C++ TLSv1_client_method函数代码示例

/*
 * initialize ssl methods
 */
static void
init_ssl_methods(void)
{
	LM_DBG("entered\n");

	ssl_methods[TLS_USE_TLSv1_cli-1] = (SSL_METHOD*)TLSv1_client_method();
	ssl_methods[TLS_USE_TLSv1_srv-1] = (SSL_METHOD*)TLSv1_server_method();
	ssl_methods[TLS_USE_TLSv1-1] = (SSL_METHOD*)TLSv1_method();

	ssl_methods[TLS_USE_SSLv23_cli-1] = (SSL_METHOD*)SSLv23_client_method();
	ssl_methods[TLS_USE_SSLv23_srv-1] = (SSL_METHOD*)SSLv23_server_method();
	ssl_methods[TLS_USE_SSLv23-1] = (SSL_METHOD*)SSLv23_method();

#if OPENSSL_VERSION_NUMBER >= 0x10001000L
	ssl_methods[TLS_USE_TLSv1_2_cli-1] = (SSL_METHOD*)TLSv1_2_client_method();
	ssl_methods[TLS_USE_TLSv1_2_srv-1] = (SSL_METHOD*)TLSv1_2_server_method();
	ssl_methods[TLS_USE_TLSv1_2-1] = (SSL_METHOD*)TLSv1_2_method();
#endif
}

/*
  Initializes SSL and allocate global
  context SSL_context

  SYNOPSIS
    my_ssl_start
      mysql        connection handle

  RETURN VALUES
    0  success
    1  error
*/
int my_ssl_start(MYSQL *mysql)
{
  int rc= 0;
  DBUG_ENTER("my_ssl_start");
  /* lock mutex to prevent multiple initialization */
  pthread_mutex_lock(&LOCK_ssl_config);
  if (!my_ssl_initialized)
  {
#if OPENSSL_VERSION_NUMBER < 0x10100000
    if (ssl_crypto_init())
      goto end;
#endif
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
#else
    SSL_library_init();
#if SSLEAY_VERSION_NUMBER >= 0x00907000L
    OPENSSL_config(NULL);
#endif
#endif

    /* load errors */
    SSL_load_error_strings();
    /* digests and ciphers */
    OpenSSL_add_all_algorithms();

#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    if (!(SSL_context= SSL_CTX_new(TLS_client_method())))
#else
    if (!(SSL_context= SSL_CTX_new(TLSv1_client_method())))
#endif
    {
      my_SSL_error(mysql);
      rc= 1;
      goto end;
    }
    my_ssl_initialized= TRUE;
  }
end:
  pthread_mutex_unlock(&LOCK_ssl_config);
  DBUG_RETURN(rc);
}

void
_lm_ssl_initialize (LmSSL *ssl) 
{
    static gboolean initialized = FALSE;
    /*const char *cert_file = NULL;*/

    if (!initialized) {
        SSL_library_init();
        /* FIXME: Is this needed when we are not in debug? */
        SSL_load_error_strings();
        initialized = TRUE;
    }

    ssl->ssl_method = TLSv1_client_method();
    if (ssl->ssl_method == NULL) {
        g_warning ("TLSv1_client_method() == NULL");
        abort();
    }
    ssl->ssl_ctx = SSL_CTX_new(ssl->ssl_method);
    if (ssl->ssl_ctx == NULL) {
        g_warning ("SSL_CTX_new() == NULL");
        abort();
    }

    /* Set the NO_TICKET option on the context to allow for talk to Google Talk 
     * which apparently seems to be having a problem handling empty session 
     * tickets due to a bug in Java.
     *
     * See http://twistedmatrix.com/trac/ticket/3463 and
     * Loudmouth [#28].
     */
    SSL_CTX_set_options (ssl->ssl_ctx, SSL_OP_NO_TICKET);

    /*if (access("/etc/ssl/cert.pem", R_OK) == 0)
      cert_file = "/etc/ssl/cert.pem";
      if (!SSL_CTX_load_verify_locations(ssl->ssl_ctx,
      cert_file, "/etc/ssl/certs")) {
      g_warning("SSL_CTX_load_verify_locations() failed");
      }*/
    SSL_CTX_set_default_verify_paths (ssl->ssl_ctx);
    SSL_CTX_set_verify (ssl->ssl_ctx, SSL_VERIFY_PEER, ssl_verify_cb);
}

// Establish a connection using an SSL layer
connection *sslConnect (void)
{
  connection *c;

  c = malloc (sizeof (connection));
  c->sslHandle = NULL;
  c->sslContext = NULL;

  c->socket = tcpConnect ();
  if (c->socket)
    {
      // Register the error strings for libcrypto & libssl
      SSL_load_error_strings ();
      // Register the available ciphers and digests
      SSL_library_init ();
 //     SSL_CTX_set_verify( tlsctx, SSL_VERIFY_PEER, verify_callback );
      // New context saying we are a client, and using SSL 2 or 3
    c->sslContext = SSL_CTX_new (TLSv1_client_method ());
   //   c->sslContext = SSL_CTX_new (TLSv1_client_method());
      if (c->sslContext == NULL)
        ERR_print_errors_fp (stderr);

      // Create an SSL struct for the connection
      c->sslHandle = SSL_new (c->sslContext);
      if (c->sslHandle == NULL)
        ERR_print_errors_fp (stderr);

      // Connect the SSL struct to our connection
      if (!SSL_set_fd (c->sslHandle, c->socket))
        ERR_print_errors_fp (stderr);

      // Initiate SSL handshake
      if (SSL_connect (c->sslHandle) != 1)
        ERR_print_errors_fp (stderr);
    }
  else
    {
      perror ("Connect failed");
    }

  return c;
}

/*
 * initialize ssl methods 
 */
static void
init_ssl_methods(void)
{
	DBG("init_methods: Entered\n");
	ssl_methods[TLS_USE_SSLv2_cli - 1] = SSLv2_client_method();
	ssl_methods[TLS_USE_SSLv2_srv - 1] = SSLv2_server_method();
	ssl_methods[TLS_USE_SSLv2 - 1] = SSLv2_method();
	
	ssl_methods[TLS_USE_SSLv3_cli - 1] = SSLv3_client_method();
	ssl_methods[TLS_USE_SSLv3_srv - 1] = SSLv3_server_method();
	ssl_methods[TLS_USE_SSLv3 - 1] = SSLv3_method();
	
	ssl_methods[TLS_USE_TLSv1_cli - 1] = TLSv1_client_method();
	ssl_methods[TLS_USE_TLSv1_srv - 1] = TLSv1_server_method();
	ssl_methods[TLS_USE_TLSv1 - 1] = TLSv1_method();
	
	ssl_methods[TLS_USE_SSLv23_cli - 1] = SSLv23_client_method();
	ssl_methods[TLS_USE_SSLv23_srv - 1] = SSLv23_server_method();
	ssl_methods[TLS_USE_SSLv23 - 1] = SSLv23_method();
}

SSL_CTX *cr_ssl_context_cli(void)
{
	const SSL_METHOD *meth;
	SSL_CTX *ssl;
	
	/* loading ssl features */

	SSL_load_error_strings();
	OpenSSL_add_all_algorithms();

	SSL_library_init();	
	/* creat a TLSv1 method instance */
	meth = TLSv1_client_method();

	ssl = SSL_CTX_new(meth);
	if(!ssl) {
		ERR_print_errors_fp(stderr);
		return NULL;
	}
	return ssl;
}

void TLSConnectionPrivate::OnConnect(uv_connect_t *connect, int status) {
	TLSConnectionPrivate *cp = static_cast<TLSConnectionPrivate *>(connect->data);
	assert(cp->state_ == TLS_CONNECTION_STATE_PRE_CONNECT);

	// Unable to connect.
	if (status == -1) {
		cp->ShutdownError(UVUtils::ErrorFromLastUVError(cp->loop_));
		return;
	}

	// Begin reading the incoming stream of data.
	int err = uv_read_start(connect->handle, TLSConnectionPrivate::AllocCallback, TLSConnectionPrivate::OnRead);
	if (err != UV_OK) {
		cp->ShutdownError(UVUtils::ErrorFromLastUVError(cp->loop_));
		return;
	}

	// Set up the OpenSSL context
	const SSL_METHOD *meth = TLSv1_client_method();
	cp->ctx_ = SSL_CTX_new(meth);

	SSL_CTX_set_verify(cp->ctx_, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL);
	SSL_CTX_set_cert_verify_callback(cp->ctx_, TLSConnectionPrivate::SSLVerifyCallback, cp);

	cp->ssl_ = SSL_new(cp->ctx_);
	SSL_set_connect_state(cp->ssl_);
	cp->bio_ = BIO_new(UVBioState::GetMethod());
	cp->biostate_ = new UVBioState(connect);
	cp->bio_->ptr = cp->biostate_;
	SSL_set_bio(cp->ssl_, cp->bio_, cp->bio_);

	// Set an empty X509_STORE as our SSL_CTX cert store.
	// The default store should be empty as well, but let's
	// make sure.
	X509_STORE *store = X509_STORE_new();
	SSL_CTX_set_cert_store(cp->ctx_, store);

	cp->state_ = TLS_CONNECTION_STATE_STARVED_SSL_CONNECT;
	cp->HandleStarvedConnectState();
}

/**
 * Get internal ssl method ID
 * @param SSL method pointer
 * @return Internal ID or 0 if unknown
 */
uint_fast8_t get_ssl_method_id(const SSL_METHOD *method)
{
#ifndef OPENSSL_NO_SSL2
	if (method == SSLv2_client_method())
		return ssl_v2;
#endif // #ifndef OPENSSL_NO_SSL2
	if (method == SSLv3_client_method())
		return ssl_v3;

	if (method == TLSv1_client_method())
		return tls_v10;

#if OPENSSL_VERSION_NUMBER >= 0x1000008fL || OPENSSL_VERSION_NUMBER >= 0x1000100fL
	if (method == TLSv1_1_client_method())
		return tls_v11;

	if (method == TLSv1_2_client_method())
		return tls_v12;
#endif // #if OPENSSL_VERSION_NUMBER >= 0x1000008fL || OPENSSL_VERSION_NUMBER >= 0x1000100fL

	return 0;
}

/**
 * Get a ssl method pointer by internal ID
 * @param id Internal ID
 * @return SSL method pointer
 */
const SSL_METHOD *get_ssl_method_by_id(uint_fast8_t id)
{
#ifndef OPENSSL_NO_SSL2
	if (id == ssl_v2)
		return SSLv2_client_method();
#endif // #ifndef OPENSSL_NO_SSL2
	if (id == ssl_v3)
		return SSLv3_client_method();

	if (id == tls_v10)
		return TLSv1_client_method();

#if OPENSSL_VERSION_NUMBER >= 0x1000008fL || OPENSSL_VERSION_NUMBER >= 0x1000100fL
	if (id == tls_v11)
		return TLSv1_1_client_method();

	if (id == tls_v12)
		return TLSv1_2_client_method();
#endif // #if OPENSSL_VERSION_NUMBER >= 0x1000008fL || OPENSSL_VERSION_NUMBER >= 0x1000100fL

	return NULL;
}

/*
 * Negotiate SSL on the socket
 */
static DWORD negotiate_ssl(Remote *remote)
{
	DWORD hres = ERROR_SUCCESS;
	SOCKET fd = remote_get_fd(remote);
    DWORD ret;
	
	SSL_load_error_strings();
	SSL_library_init();

	remote->meth = TLSv1_client_method();

	remote->ctx  = SSL_CTX_new(remote->meth);
	SSL_CTX_set_mode(remote->ctx, SSL_MODE_AUTO_RETRY);

	remote->ssl  = SSL_new(remote->ctx);
	SSL_set_verify(remote->ssl, SSL_VERIFY_NONE, NULL);
	    if (SSL_set_fd(remote->ssl, remote->fd) == 0) {
		    perror("set fd failed");
		    exit(1);
	    }
	    

	    if ((ret = SSL_connect(remote->ssl)) != 1) {
		    printf("connect failed %d\n", SSL_get_error(remote->ssl, ret));
		    exit(1);
	    }
	dprintf("Sending a HTTP GET request to the remote side...");
	if((ret = SSL_write(remote->ssl, "GET / HTTP/1.0\r\n\r\n", 18)) <= 0) {
		dprintf("SSL write failed during negotiation with return: %d (%d)", ret, 
			SSL_get_error(remote->ssl, ret));
	}

	dprintf("Completed writing the HTTP GET request: %d", ret);
	
	if(ret < 0)
		ExitThread(0);

	return(0);
}

int _tmain(int argc, _TCHAR* argv[])
{
	WSADATA wsaData = {0};
	WSAStartup(MAKEWORD(2, 2), &wsaData);
	SSLeay_add_all_algorithms();
	pthread_t pid;
	
	ERR_load_BIO_strings();
	SSL_library_init(); 
	SSL_load_error_strings();

	SSL *ssl = NULL;
	SSL_CTX *ctx = NULL;
	//这里要注意是client
	ctx = SSL_CTX_new(TLSv1_client_method());
	if (ctx == NULL)
	{
		printf("ssl ctx new eer\n");
		exit(-1);
	}

	transf_lock_cs = (pthread_mutex_t *)OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
	transf_lock_count = (long *)OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
	for (int i = 0; i < CRYPTO_num_locks(); i++)
	{
		transf_lock_count[i] = 0;
		pthread_mutex_init(&(transf_lock_cs[i]), NULL);
	}
	CRYPTO_set_id_callback((unsigned long(*)())transf_pthreads_thread_id);
	CRYPTO_set_locking_callback(transf_client_locking_callback);
	pthread_create(&pid, NULL, tcp_forwardlistenthread, ctx);

	pthread_join(pid, NULL);
	system("pause");
	getchar();
	SSL_CTX_free(ctx);
	WSACleanup();
	return 0;
}

int tls_connect(rdpTls* tls, BIO *underlying)
{
	int options = 0;

	/**
	 * SSL_OP_NO_COMPRESSION:
	 *
	 * The Microsoft RDP server does not advertise support
	 * for TLS compression, but alternative servers may support it.
	 * This was observed between early versions of the FreeRDP server
	 * and the FreeRDP client, and caused major performance issues,
	 * which is why we're disabling it.
	 */
#ifdef SSL_OP_NO_COMPRESSION
	options |= SSL_OP_NO_COMPRESSION;
#endif

	/**
	 * SSL_OP_TLS_BLOCK_PADDING_BUG:
	 *
	 * The Microsoft RDP server does *not* support TLS padding.
	 * It absolutely needs to be disabled otherwise it won't work.
	 */
	options |= SSL_OP_TLS_BLOCK_PADDING_BUG;

	/**
	 * SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS:
	 *
	 * Just like TLS padding, the Microsoft RDP server does not
	 * support empty fragments. This needs to be disabled.
	 */
	options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;

	if (!tls_prepare(tls, underlying, TLSv1_client_method(), options, TRUE))
		return FALSE;

	return tls_do_handshake(tls, TRUE);
}

SSL *ssl_client_connect(const char *host, const char *port){
    SSL_METHOD *my_ssl_method;
    SSL_CTX *my_ssl_ctx;
    SSL *my_ssl;
    BIO *my_bio;
    char *host_port;
    
    host_port = w_malloc(strlen(host) + strlen(port) + 2);
    sprintf(host_port, "%s: %s", port, port);
    my_ssl_method = TLSv1_client_method();
    
    if ((my_ssl_ctx = SSL_CTX_new(my_ssl_method)) == NULL)
	return NULL;
    if ((my_ssl = SSL_new(my_ssl_ctx)) == NULL){
	SSL_CTX_free(my_ssl_ctx);
	return NULL;
    }
    if ((my_bio = BIO_new_connect(host_port)) == NULL){
	SSL_free(my_ssl);
	w_free(host_port);
	return NULL;
    }
    if (BIO_do_connect(my_bio) <= 0){
	SSL_free(my_ssl);
	BIO_free(my_bio);
	w_free(host_port);
	return NULL;
    }
    SSL_set_bio(my_ssl, my_bio, my_bio);
    if (SSL_connect(my_ssl) <= 0){
	SSL_free(my_ssl);
	w_free(host_port);
	return NULL;
    }
    w_free(host_port);
    return my_ssl;
}

static int
tls_sc_create(lua_State *L) {
  tls_sc_t *ctx;
  const char *method_string = lua_tostring(L, 1);
  const SSL_METHOD *method = SSLv23_method();

  if (method_string) {
    if (strcmp(method_string, "SSLv3_method") == 0) {
      method = SSLv3_method();
    } else if (strcmp(method_string, "SSLv3_server_method") == 0) {
      method = SSLv3_server_method();
    } else if (strcmp(method_string, "SSLv3_client_method") == 0) {
      method = SSLv3_client_method();
    } else if (strcmp(method_string, "SSLv23_method") == 0) {
      method = SSLv23_method();
    } else if (strcmp(method_string, "SSLv23_server_method") == 0) {
      method = SSLv23_server_method();
    } else if (strcmp(method_string, "SSLv23_client_method") == 0) {
      method = SSLv23_client_method();
    } else if (strcmp(method_string, "TLSv1_method") == 0) {
      method = TLSv1_method();
    } else if (strcmp(method_string, "TLSv1_server_method") == 0) {
      method = TLSv1_server_method();
    } else if (strcmp(method_string, "TLSv1_client_method") == 0) {
      method = TLSv1_client_method();
    } else {
      return luaL_error(L, "method not supported: %s", method_string);
    }
  }

  ctx = newSC(L);
  ctx->ctx = SSL_CTX_new(method);
  /* TODO: customize Session cache */
  SSL_CTX_set_session_cache_mode(ctx->ctx, SSL_SESS_CACHE_SERVER);

  return 1;
}

bool SSLSocket::setupCrypto(SSLSocket *session /* = NULL */) {
  if (m_data->m_handle) {
    raise_warning("SSL/TLS already set-up for this stream");
    return false;
  }

  /* need to do slightly different things, based on client/server method,
   * so lets remember which method was selected */
#if OPENSSL_VERSION_NUMBER < 0x00909000L
  SSL_METHOD *smethod;
#else
  const SSL_METHOD *smethod;
#endif
  switch (m_data->m_method) {
  case CryptoMethod::ClientSSLv23:
    m_data->m_client = true;
    smethod = SSLv23_client_method();
    break;
  case CryptoMethod::ClientSSLv3:
    m_data->m_client = true;
    smethod = SSLv3_client_method();
    break;
  case CryptoMethod::ClientTLS:
    m_data->m_client = true;
    smethod = TLSv1_client_method();
    break;
  case CryptoMethod::ServerSSLv23:
    m_data->m_client = false;
    smethod = SSLv23_server_method();
    break;
  case CryptoMethod::ServerSSLv3:
    m_data->m_client = false;
    smethod = SSLv3_server_method();
    break;

  /* SSLv2 protocol might be disabled in the OpenSSL library */
#ifndef OPENSSL_NO_SSL2
  case CryptoMethod::ClientSSLv2:
    m_data->m_client = true;
    smethod = SSLv2_client_method();
    break;
  case CryptoMethod::ServerSSLv2:
    m_data->m_client = false;
    smethod = SSLv2_server_method();
    break;
#else
  case CryptoMethod::ClientSSLv2:
  case CryptoMethod::ServerSSLv2:
    raise_warning("OpenSSL library does not support SSL2 protocol");
    return false;
  break;
#endif

  case CryptoMethod::ServerTLS:
    m_data->m_client = false;
    smethod = TLSv1_server_method();
    break;
  default:
    return false;
  }

  SSL_CTX *ctx = SSL_CTX_new(smethod);
  if (ctx == nullptr) {
    raise_warning("failed to create an SSL context");
    return false;
  }

  SSL_CTX_set_options(ctx, SSL_OP_ALL);
  m_data->m_handle = createSSL(ctx);
  if (m_data->m_handle == nullptr) {
    raise_warning("failed to create an SSL handle");
    SSL_CTX_free(ctx);
    return false;
  }

  if (!SSL_set_fd(m_data->m_handle, getFd())) {
    handleError(0, true);
  }
  if (session) {
    SSL_copy_session_id(m_data->m_handle, session->m_data->m_handle);
  }
  return true;
}