RE: [ECOS] RE: RE: On Porting OpenSSL v1.0.0c

RE: [ECOS] RE: RE: On Porting OpenSSL v1.0.0c

[amassa]

Hi,

Thanks for the reply.

I do have a call to get the further errors and code similar to the one you included below.  It seems errno is 0 (showing no error), but I need to look into this further to see if it is implemented correctly on this platform because SSL_get_error returns 5 (as you mentioned).

I have also tried to use the callback during connection to obtain more information.  These are the output messages (snippet) I am seeing after the attempt to perform SSL_connect():

do the SSL connection
SSL_connect:before/connect initialization
SSL_connect:error in SSLv3 write client hello A
SSL_connect status  -1
SSL_connect Error  5
sockerrno to connect, err = 0 (No error)
SSL Verify OK
SSL_connect Failed

The callback status returns "error in SSLv3 write client hello A".

I have implemented my own ioctl() (returning ENOSYS) to handle any calls into that function.

Any further ideas are greatly appreciated.

Thanks,
Anthony

---- "Retallack wrote: 
> Hi, 
> 
> One thing hat comes to mind, error 5 is SSL_ERROR_SYSCALL, see: http://www.openssl.org/docs/ssl/SSL_get_error.html
> 
> It also suggests some more debug to use to find out what has happened (for example errno). You can also use something like the following to get a string of the error:
> 
> unsigned long l;
> while ((l=ERR_get_error()))
> {
>     printf("ssl error: %s\n", ERR_error_string(l,NULL));
> }
> 
> Because the underlying transport is not TCP, it might be returning an error because of blocking/non-blocking differences. Also I believe that openssl can use ioctl calls, this may be failing on a serial file descriptor. 
> 
> Mark Retallack 
> 
> -----Original Message-----
> From: ecos-discuss-owner@ecos.sourceware.org [mailto:ecos-discuss-owner@ecos.sourceware.org] On Behalf Of Anthony Massa
> Sent: 26 April 2011 17:53
> To: ecos-discuss@ecos.sourceware.org
> Subject: [ECOS] RE: RE: On Porting OpenSSL v1.0.0c
> 
> Hi,
> 
> I have OpenSSL built into my image (along with a slightly older version of eCos).  I am not able to use the standard socket interface layer over Ethernet - basically the platform I'm using needs to communicate via serial for the network traffic.  So, basically the socket interface functions (connect, send, recv) are implemented to use this serial interface.  I have tested the raw socket interface for the connect, send, and recv functions and they appear to be able to echo with a server properly - so I believe the socket interface is running correctly.
> 
> I am running the test code I included above (ssltest.c) and find that the test is failing at line 725 when the SSL_connect function is called.
> 
> The output I see and errors returned are shown here:
> 
> do the SSL connection
> SSL_connect status  -1
> SSL_connect Error  5
> 
> I appreciate any feedback.
> 
> Thanks,
> Anthony
> 


-- 
Before posting, please read the FAQ: http://ecos.sourceware.org/fom/ecos
and search the list archive: http://ecos.sourceware.org/ml/ecos-discuss

RE: [ECOS] RE: RE: On Porting OpenSSL v1.0.0c

[Retallack, Mark]

Hi, 

One thing hat comes to mind, error 5 is SSL_ERROR_SYSCALL, see: http://www.openssl.org/docs/ssl/SSL_get_error.html

It also suggests some more debug to use to find out what has happened (for example errno). You can also use something like the following to get a string of the error:

unsigned long l;
while ((l=ERR_get_error()))
{
    printf("ssl error: %s\n", ERR_error_string(l,NULL));
}

Because the underlying transport is not TCP, it might be returning an error because of blocking/non-blocking differences. Also I believe that openssl can use ioctl calls, this may be failing on a serial file descriptor. 

Mark Retallack 

-----Original Message-----
From: ecos-discuss-owner@ecos.sourceware.org [mailto:ecos-discuss-owner@ecos.sourceware.org] On Behalf Of Anthony Massa
Sent: 26 April 2011 17:53
To: ecos-discuss@ecos.sourceware.org
Subject: [ECOS] RE: RE: On Porting OpenSSL v1.0.0c

Hi,

I have OpenSSL built into my image (along with a slightly older version of eCos).  I am not able to use the standard socket interface layer over Ethernet - basically the platform I'm using needs to communicate via serial for the network traffic.  So, basically the socket interface functions (connect, send, recv) are implemented to use this serial interface.  I have tested the raw socket interface for the connect, send, and recv functions and they appear to be able to echo with a server properly - so I believe the socket interface is running correctly.

I am running the test code I included above (ssltest.c) and find that the test is failing at line 725 when the SSL_connect function is called.

The output I see and errors returned are shown here:

do the SSL connection
SSL_connect status  -1
SSL_connect Error  5

I appreciate any feedback.

Thanks,
Anthony


--
Before posting, please read the FAQ: http://ecos.sourceware.org/fom/ecos
and search the list archive: http://ecos.sourceware.org/ml/ecos-discuss

[ECOS] RE: RE: On Porting OpenSSL v1.0.0c

[Anthony Massa]

[-- Attachment #1: Type: text/plain, Size: 874 bytes --]

Hi,

I have OpenSSL built into my image (along with a slightly older version of eCos).  I am not able to use the standard socket interface layer over Ethernet - basically the platform I'm using needs to communicate via serial for the network traffic.  So, basically the socket interface functions (connect, send, recv) are implemented to use this serial interface.  I have tested the raw socket interface for the connect, send, and recv functions and they appear to be able to echo with a server properly - so I believe the socket interface is running correctly.

I am running the test code I included above (ssltest.c) and find that the test is failing at line 725 when the SSL_connect function is called.

The output I see and errors returned are shown here:

do the SSL connection
SSL_connect status  -1
SSL_connect Error  5

I appreciate any feedback.

Thanks,
Anthony


[-- Attachment #2: ssltest.c --]
[-- Type: text/plain, Size: 24983 bytes --]

#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
#include <limits.h>

#include "os.h"

#include <netinet/in.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <openssl/ssl.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/objects.h>
#include <openssl/bio.h>
#include <openssl/err.h>


//asd


#define ALLOW_INVALID_PURPOSE             0x00000001
#define ALLOW_SELF_SIGNED_CERT_IN_CHAIN   0x00000002
#define VERIFY_SHOW_CERTS                 0x80000000

#define SHUT_RD   0		/* == Win32 SD_RECEIVE */
#define SHUT_WR   1		/* == Win32 SD_SEND    */
#define SHUT_RDWR 2		/* == Win32 SD_BOTH    */


unsigned long verify_control_flags = 0;
int dump_cert_names = 0;
int ignore_all_verify_errors = 0;

char * rootcert = 
"-----BEGIN CERTIFICATE-----\n"
"MIIDbDCCAtWgAwIBAgIBKTANBgkqhkiG9w0BAQQFADCBkTELMAkGA1UEBhMCVVMx\n"
"CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTYW4gRGllZ28xEzARBgNVBAoTClZlcmlt\n"
"YXRyaXgxDTALBgNVBAsTBFZDQVMxGzAZBgNVBAMTElZlcmltYXRyaXggUk9PVCBD\n"
"QTEgMB4GCSqGSIb3DQEJARYRQ0FAVmVyaW1hdHJpeC5jb20wHhcNMDUwMzIzMjA0\n"
"NzEwWhcNMTUwMzIxMjA0NzEwWjCBhzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNB\n"
"MRMwEQYDVQQKEwpWZXJpbWF0cml4MQ0wCwYDVQQLEwRWQ0FTMRQwEgYDVQQDEwtN\n"
"aWtlIEJlYXR0eTExMC8GCSqGSIb3DQEJARYiU1VCQ0EuMTExMTYxMDgyOTg0M0BW\n"
"ZXJpbWF0cml4LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAy0us/E8u\n"
"2vH1x6AcwDHllaMz3SdJ1plknmOPn2IgPHoOdg+PR2ciAR4wOzXUyOkasUhn8FyS\n"
"p+lPQiv/vfMxu6zG4NtwRF5NIWqCG06pXUIYR3JH4HSbfhf+9IIHsn2HwPolBBRq\n"
"zDJRkKKVLWSlYLjneqhWkYCFLkTshSyw2vcCAwEAAaOB2zCB2DAdBgNVHQ4EFgQU\n"
"CfPXPsVfPryHZq9o7/soM3JAtZUwgagGA1UdIwSBoDCBnaGBl6SBlDCBkTELMAkG\n"
"A1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTYW4gRGllZ28xEzARBgNV\n"
"BAoTClZlcmltYXRyaXgxDTALBgNVBAsTBFZDQVMxGzAZBgNVBAMTElZlcmltYXRy\n"
"aXggUk9PVCBDQTEgMB4GCSqGSIb3DQEJARYRQ0FAVmVyaW1hdHJpeC5jb22CAQAw\n"
"DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQBr9fD+FC5Of2LJb1pw+hUO\n"
"WKFmgulTkVGO5tFo2EddK5k/RywxJ76QmM+ej0Zz9AsvWDJO6HQmpwm8WQbxyG6F\n"
"jq5xKAUJMSmQv3UYY7uwcmcZbtnU6OYfm5zIz1p7F9oJsCWBX3nPQ3SE7DP7xBBK\n"
"KsHR1fLvK1pdTPsSpJsQvw==\n"
"-----END CERTIFICATE-----\n";


int ip_connect( char * host, int port )
{
	struct sockaddr_in sa;
	int s = -1;
	
	/* Set-up the sockaddr_in structure */
	memset((char *)&sa,0,sizeof(sa));
	sa.sin_family=AF_INET;
	sa.sin_port=(unsigned short)port;
    sa.sin_addr.s_addr = inet_addr(host);

SM_printf("connect port = %x\r\n", sa.sin_port);

	/* Create the socket */
	s = socket( AF_INET, SOCK_STREAM, 0 );
	if (s == -1) {
		SM_printf("failed to create the socket\r\n");
		return -1;
	}

	/* Connect */
	if ( connect( s, (struct sockaddr*)&sa, sizeof(sa) ) == -1 ) {
		SM_printf("failed to connect\r\n");
		close(s);
		return -1;
	} 

	return s;

#if 0

   unsigned long addr;
//   struct sockaddr_in them;
   sockaddr them;
   //struct hostent * pHostEnt;
   //char ** pHostAddr = NULL;
   int s = -1;

   /* resolve IP address */
   addr = inet_addr(host);
   if ( -1 == addr )
   {
      SM_printf("Host address must be an IPv4 IP Address\n");
	//SM_printf("Failed to connect, err = %d (%s)\r\n", e, strerror(e));
      return -1;
   }

   /* Set-up the sockaddr_in structure */
   memset((char *)&them,0,sizeof(them));
   them.sin_family=AF_INET;
   //them.sin_port=htons((unsigned short)port);
   them.sin_port=(unsigned short)port;
   them.sin_addr.s_addr = inet_addr(host);
   //memcpy( (void *)&them.sin_addr, (void *)&addr, sizeof(addr) );


   /* create the socket */
   //s = socket( AF_INET, SOCK_STREAM, IPPROTO_TCP );
    s = socket(AF_INET, SOCK_STREAM, 0);
   if (-1 == s) 
   {
	SM_printf("Failed to create socket  %d\n",errno);
      return -1;
   }

   
   if (connect(s, &them, sizeof(them)) == -1) {
//   if (connect(s, &them, sizeof(them) ) == -1 ) 
   {
      int e = errno;
      SM_printf("Failed to connect, err = %d (%s)\n", e, strerror(e) );
      close( s );
      return -1;
   }

   SM_printf("Socket (%d) connect OK to %s:%d\n", s, host, port);
   return s;
#endif
}


void print_cert( X509 * cert )
{
    X509_PURPOSE *ptmp;
    int j, id, i, idret;
    char *pname;
    BIO *STDout=NULL;
    
    // Create BIO object for stdout
    STDout=BIO_new_fp(stdout,BIO_NOCLOSE);

    // Print the certificate text
    X509_print_ex( STDout, cert, 0, 0 );

    // Print the Certificate Purposes
    // This code is from openssl/apps/x509.c
    BIO_printf(STDout, "    Certificate purposes:\n");
    for (j = 0; j < X509_PURPOSE_get_count(); j++)
    {
        ptmp = X509_PURPOSE_get0(j);
        id = X509_PURPOSE_get_id(ptmp);
        pname = X509_PURPOSE_get0_name(ptmp);
        for (i = 0; i < 2; i++)
        {
            idret = X509_check_purpose(cert, id, i);
            BIO_printf(STDout, "        %s%s : ", pname, i ? " CA" : ""); 
            if (idret == 1) 
                BIO_printf(STDout, "Yes\n");
            else if (idret == 0) 
                BIO_printf(STDout, "No\n");
            else 
                BIO_printf(STDout, "Yes (WARNING code=%d)\n", idret);
        }
    }

    // Free our BIO object
    BIO_free_all(STDout);
}



X509 * get_issuer( X509_STORE_CTX *ctx )
{
    X509 *issuer, *tmp_issuer = NULL, *err_cert;
    int res;


    // Ensure we have an X509 Store Context
    if ( !ctx )
    {
       SM_printf( "no CTX\n" );
       return NULL;
    }

    err_cert = X509_STORE_CTX_get_current_cert(ctx);
    if ( NULL == err_cert )
    {
        SM_printf("No cert to get issuer of\n");
        return NULL;
    }

    // Obtain the issuer cert
    issuer = ctx->current_issuer;

    // If the issuer has not been set, try to get it from the trusted 
    // certs in the store.  If this works, the cert will have to be freed
    // later.
    if ( !issuer )
    {
        // It is not set yet, try getting it from the store
        res = X509_STORE_CTX_get1_issuer( &tmp_issuer, ctx, err_cert );
        issuer = tmp_issuer;
        if ( issuer )
        {
            //SM_printf( "Got issuer from trusted certs\n" );
        }
    }

    if ( !issuer)
    {
        // If we did not get the issuer from the trusted certs,
        // try getting it from the stack of untrusted certs.
        // If this works we just get a pointer to the stack 
        // entry and must NOT free it.
        int i;
        X509 *potential_issuer;
        for (i = 0; i < sk_X509_num(ctx->untrusted); i++)
        {
            potential_issuer = sk_X509_value(ctx->untrusted, i);
            if (ctx->check_issued(ctx, err_cert, potential_issuer))
                issuer = potential_issuer;
        }
        if ( issuer )
        {
            //SM_printf("Got issuer from untrusted certs\n");
        }
    }

    if ( !issuer )
    {
       SM_printf( "Could not find issuer cert\n");
    }
    //else 
    //{
    //    SM_printf( "Have issuer cert\n" );
    //}

    // This should be freed to avoid memory leaks, 
    // but this is just a test app, so let it leak!
    //if (tmp_issuer) 
    //    X509_free(tmp_issuer);
    return issuer;

}

void log_ssl_verify_errors( int verify_result )
{
    switch( verify_result ) 
    {
        default:
            SM_printf("UNKNOWN SSL Verify error %ld\n", verify_result);
            break;
        case X509_V_OK:
            SM_printf("SSL Verify OK\n");
            break;
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
            SM_printf("SSL Verify UNABLE_TO_GET_ISSUER_CERT\n");
            break;
        case X509_V_ERR_CERT_NOT_YET_VALID:
            SM_printf("SSL Verify CERT_NOT_YET_VALID\n");
            break;
        case X509_V_ERR_CERT_HAS_EXPIRED:
            SM_printf("SSL Verify CERT_HAS_EXPIRED\n");
            break;
        case X509_V_ERR_INVALID_PURPOSE:
            SM_printf("SSL Verify INVALID_PURPOSE\n");
            break;
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
            SM_printf("SSL Verify UNABLE_TO_GET_ISSUER_CERT_LOCALLY\n");
            break;
        case X509_V_ERR_PATH_LENGTH_EXCEEDED:
            SM_printf("SSL Verify PATH_LENGTH_EXCEEDED\n");
            break;
        case X509_V_ERR_CERT_UNTRUSTED:
            SM_printf("SSL Verify CERT_UNTRUSTED\n");
            break;
        case X509_V_ERR_CERT_REJECTED:
            SM_printf("SSL Verify CERT_REJECTED\n");
            break;
        case X509_V_ERR_UNABLE_TO_GET_CRL:
            SM_printf("SSL Verify UNABLE_TO_GET_CRL\n");
            break;
        case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
            SM_printf("SSL Verify UNABLE_TO_DECRYPT_CERT_SIGNATURE\n");
            break;
        case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
            SM_printf("SSL Verify UNABLE_TO_DECRYPT_CRL_SIGNATURE\n");
            break;
        case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
            SM_printf("SSL Verify UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY\n");
            break;
        case X509_V_ERR_CERT_SIGNATURE_FAILURE:
            SM_printf("SSL Verify CERT_SIGNATURE_FAILURE\n");
            break;
        case X509_V_ERR_CRL_SIGNATURE_FAILURE:
            SM_printf("SSL Verify CRL_SIGNATURE_FAILURE\n");
            break;
        case X509_V_ERR_CRL_NOT_YET_VALID:
            SM_printf("SSL Verify ERR_CRL_NOT_YET_VALID\n");
            break;
        case X509_V_ERR_CRL_HAS_EXPIRED:
            SM_printf("SSL Verify CRL_HAS_EXPIRED\n");
            break;
        case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
            SM_printf("SSL Verify ERROR_IN_CERT_NOT_BEFORE_FIELD\n");
            break;
        case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
            SM_printf("SSL Verify ERROR_IN_CERT_NOT_AFTER_FIELD\n");
            break;
        case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
            SM_printf("SSL Verify ERROR_IN_CRL_LAST_UPDATE_FIELD\n");
            break;
        case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
            SM_printf("SSL Verify ERROR_IN_CRL_NEXT_UPDATE_FIELD\n");
            break;
        case X509_V_ERR_OUT_OF_MEM:
            SM_printf("SSL Verify OUT_OF_MEM\n");
            break;
        case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
            SM_printf("SSL Verify DEPTH_ZERO_SELF_SIGNED_CERT\n");
            break;
        case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
            SM_printf("SSL Verify SELF_SIGNED_CERT_IN_CHAIN\n");
            break;
        case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
            SM_printf("SSL Verify UNABLE_TO_VERIFY_LEAF_SIGNATURE\n");
            break;
        case X509_V_ERR_CERT_CHAIN_TOO_LONG:
            SM_printf("SSL Verify CERT_CHAIN_TOO_LONG\n");
            break;
        case X509_V_ERR_CERT_REVOKED:
            SM_printf("SSL Verify CERT_REVOKED\n");
            break;
        case X509_V_ERR_INVALID_CA:
            SM_printf("SSL Verify INVALID_CA\n");
            break;
        case X509_V_ERR_SUBJECT_ISSUER_MISMATCH:
            SM_printf("SSL Verify SUBJECT_ISSUER_MISMATCH\n");
            break;
        case X509_V_ERR_AKID_SKID_MISMATCH:
            SM_printf("SSL Verify AKID_SKID_MISMATCH\n");
            break;
        case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH:
            SM_printf("SSL Verify AKID_ISSUER_SERIAL_MISMATCH\n");
            break;
        case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
            SM_printf("SSL Verify UNABLE_TO_GET_CRL_ISSUER\n");
            break;
/*
        case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
        case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
        case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
        case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
        case X509_V_ERR_INVALID_NON_CA:
        case X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED:
        case X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
        case X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED:
        case X509_V_ERR_INVALID_EXTENSION:
        case X509_V_ERR_INVALID_POLICY_EXTENSION:
        case X509_V_ERR_NO_EXPLICIT_POLICY:
        case X509_V_ERR_UNNESTED_RESOURCE:
        case X509_V_ERR_APPLICATION_VERIFICATION:
*/
    }
}

#if 0
void log_ssl_errors( )
{
   unsigned long err;
   char * sErrStr;
   SM_printf("log_ssl_errors -- \n");
   err = ERR_get_error();
   SM_printf("ERR_get_error Error code  %d\n",err);
   while( err != 0 ) 
   {
      SM_printf("Use NULL for error buffer so OpenSSL internal buffer is used.\n");
      // This internal buffer is not thread safe!
      sErrStr = (char *)ERR_error_string( err, NULL );
      if ( sErrStr != NULL ) 
         SM_printf("%lu - %s\n", err, sErrStr );
   }
}
#endif


X509 * pem_to_x509( char * pem )
{
   X509 * pX509 = NULL;
   BIO  * pBio  = NULL;

   /* Allocate BIO object*/
   pBio  = BIO_new( BIO_s_mem() );
   if ( pBio == NULL )
      return NULL;

   /* Put the raw certificate (char format) into the BIO object */
   BIO_write( pBio, pem, strlen(pem) );

   /* Parse the certificate */
   pX509 = (struct x509_st *)PEM_ASN1_read_bio( 
                (char *(*)())d2i_X509  /* DER to Internal conversion fn */
              , PEM_STRING_X509        /* PEM Marker string from pem.h  */
              , pBio                   /* BIO containing cert PEM data  */
              , NULL
              , NULL
              , NULL 
              );
   /* Free the BIO structure */
   BIO_free(pBio);
   /* Return the Cert */
   return pX509;
}


#define MAX_DEPTH 3

int my_verify_callback(int ok, X509_STORE_CTX *ctx)
{
   X509 *err_cert, *issuer;
   int err;
   int depth;
   char buf[256];
   SM_printf("my_verify_callback \n");
 
   err_cert = X509_STORE_CTX_get_current_cert(ctx);
   err      = X509_STORE_CTX_get_error(ctx);
   depth    = X509_STORE_CTX_get_error_depth(ctx);


   SM_printf("------------ Begin Verify Callback --------------\n");
   X509_NAME_oneline(X509_get_subject_name(err_cert),buf,sizeof buf);
   if ( dump_cert_names ) 
   {
      SM_printf("verifying certificate: %s\n", buf);
      print_cert( err_cert );
      SM_printf("\n");
   }
   X509_NAME_oneline(X509_get_issuer_name(err_cert),buf,sizeof buf);
   if ( dump_cert_names ) 
   {
      SM_printf("issued by            : %s\n", buf);
      issuer = get_issuer( ctx );
      if ( issuer )
          print_cert( issuer );
      else
          SM_printf("No issuer yet\n");
      SM_printf("\n");
   }

   if ( !ok ) 
   {
      if ( depth >= MAX_DEPTH ) 
      {
         SM_printf("Verify callback: depth( %d ) exceeds %d\n", depth, MAX_DEPTH );
         X509_STORE_CTX_set_error(ctx,X509_V_ERR_CERT_CHAIN_TOO_LONG);
         ok = 0;
      }
      switch( ctx->error )
      {
      case X509_V_OK:
         SM_printf( "!ok but X509_V_OK?, just say OK\n");
         ok = 1;
         break;

      case X509_V_ERR_INVALID_PURPOSE:
         if ( verify_control_flags & ALLOW_INVALID_PURPOSE )
         {
            SM_printf("ignoring INVALID_PURPOSE error\n");
            X509_STORE_CTX_set_error(ctx,X509_V_OK);
            ok = 1;
         }
         break;

      case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
         if ( verify_control_flags & ALLOW_SELF_SIGNED_CERT_IN_CHAIN )
         {
            SM_printf("ignoring SELF_SIGNED_CERT_IN_CHAIN error\n");
            X509_STORE_CTX_set_error(ctx,X509_V_OK);
            ok = 1;
         }
         break;

      default:
         if ( ignore_all_verify_errors )
         {
            SM_printf("ignoring verify error (%d)", ctx->error);
            log_ssl_verify_errors( ctx->error );
            X509_STORE_CTX_set_error(ctx,X509_V_OK);
            ok = 1;
         }
         else
         {
            SM_printf("verify callback failing on ");
            log_ssl_verify_errors( ctx->error );
         }
         break;
      }    
   }

   SM_printf("------------ End Verify Callback --------------\n");
   return(ok);
}

void usage()
{
   SM_printf("ssltest [options]\n");
   SM_printf("    -s server_addr\n");
   SM_printf("    -p server_port\n");
   SM_printf("    -v             : disable client validation of server\n");
   SM_printf("    -f flags       : 1 to allow invalid purpose\n");
   SM_printf("                   : 2 to allow self signed cert in chain\n");
   SM_printf("                   : 32 to show certs being verified\n");
   SM_printf("    -o             : omit setting local trusted rootcert\n");
   SM_printf("    -i             : ignore all verify errors\n");

}

int ssltest(char *server, int port_num)
{
//   char    * server;
   int       port;
   SSL_CTX * sslctx  = NULL;  /* SSL Context */
   SSL     * sslcon  = NULL;  /* SSL Connection handle */
   int       s       = -1;         /* socket */
   int       err;
   int       e;
   BIO     * sbio    = NULL;
   //int       c;
   int       verify_peer = 1;
   //int       tmp;
   X509    * root_x509 = NULL;
   int       omit_rootcert = 0;
   SM_printf("ssltest: test function ---  \n");

  /* if ( argc < 3 )
   {
      usage();
      return 0;
   }
*/
    /* while ((c = getopt(argc, argv, "inovf:s:p:")) != -1)
         switch (c) {
         case 'v': verify_peer = 0; break;
         case 's': server = optarg; break;
         case 'p': port = atoi(optarg); break;
         case 'f': tmp = atoi(optarg); 
                   if ( tmp > 0 )
                      verify_control_flags |= (1 << (tmp-1));
                   break;
         case 'o': omit_rootcert = 1; break;
         case 'i': ignore_all_verify_errors = 1; 
                   verify_control_flags = 0xFFFFFFFF; 
                   break;
         case 'n': dump_cert_names = 1;
         case '?':
         case 'h': usage(argv[0]);           return 0;
         }
  */
//   server = "192.168.1.12";
   port = port_num;
//   port = 8090;
//   port = 12697;
   ignore_all_verify_errors = 1; 
   verify_control_flags = 0xFFFFFFFF; 
   verify_peer = 0;

   /* Check that port is valid */
   if ( port <= 0 )
   {
      SM_printf("invalid port %d\n", port );
      return 0;
   }

   /* Dump the Validation Flags */
   if ( verify_peer )
   {
      if ( ignore_all_verify_errors )
      {
         SM_printf("Verify Peer ignoring all validation errors\n");
      }
      else
      if ( verify_control_flags )
      {
         SM_printf("Verify Peer: (%x)\n",verify_control_flags);
         if ( verify_control_flags & ALLOW_INVALID_PURPOSE )
             SM_printf("           :Allow Invalid Purpose\n");
         if ( verify_control_flags & ALLOW_SELF_SIGNED_CERT_IN_CHAIN )
             SM_printf("           :Allow Self Signed Cert In Chain\n");
         if ( verify_control_flags & VERIFY_SHOW_CERTS )
             {
             dump_cert_names = 1;
             SM_printf("           :Show names of certs being verified\n");
             }
      }
      else
      {
         SM_printf("Verify Peer with no error exceptions\n");
      }
   }
   else
   {
      SM_printf("Peer Verification disabled\n");
   }

   do {

      /* Initialize OpenSSL */
	
      OpenSSL_add_all_algorithms();
      OpenSSL_add_all_digests();
      OpenSSL_add_all_ciphers();
      OpenSSL_add_ssl_algorithms();
	SSL_library_init();
      SSL_load_error_strings();

      /* Create an SSL Context */
      sslctx = SSL_CTX_new(TLSv1_client_method());
      if ( NULL == sslctx )
      {
         SM_printf("Failed to create SSL Context\n");
         break;
      }
      
SM_printf("SSL_CTX_new log ssl errors\n");
log_ssl_errors();

      /* Initialize the context */
      SSL_CTX_set_quiet_shutdown(sslctx,1);
      SSL_CTX_set_options(sslctx, 0);
      SSL_CTX_sess_set_cache_size(sslctx,128);

      /* Setup for Peer Validation */
      if ( verify_peer )
      {
         if ( !omit_rootcert )
         {
            SM_printf("setting local trusted rootcert\n");
            root_x509 = pem_to_x509( rootcert );
            if ( root_x509 )
               X509_STORE_add_cert( sslctx->cert_store, root_x509 );
            else
            {
               log_ssl_errors();
               SM_printf("Failed to convert rootcert to X509 structure in verify setup\n");
            }
         }
         else
         {
            SM_printf("omitted setting local trusted rootcert\n");
         }

         SM_printf("enabbling client validation of server SSL certificate\n");
         SSL_CTX_set_verify( sslctx
                           , SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT
                           , my_verify_callback
                           );

         SSL_CTX_set_verify_depth( sslctx, 3 );
      }

      /* Create SSL Connection context */
      sslcon = SSL_new(sslctx);
      if ( sslcon == NULL ) 
      {
         SM_printf("SSL_new failed\n");
         break;
      }

SM_printf("SSL_new log ssl errors\n");
log_ssl_errors();

      /* Establish connection to the server */
      s = ip_connect( server, port );
      if ( -1 == s )
      {
         SM_printf("IP connection to %s on port %d Failed\n", server, port);
         break;
      }

      /* Wrap the connected socket in a BIO object so OpenSSL can use it */
      sbio = BIO_new_socket( s, BIO_NOCLOSE );
      if ( sbio == NULL ) 
      {
         SM_printf("Failed to create socket BIO\n");
         break;
      }

SM_printf("BIO_new_socket log ssl errors\n");
log_ssl_errors();

SM_printf("sslcon->type  %d\n",sslcon->type);
SM_printf("sslcon->version  %d\n",sslcon->version); //Protocol Version
SM_printf("sslcon->rwstate  %d\n",sslcon->rwstate);
SM_printf("sslcon->in_handshake  %d\n",sslcon->in_handshake);
SM_printf("sslcon->handshake_func  %d\n",sslcon->handshake_func);
SM_printf("sslcon->state  %d\n",sslcon->state);
SM_printf("sslcon->rstate  %d\n",sslcon->rstate);
SM_printf("sslcon->init_num  %d\n",sslcon->init_num); //amount read/written
SM_printf("sslcon->error  %d\n",sslcon->error);
SM_printf("sslcon->error_code  %d\n",sslcon->error_code); // Actual Error Code
SM_printf("sslcon->client_version  %d\n",sslcon->client_version);

      /* Give the connected socket to OpenSSL */
	SM_printf("Give the connected socket to OpenSSL\n");
      SSL_set_bio( sslcon, sbio, sbio );
      SSL_set_connect_state( sslcon );

      /* Perform the SSL handshake to complete the SSL connection */
      while( 1 )
      {
         /* do the SSL connection */
	   SM_printf("do the SSL connection\n");
         err = SSL_connect( sslcon );

	   SM_printf("SSL_connect status  %d\n", err);
         /* Check for success */
         if ( err > 0 )
         {
            log_ssl_errors();
            log_ssl_verify_errors( sslcon->verify_result );
            SM_printf("SSL_connect succeeded\n");
            break;
         }

         /* Error was returned */
         e = SSL_get_error( sslcon, err );
         if ( (SSL_ERROR_WANT_READ  != e) && (SSL_ERROR_WANT_WRITE != e) )
         {
            SM_printf("SSL_connect Error  %d\n", e);
		log_ssl_errors();
		int e = errno;
	      SM_printf("sockerrno to connect, err = %d (%s)\n", e, strerror(e) );
            log_ssl_verify_errors( sslcon->verify_result );
            SM_printf("SSL_connect Failed\n");

SM_printf("sslcon->type  %d\n",sslcon->type);
SM_printf("sslcon->version  %d\n",sslcon->version); //Protocol Version
SM_printf("sslcon->rwstate  %d\n",sslcon->rwstate);
SM_printf("sslcon->in_handshake  %d\n",sslcon->in_handshake);
SM_printf("sslcon->handshake_func  %d\n",sslcon->handshake_func);
SM_printf("sslcon->state  %d\n",sslcon->state);
SM_printf("sslcon->rstate  %d\n",sslcon->rstate);
SM_printf("sslcon->init_num  %d\n",sslcon->init_num); //amount read/written
SM_printf("sslcon->error  %d\n",sslcon->error);
SM_printf("sslcon->error_code  %d\n",sslcon->error_code); // Actual Error Code
SM_printf("sslcon->client_version  %d\n",sslcon->client_version);

            break;
         }

         /* OpenSSL wants to retry */
         SM_printf("Retry SSL_connect\n");
      }

      /* Connection has either been established, or it has failed */
   } while ( 0 );

   /* Free allocated resources */
   SM_printf("freeing resources\n");
   if ( sslcon )
   {
      SSL_shutdown( sslcon );
      shutdown( SSL_get_fd(sslcon), SHUT_RDWR );
      SSL_free( sslcon );
   }
   if ( s != -1 )
   {
      shutdown( s, SHUT_RDWR );
      close( s );
   }
   if ( sslctx )
      SSL_CTX_free( sslctx );
   if ( root_x509 )
      X509_free( root_x509 );

   EVP_cleanup();
   CRYPTO_cleanup_all_ex_data();
   ERR_remove_state(0);
   ERR_free_strings();

   return 0;
}



[-- Attachment #3: Type: text/plain, Size: 148 bytes --]

-- 
Before posting, please read the FAQ: http://ecos.sourceware.org/fom/ecos
and search the list archive: http://ecos.sourceware.org/ml/ecos-discuss