OpenSSL编程实例.doc

客户端程序

// OpenSSLClient.cpp

#include

#include

using namespace std;

#pragma comment (lib, "Ws2_32.lib")

#include "openssl/ssl.h"

#pragma comment(lib, "ssleay32.lib")

#pragma comment(lib, "libeay32.lib")

#define SERVICE_PORT 10000

const int nBufSize = 512;

// 初始化2.2版本Winsock

int InitWinsock(){

WSADATA wsaData = {0};

WORD wVer = MAKEWORD(2,2);

int nRet = WSAStartup(wVer, &wsaData);

if(nRet != 0){

cout<<"Winsock初始化失败，错误代码是"<

}

return nRet;

}

// 创建一个套接字

SOCKET CreateSocket(){

SOCKET hSocket = INVALID_SOCKET;

hSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

if(hSocket == INVALID_SOCKET){

int last_err = WSAGetLastError();

cout<<"创建套接字失败，错误代码是"<

}

return hSocket;

}

// 连接到服务器

int ConnectServer(SOCKET hSocket){

// 填充远程套接字地址

SOCKADDR_IN saServer = {0};

saServer.sin_family = AF_INET;

saServer.sin_port = htons(SERVICE_PORT);

saServer.sin_addr.s_addr = inet_addr("127.0.0.1");

// 使用远程套接字地址连接到服务器

int nRet = connect(hSocket, (SOCKADDR *)&saServer, sizeof(saServer));

if(nRet == SOCKET_ERROR){

int last_err = WSAGetLastError();

cout<<"连接失败，错误代码是"<

}

return nRet;

}

bool InitOpenSSL(){

if(!SSL_library_init())

return false;

SSL_load_error_strings();

return true;

}

int PasswordCB(char *buf, int size, int flag, void *userdata){

// 作者所创建的客户端程序私匙密码是12345678

const char* pass = "12345678";

if(size < strlen(pass) + 1)

return(0);

strcpy(buf, pass);

return(strlen(pass));

}

int VerifyCB(int ok, X509_STORE_CTX *store){

if(!ok){

int err = X509_STORE_CTX_get_error(store);

cout<

}

return ok;

}

SSL_CTX* InitSSLContext(){

const SSL_METHOD *meth = NULL;

SSL_CTX* ctx = NULL;

meth = SSLv23_method();

ctx = SSL_CTX_new(meth);

// 加载客户端程序证书链

if(!SSL_CTX_use_certificate_chain_file(ctx, "ClientAppChain.pem")){ cout<<"加载客户端程序证书链失败"<

return NULL;

}

SSL_CTX_set_default_passwd_cb(ctx, PasswordCB);

// 加载客户端程序私匙文件

if(!SSL_CTX_use_PrivateKey_file(ctx, "ClientApp_PrivateKey.pem",

SSL_FILETYPE_PEM)){

cout<<"加载客户端程序私匙文件失败"<

return NULL;

}

// 加载客户端程序所信任的CA

if(!SSL_CTX_load_verify_locations(ctx, "MyTestCA_Certificate.pem",

NULL)){

cout<<"加载客户端程序所信任的CA失败"<

return NULL;

}

// 加载OpenSSL缺省信任的CA

if(!SSL_CTX_set_default_verify_paths(ctx)){

cout<<" 加载OpenSSL缺省信任的CA失败"<

return NULL;

}

// 我们知道，服务器的证书链是serverApp-->ServerCA-->MyTestCA，

// 所以可以明确验证深度是2，即最多检查ServerCA和MyTestCA两个CA SSL_CTX_set_verify_depth(ctx, 2);

// SSL_VERIFY_PEER要求服务器提供证书，VerifyCB用于输出OpenSSL

// 握手过程中验证服务器证书链失败时的错误信息

SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, VerifyCB);

SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);

return ctx;

}

// 简单的校验，仅检查common name

bool CheckCertificate(SSL* ssl){

X509* cert = SSL_get_peer_certificate(ssl);

if(cert == NULL)

return false;

X509_NAME* subjectName = X509_get_subject_name(cert);

if(subjectName == NULL)

return false;

char buf[256];

if(X509_NAME_get_text_by_NID(subjectName, NID_commonName, buf, 256) >0 ){

if(strcmp(buf, "serverApp") == 0)

return true;

}

return false;

}

void DoWork(SSL* ssl){

char buf[256];

while(true){

if(!fgets(buf, sizeof(buf)/sizeof(buf[0]), stdin)){

SSL_shutdown(ssl);

break;

}

int len = strlen(buf);

int nSent = 0;

while(nSent < len){

int nRet = SSL_write(ssl, buf+nSent, len-nSent);

if(nRet <= 0){

cout<<"SSL_write发生错误"<

SSL_clear(ssl);

break;

}

nSent += nRet;

}

}

}

int main(int argc, char* argv[]){

if(InitWinsock() != 0)

return -1;

SOCKET hSocket = INVALID_SOCKET;

SSL_CTX* ctx = NULL;

SSL* ssl = NULL;

BIO* sbio = NULL;

int nRet = 0;

try{

if(!InitOpenSSL())

throw -1;

ctx = InitSSLContext();

if(ctx == NULL)

throw -1;

ssl = SSL_new(ctx);

hSocket = CreateSocket();

if(hSocket == INVALID_SOCKET)

throw -1;

if(ConnectServer(hSocket) == SOCKET_ERROR)

throw -1;

sbio = BIO_new_socket(hSocket, BIO_NOCLOSE);

SSL_set_bio(ssl, sbio, sbio);

if(SSL_connect(ssl) <= 0){

cout<<"SSL握手发生错误"<

throw -1;

}

if(!CheckCertificate(ssl))

throw -1;

DoWork(ssl);

}

catch(int excpt_err){

nRet = excpt_err;

}

//if(sbio) BIO_free(sbio);

if(ssl) SSL_free(ssl);

if(ctx) SSL_CTX_free(ctx);

if(hSocket != INVALID_SOCKET)

closesocket(hSocket);

WSACleanup();

return 0;

}

----------------------------------------------------

服务器程序

// OpenSSLServer.cpp

#include

#include

using namespace std;

#pragma comment (lib, "Ws2_32.lib")

#include "openssl/ssl.h"

#pragma comment(lib, "ssleay32.lib")

#pragma comment(lib, "libeay32.lib")

#define SERVICE_PORT 10000

const int nBufSize = 512;

// 初始化2.2版本Winsock

int InitWinsock(){

WSADATA wsaData = {0};

WORD wVer = MAKEWORD(2,2);

int nRet = WSAStartup(wVer, &wsaData);

if(nRet != 0){

cout<<"Winsock初始化失败，错误代码是"<

}

return nRet;

}

// 创建一个套接字

SOCKET CreateSocket(){

SOCKET hSocket = INVALID_SOCKET;

hSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

if(hSocket == INVALID_SOCKET){

int last_err = WSAGetLastError();

cout<<"创建套接字失败，错误代码是"<

}

return hSocket;

}

// 绑定和监听

int BindListen(SOCKET hSocket){

// 填充本地套接字地址

sockaddr_in saListen = {0};

saListen.sin_family = AF_INET;

saListen.sin_port = htons(SERVICE_PORT);

saListen.sin_addr.s_addr = htonl(INADDR_ANY);

// 把本地套接字地址绑定到监听套接字

int nRet = bind(hSocket, (sockaddr*)&saListen, sizeof(sockaddr));

if(nRet == SOCKET_ERROR){

int last_err = WSAGetLastError();

cout<<"绑定套接字失败，错误代码是"<

}

else{

// 开始监听

nRet = listen(hSocket, 5);

if(nRet == SOCKET_ERROR){

int last_err = WSAGetLastError();

cout<<"监听失败，错误代码是"<

}

}

return nRet;

}

// 接收连接请求

SOCKET AcceptRequest(SOCKET hSocket){

sockaddr_in saClient = {0};

int nSALen = sizeof(sockaddr);

SOCKET hClientSocket = accept(hSocket, (sockaddr*)&saClient, &nSALen);

if(hClientSocket == INVALID_SOCKET){

int last_err = WSAGetLastError();

cout<<"接受连接请求失败，错误代码是"<

}

return hClientSocket;

}

bool InitOpenSSL(){

if(!SSL_library_init())

return false;

SSL_load_error_strings();

return true;

}

int PasswordCB(char *buf, int size, int flag, void *userdata){

// 作者所创建的服务器程序私匙密码是abcdefgh

const char* pass = "abcdefgh";

if(size < strlen(pass) + 1)

return(0);

strcpy(buf, pass);

return(strlen(pass));

}

int VerifyCB(int ok, X509_STORE_CTX *store){

if(!ok){

int err = X509_STORE_CTX_get_error(store);

cout<

}

return ok;

}

SSL_CTX* InitSSLContext(){

const SSL_METHOD *meth = NULL;

SSL_CTX* ctx = NULL;

meth = SSLv23_method();

ctx = SSL_CTX_new(meth);

// 加载服务器程序证书链

if(!SSL_CTX_use_certificate_chain_file(ctx, "serverAppChain.pem")){

cout<<"加载服务器程序证书链失败"<

return NULL;

}

SSL_CTX_set_default_passwd_cb(ctx, PasswordCB);

// 加载服务器程序私匙文件

if(!SSL_CTX_use_PrivateKey_file(ctx, "ServerApp_PrivateKey.pem",

SSL_FILETYPE_PEM)){

cout<<"加载服务器程序私匙文件失败"<

return NULL;

}

// 加载服务器程序所信任的CA

if(!SSL_CTX_load_verify_locations(ctx, "MyTestCA_Certificate.pem",

NULL)){

cout<<"加载服务器程序所信任的CA失败"<

return NULL;

}

// 加载OpenSSL缺省信任的CA

if(!SSL_CTX_set_default_verify_paths(ctx)){

cout<<" 加载OpenSSL缺省信任的CA失败"<

return NULL;

}

// 我们知道，客户端的证书链是ClientApp-->MyTestCA，

// 所以可以明确验证深度是1，即只检查MyTestCA

SSL_CTX_set_verify_depth(ctx, 1);

// SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT要求客户端提供证书，

// 如果不提供的话，则校验失败。VerifyCB用于输出OpenSSL

// 握手过程中验证客户端证书链失败时的错误信息

SSL_CTX_set_verify(ctx,

SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,

VerifyCB);

SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);

return ctx;

}

// 简单的校验，仅检查common name

bool CheckCertificate(SSL* ssl){

X509* cert = SSL_get_peer_certificate(ssl);

if(cert == NULL)

return false;

X509_NAME* subjectName = X509_get_subject_name(cert);

if(subjectName == NULL)

return false;

char buf[256];

if(X509_NAME_get_text_by_NID(subjectName, NID_commonName, buf, 256) >0 ){

if(strcmp(buf, "ClientApp") == 0)

return true;

}

return false;

}

void DoWork(SSL* ssl){

char buf[256];

while(true){

int nRead = SSL_read(ssl, buf, sizeof(buf)/sizeof(buf[0]) - 1);

if(nRead <= 0){

if(SSL_get_shutdown(ssl) & SSL_RECEIVED_SHUTDOWN){

SSL_shutdown(ssl);

}

else{

SSL_clear(ssl);

}

break;

}

buf[nRead] = 0;

cout<

}

}

int main(int argc, char* argv[]){

if(InitWinsock() != 0)

return -1;

SOCKET hListenSocket = INVALID_SOCKET;

SOCKET hClientSocket = INVALID_SOCKET;

SSL_CTX* ctx = NULL;

SSL* ssl = NULL;

BIO* sbio = NULL;

int nRet = 0;

try{

if(!InitOpenSSL())

throw -1;

ctx = InitSSLContext();

if(ctx == NULL)

throw -1;

ssl = SSL_new(ctx);

hListenSocket = CreateSocket();

if(hListenSocket == INVALID_SOCKET)

throw -1;

if(BindListen(hListenSocket) == SOCKET_ERROR)

throw -1;

hClientSocket = AcceptRequest(hListenSocket);

if(hClientSocket == INVALID_SOCKET)

throw -1;

sbio = BIO_new_socket(hClientSocket, BIO_NOCLOSE);

SSL_set_bio(ssl, sbio, sbio);

if(SSL_accept(ssl) <= 0){

cout<<"SSL握手发生错误"<

throw -1;

}

if(!CheckCertificate(ssl))

throw -1;

DoWork(ssl);

}

catch(int excpt_err){

nRet = excpt_err;

}

//if(sbio) BIO_free(sbio);

if(ssl) SSL_free(ssl);

if(ctx) SSL_CTX_free(ctx);

if(hClientSocket != INVALID_SOCKET) closesocket(hClientSocket);

if(hListenSocket != INVALID_SOCKET) closesocket(hListenSocket);

WSACleanup();

return 0;

}