTX_new(method);   /* Create new context */
  80.     if ( ctx == NULL )
  81.     {
  82.         ERR_print_errors_fp(stderr);
  83.         abort();
  84.     }
  86.     if(imethod!=NULL && strncmp(imethod, "1.3", 3)==0)
  87.         SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2);
  89.     return ctx;
  90. }
  92. void ShowCerts(SSL* ssl)
  93. {   X509 *cert;
  94.     char *line;
  96.     cert = SSL_get_peer_certificate(ssl); /* get the server's certificate */
  97.     if ( cert != NULL )
  98.     {
  99.         printf("Server certificates:\n");
  100.         line = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
  101.         printf("Subject: %s\n", line);
  102.         free(line);       /* free the malloc'ed string */
  103.         line = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
  104.         printf("Issuer: %s\n", line);
  105.         free(line);       /* free the malloc'ed string */
  106.         X509_free(cert);     /* free the malloc'ed certificate copy */
  107.     }
  108.     else
  109.         printf("Info: No client certificates configured.\n");
  110. }
  112. int main(int count, char *strings[])
  113. {   SSL_CTX *ctx;
  114.     int server;
  115.     SSL *ssl;
  116.     char buf[1024];
  117.     int bytes;
  118.     char *hostname, *portnum;
  120.     if ( count != 3 )
  121.     {
  122.         printf("usage: %s <hostname> <portnum>\n", strings[0]);
  123.         exit(0);
  124.     }
  125.     SSL_library_init();
  126.     hostname=strings[1];
  127.     portnum=strings[2];
  129.     ctx = InitCTX();
  130.     LoadCertificates(ctx, "/home/qarun/aparopka/myCA/server_crt.pem", "/home/qarun/aparopka/myCA/server_key.pem");
  131.     server = OpenConnection(hostname, atoi(portnum));
  132.     ssl = SSL_new(ctx);      /* create new SSL connection state */
  133.     SSL_set_fd(ssl, server);    /* attach the socket descriptor */
  134.     int sd = SSL_get_fd(ssl);
  135.     int flip=1;
  136.     printf("\nsd: <%d>", sd);
  137.     if ( SSL_connect(ssl) == FAIL )   /* perform the connection */
  138.         ERR_print_errors_fp(stderr);
  139.     else
  140.     {   //char *msg = "Hello???";
  141.         if(SSL_do_handshake(ssl) <= 0){
  142.             printf("\n client SSL_do_handshake failed....\n");
  143.         }
  144.         char msg[1024];
  145.         printf("Connected with %s encryption\n", SSL_get_cipher(ssl));
  146.         ShowCerts(ssl);        /* get any certs */
  147.         while(1){
  148.                 bzero(msg, 1024);
  149.                 bzero(buf, 1024);
  150.                 printf("\nEnter message: ");
  151.                 fgets(msg, 1024, stdin);
  152.                 //SSL_write(ssl, msg, strlen(msg));   /* encrypt & send message */
  153.                 send(sd, msg, strlen(msg),  0); //MSG_NOSIGNAL | MSG_DONTWAIT); //MSG_CONFIRM);
  155.                 //bytes = SSL_read(ssl, buf, sizeof(buf)); /* get reply & decrypt */
  156.                 //bytes = read(sd, buf, sizeof(buf));
  157.                 bytes = recv(sd, buf, sizeof(buf), 0);
  159.                   /* read again for TLS 1.3 only for first time */
  160.                   /*char *imethod=getenv("TLS_METHOD");
  161.                   if(imethod!=NULL && strncmp(imethod, "1.3", 3)==0
  162.                        && flip){
  163.                       bytes = read(sd, buf, sizeof(buf));
  164.                       flip=0;
  165.                   }*/
  167.                 buf[bytes] = 0;
  168.                 printf("Received: \"%s\"\n", buf);
  169.         }
  170.         SSL_free(ssl);        /* release connection state */
  171.     }
  172.     close(server);         /* close socket */
  173.     SSL_CTX_free(ctx);        /* release context */
  174.     return 0;
  175. }

TLS 1.2的服务器和客户端输出

  1. **$ ./ssl_server_working 2023**
  2. Setting TLS1.2 method
  3. Connection: 10.250.14.23:41152
  5. sd: <4>No certificates.
  6. Client msg: "first
  7. "
  8. Client msg: "second
  9. "
  10. Client msg: "third
  11. "
  13.  **./ssl_client_working 10.250.14.23 2023**
  15. Setting TLS1.2 method
  17. sd: <3>Connected with ECDHE-RSA-AES256-GCM-SHA384 encryption
  18. Server certificates:
  19. Subject: /CN=MyOwn Root Certificate Authority/ST=CA/C=US/emailAddress=amit.paropkari@quest.com/O=SharePlex/OU=IT Department
  20. Issuer: /CN=MyOwn Root Certificate Authority/ST=CA/C=US/emailAddress=amit.paropkari@quest.com/O=SharePlex/OU=IT Department
  22. Enter message: first
  23. Received: "<html><body><pre>first
  24. </pre></body></html>
  26. "
  28. Enter message: second
  29. Received: "<html><body><pre>second
  30. </pre></body></html>
  32. "
  34. Enter message: third
  35. Received: "<html><body><pre>third
  36. </pre></body></html>
  38. "

TLS 1.3的服务器和客户端输出：请注意，第一个客户端请求的响应为空，它将在第二个请求的下一个响应中接收。

  1. export TLS_METHOD=1.3
  2.  **./ssl_server_working 2024**
  3. Setting TLS1.3 method
  4. Connection: 10.250.14.23:34012
  6. sd: <4>No certificates.
  7. Client msg: "first
  8. "
  9. Client msg: "second
  10. "
  11. Client msg: "third
  12. "
  14. **./ssl_client_working 10.250.14.23 2024**
  16. Setting TLS1.3 method
  18. sd: <3>Connected with TLS_AES_256_GCM_SHA384 encryption
  19. Server certificates:
  20. Subject: /CN=MyOwn Root Certificate Authority/ST=CA/C=US/emailAddress=amit.paropkari@quest.com/O=SharePlex/OU=IT Department
  21. Issuer: /CN=MyOwn Root Certificate Authority/ST=CA/C=US/emailAddress=amit.paropkari@quest.com/O=SharePlex/OU=IT Department
  23. Enter message: first
  24. Received: ""
  26. Enter message: second
  27. Received: "<html><body><pre>first
  28. </pre></body></html>
  30. "
  32. Enter message: third
  33. Received: "<html><body><pre>second
  34. </pre></body></html>
  36. "
ssl

1条答案

按热度按时间
nxagd54h

nxagd54h1#

我们得到了这个问题的答案。原来TLS 1.3增加了一个握手步骤，在服务器完成消息之后，客户端再次发送服务器完成消息，服务器验证它，并发送握手后协议级别的消息，称为'NewSessionTicket消息'。我们可以在启动SSL服务器之前，使用SSL_CTX_set_num_tickets方法禁用它。

  1. SSL_set_num_tickets(ssl, 0);       /* Disable post-handshake token */
  2. sd = SSL_get_fd(ssl);              /* get socket connection */
  3. if ( SSL_accept(ssl) == FAIL )     /* do SSL-protocol accept */
  4.     ERR_print_errors_fp(stderr);

对于担心这样做不安全的人来说，在我们的需求中，我们只需要初始的安全认证，然后我们进行会话隧道。在此之后，如果我们对每个事务使用SSL_write SSL_read（这些事务的数量和时间都很大），加密解密步骤将降低性能。因此，我们使用send & recv发送数据。

赞(0）分享  回复(0）举报  2022-11-14
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com