c中用socket传输和验证证书（openssl）

Question

我必须用c 编写这些代码。我已经生成了一个终止t1的证书：t1.pem，它是由openssl生成的。终端 t1 和 t2 之间的通信已通过 c 中的套接字建立。

现在我想将此证书发送到另一个终止 t2。并且我希望 t2 接收该证书，验证它并向 t1 作出接受答复。当 t1 获得接受时，剩下的事情就会发生。

但我不知道如何做这些事情。

例如我将t1.pem作为字符串传输？但在t2端，我该如何验证呢？我知道openssl中有这样做的函数，但我不太清楚。最后，正常情况下，验收应该是怎样的呢？

@[email protected] 这里有很多问题.. 抱歉...如果有人可以给我一些指导.. 预先非常感谢！

Answer 1

如果您尝试使用 openssl 建立通信，请查看此 OpenSSL 教程。

Answer 2

这是给您的一些起始注释...

server
{
    SSL_CTX_new()
    SSL_CTX_* set_cipher_list,set_mode,set_options
    SSL_CTX_* set_default_passwd_cb,use_certificate_file,use_PrivateKey_file etc

    SSL_new()
    SSL_set_fd(,socket)    
    SSL_set_accept_state()

    SSL_read()/SSL_write()

    SSL_shutdown()        
    SSL_free()

    SSL_CTX_free()
}

client
{
    SSL_CTX_new()
    SSL_CTX_* set_cipher_list,set_mode,options
    SSL_CTX_* load_verify_locations,set_verify etc

    SSL_new()
    SSL_set_fd(,socket)
    SSL_set_connect_state()

    SSL_read()/SSL_write()

    SSL_shutdown()
    SSL_free()

    SSL_CTX_free()
}

Answer 3

下面是一个示例代码，应该可以帮助您：

服务器

#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

int main()
{
int server_sockfd, client_sockfd;
int server_len, client_len;
struct sockaddr_in server_address;
struct sockaddr_in client_address;

int result = 0;
//ssl initiation
SSL_library_init();
SSL_load_error_strings();
SSL_METHOD *meth = SSLv3_server_method();
SSL_CTX *ctx = SSL_CTX_new(meth);

SSL_CTX_use_certificate_file(ctx, "server_crt.pem", SSL_FILETYPE_PEM);
SSL_CTX_use_PrivateKey_file(ctx, "server_key.pem", SSL_FILETYPE_PEM);



//unnamed socket
server_sockfd = socket(AF_INET, SOCK_STREAM, 0);

//naming
server_address.sin_family = AF_INET;
server_address.sin_addr.s_addr = htonl(INADDR_ANY);
server_address.sin_port = htons(9734);
server_len = sizeof(server_address);
result = bind(server_sockfd, (struct sockaddr *)&server_address, server_len);

if(result<0)
{
    printf("\nBinding Error");
}

//connection
listen(server_sockfd, 5);
while(1)
{
    char ch;
    printf("server waiting\n");

//accept connection

    client_len = sizeof(client_address);
    client_sockfd = accept(server_sockfd, (struct sockaddr *)&client_address, &client_len);
    printf("\nConnected\n");
    SSL* ssl;
    ssl = SSL_new(ctx);
    SSL_set_fd(ssl, client_sockfd);

//handshake

    SSL_accept(ssl);
    printf("\nHandshake Done\n");

//exchage message
    result = SSL_read(ssl, &ch, sizeof(ch));

    if(result<0)
    {
        printf("\nreading Error");
    }
    ++ch;
    result = SSL_write(ssl, &ch, sizeof(ch));


    if(result<0)
    {
        printf("\nwriting Error");
    }

    close(client_sockfd);
}
}

客户端

#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

void check_cert(SSL* ssl)
{

//ssl initiation
/*SSL_library_init();
SSL_load_error_strings();
const SSL_METHOD *meth;
meth = SSLv3_method();
SSL_CTX *ctx;
SSL *_ssl;
ctx = SSL_CTX_new(meth);*/

}

int main()
{
int sockfd;
int len;
struct sockaddr_in address;
int result=0;
char ch = 'A';


//ssl initiation
SSL_library_init();
SSL_load_error_strings();
SSL_METHOD *meth;
meth = SSLv3_client_method();
SSL_CTX *ctx;
SSL* ssl;
ctx = SSL_CTX_new(meth);    
result = SSL_CTX_load_verify_locations(ctx, "cacert.pem", 0);
//result = SSL_CTX_load_verify_locations(ctx, NULL, "/home/cdac/Desktop/test/cert");
printf("\nCA load result = %d\n", result);
printf("\nSSL initialized");

//socket for client
sockfd = socket(AF_INET, SOCK_STREAM, 0);

//naming socket
address.sin_family = AF_INET;
address.sin_addr.s_addr = inet_addr("127.0.0.1");
address.sin_port = htons(9734);
len = sizeof(address);
printf("length====\n%d",len);
printf("Socket done\n");





//connecting server
result = connect(sockfd, (struct sockaddr *)&address, len);
if(result <0)
{
    perror("oops: client\n");
    exit(1);
}
else
{
    printf("Socket Connected\n");
}

//ssl-ing the connection
ssl = SSL_new(ctx);
BIO *sbio;
sbio = BIO_new(BIO_s_socket());
BIO_set_fd(sbio, sockfd, BIO_NOCLOSE);
SSL_set_bio(ssl, sbio, sbio);
//SSL_CTX_set_verify_depth(ctx, 1);
//SSL_set_fd(ssl, sockfd);
result = SSL_connect(ssl);
printf("SSL_connect: %d\n", result);


if(SSL_get_peer_certificate(ssl)!=NULL)
{


//check cert
    //check_cert(ssl);
    //getting the CA certificate



    //_ssl = SSL_new(ctx);
    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);


    int result_long = SSL_get_verify_result(ssl);
    printf("\nCertificate Check Result: %d", result_long);
    if (SSL_get_verify_result(ssl) != X509_V_OK)
        {
            printf("\nCertiticate Verification Failed\n");
            return 0;
            //exit(1);
        }
        else
        {
            printf("\nCertiticate Verification Succeeded");
        }

}
//taking input

printf("\nSay Char: \n");
scanf("%c",&ch);

//exchanging data

SSL_write(ssl, &ch, 1);
SSL_read(ssl, &ch, 1);
printf("char from server = %c\n", ch);
SSL_shutdown(ssl);  
close(sockfd);
exit(0);
}

这些代码简单且不言自明。