Openssl Server C Demo

Posted 2023-02-05 小米渣的逆袭

证书生成

rootPath=$(cd "$(dirname "$0")"; pwd)
#删除打包数据目录
OUTPUT=$rootPath/build
rm -drf $OUTPUT
mkdir $OUTPUT 

# 生成CA证书
echo "-----------------------------生成CA证书----------------------------------"
name="standard_ca"
openssl genrsa -out $OUTPUT/$name.key 2048  
openssl req -new -key $OUTPUT/$name.key -out $OUTPUT/$name.req -subj /C=CN/ST=JS/L=NJ/O=NJ/CN="127.0.0.1"
openssl x509 -req -days 3650 -in $OUTPUT/$name.req -extfile ./openssl.cnf -extensions v3_ca -signkey $OUTPUT/$name.key -out $OUTPUT/$name.cer
openssl x509 -in $OUTPUT/$name.cer -text -noout  
rm -f $OUTPUT/$name.req

echo "-----------------------------Server签名证书----------------------------------"
# Server签名证书
name="standard_server_sign"
openssl genrsa -out $OUTPUT/$name.key 2048  
openssl req -new -key $OUTPUT/$name.key -out $OUTPUT/$name.req -subj /C=CN/ST=JS/L=NJ/O=NJ/CN="127.0.0.1"
openssl x509 -req -days 3650 -in $OUTPUT/$name.req -extfile ./openssl.cnf -extensions v3_req -CA $OUTPUT/standard_ca.cer -CAkey $OUTPUT/standard_ca.key -set_serial 1000000001 -extfile $rootPath/openssl.cnf -out $OUTPUT/$name.cer  
openssl x509 -in $OUTPUT/$name.cer -text -noout  
rm -f $OUTPUT/$name.req


echo "-----------------------------客户端证书----------------------------------"
# 客户端证书
name="standard_client"
openssl genrsa -out $OUTPUT/$name.key 2048  
openssl req -new -key $OUTPUT/$name.key -out $OUTPUT/$name.req -subj /C=CN/ST=JS/L=NJ/O=NJ/CN="127.0.0.1"
openssl x509 -req -days 3650 -in $OUTPUT/$name.req -extfile ./openssl.cnf -extensions v3_req -CA $OUTPUT/standard_ca.cer -CAkey $OUTPUT/standard_ca.key -set_serial 1000000001 -extfile $rootPath/openssl.cnf -out $OUTPUT/$name.cer  
openssl x509 -in $OUTPUT/$name.cer -text -noout  
rm -f $OUTPUT/$name.req

服务端代码

// HttpSvrDemo.cpp : 定义控制台应用程序的入口点。
//


#include <stdio.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#pragma comment(lib,"Ws2_32.lib")
#pragma comment(lib,"User32.lib")
#pragma comment(lib,"Advapi32.lib")
#pragma comment(lib,"Gdi32.lib")
#include <openssl\\\\ssl.h>
//#pragma comment(lib,"libeay32.lib")
//#pragma comment(lib,"ssleay32.lib")

#pragma warning(disable: 4996)

#define CERTF   "C:\\\\Users\\\\wjr\\\\Downloads\\\\standard_server_sign.cer"
#define KEYF    "C:\\\\Users\\\\wjr\\\\Downloads\\\\standard_server_sign.key"
#define CA		"C:\\\\Users\\\\wjr\\\\Downloads\\\\standard_ca.cer"



// 这是一个 https 服务端 Demo
int main()
	
	WSADATA wsaData;
	sockaddr_in service =  0 ;
	SOCKET ListenSocket = INVALID_SOCKET;
	SOCKET AcceptSocket = INVALID_SOCKET;

	// 1.初始化 WSA 相关函数
	int err = WSAStartup(MAKEWORD(2, 2), &wsaData);
	if (err != 0)
	
		/* Tell the user that we could not find a usable */
		/* Winsock DLL.                                  */
		printf("WSAStartup failed with error: %d\\n", err);
		return -1;
	

	// 2.初始化静态库 加载错误字符 加载算法库
	SSL_library_init();
	SSL_load_error_strings();
	SSLeay_add_ssl_algorithms();

	// 3.绑定本地端口并监听 ---- 摘自 MSDN
	ListenSocket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (ListenSocket == INVALID_SOCKET)
	
		wprintf(L"socket function failed with error: %ld\\n", WSAGetLastError());
			
	
	//----------------------
	// The sockaddr_in structure specifies the address family,
	// IP address, and port for the socket that is being bound.
	service.sin_family = AF_INET;
	service.sin_addr.s_addr = inet_addr("127.0.0.1");
	service.sin_port = htons(28801);

	int iResult = bind(ListenSocket, (SOCKADDR*)&service, sizeof(service));
	if (iResult == SOCKET_ERROR)
	
		wprintf(L"bind function failed with error %d\\n", WSAGetLastError());			
	
	if (listen(ListenSocket, SOMAXCONN) == SOCKET_ERROR)
	
		wprintf(L"listen function failed with error: %d\\n", WSAGetLastError());			
	
	wprintf(L"Listening on socket...\\n");

	// 4.等待建立连接
	while (TRUE)
			
		AcceptSocket = accept(ListenSocket, NULL, NULL);
		if (AcceptSocket == INVALID_SOCKET)
		
			wprintf(L"accept failed with error: %ld\\n", WSAGetLastError());
			closesocket(ListenSocket);
			WSACleanup();
			return -1;
		
		else
		
			wprintf(L"Client connected.\\n");
		

		// 4.1将套接字与证书绑定

		const SSL_METHOD* meth = SSLv23_server_method();
		SSL_CTX* ctx = SSL_CTX_new(meth);

		 要求校验对方证书
		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);

		加载CA
		if (SSL_CTX_load_verify_locations(ctx, CA, NULL) <= 0)
		
			wprintf(L"SSL_CTX_use_certificate_file failed.\\n");
			closesocket(AcceptSocket);
			continue;
		

		if (SSL_CTX_use_certificate_file(ctx, CERTF, SSL_FILETYPE_PEM) <= 0)
		
			wprintf(L"SSL_CTX_use_certificate_file failed.\\n");
			closesocket(AcceptSocket);
			continue;
		

		if (SSL_CTX_use_PrivateKey_file(ctx, KEYF, SSL_FILETYPE_PEM) <= 0)
		
			wprintf(L"SSL_CTX_use_PrivateKey_file failed.\\n");
			closesocket(AcceptSocket);
			continue;
		
		if (SSL_CTX_check_private_key(ctx) <= 0) 
		
			wprintf(L"Private key does not match the certificate public key\\n");
			closesocket(AcceptSocket);
			continue;
		
		SSL* ssl = SSL_new(ctx);
		SSL_set_fd(ssl, AcceptSocket);
		if (SSL_accept(ssl) == -1)
		
			int n = SSL_get_error(ssl, -1);					
			const char* p1 = SSL_state_string_long(ssl);
			printf("错误代码:%s\\r\\n", SSL_state_string_long(ssl));
			closesocket(AcceptSocket);
			continue;
		

		// 4.2从SSL套接字读取数据
		char  buf[4096] =  0 ;
		int sslRead = SSL_read(ssl, buf, 4095);		
		printf("%s\\n", buf);

		// 4.3往SSL套接字写入数据
		char szTemp[400] = "HTTP/1.1 200 OK\\r\\nServer: bfe/1.0.8.14\\r\\nDate: Mon, 29 Feb 2016 06:21:46 GMT\\r\\nContent-Type: text/html\\r\\nContent-Length: 70\\r\\nConnection: keep-alive\\r\\n\\r\\n<html>\\r\\n<head><title>200 Ok</title></head><body> 200 OK </body></html>";
		int nCount = strlen(szTemp);
		int nRet = 0;
		do
		
			nRet += SSL_write(ssl, szTemp, nCount);
			if (nRet >= nCount)
			
				break;
			
		 while (true);		
		closesocket(AcceptSocket);
		AcceptSocket = INVALID_SOCKET;
	
	closesocket(ListenSocket);
	return 0;