1*e7be843bSPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2023-2025 The OpenSSL Project Authors. All Rights Reserved.
3*e7be843bSPierre Pronchery *
4*e7be843bSPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5*e7be843bSPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6*e7be843bSPierre Pronchery * in the file LICENSE in the source distribution or at
7*e7be843bSPierre Pronchery * https://www.openssl.org/source/license.html
8*e7be843bSPierre Pronchery */
9*e7be843bSPierre Pronchery
10*e7be843bSPierre Pronchery /*
11*e7be843bSPierre Pronchery * NB: Changes to this file should also be reflected in
12*e7be843bSPierre Pronchery * doc/man7/ossl-guide-quic-client-block.pod
13*e7be843bSPierre Pronchery */
14*e7be843bSPierre Pronchery
15*e7be843bSPierre Pronchery #include <string.h>
16*e7be843bSPierre Pronchery
17*e7be843bSPierre Pronchery /* Include the appropriate header file for SOCK_DGRAM */
18*e7be843bSPierre Pronchery #ifdef _WIN32 /* Windows */
19*e7be843bSPierre Pronchery # include <winsock2.h>
20*e7be843bSPierre Pronchery #else /* Linux/Unix */
21*e7be843bSPierre Pronchery # include <sys/socket.h>
22*e7be843bSPierre Pronchery #endif
23*e7be843bSPierre Pronchery
24*e7be843bSPierre Pronchery #include <openssl/bio.h>
25*e7be843bSPierre Pronchery #include <openssl/ssl.h>
26*e7be843bSPierre Pronchery #include <openssl/err.h>
27*e7be843bSPierre Pronchery
28*e7be843bSPierre Pronchery /* Helper function to create a BIO connected to the server */
create_socket_bio(const char * hostname,const char * port,int family,BIO_ADDR ** peer_addr)29*e7be843bSPierre Pronchery static BIO *create_socket_bio(const char *hostname, const char *port,
30*e7be843bSPierre Pronchery int family, BIO_ADDR **peer_addr)
31*e7be843bSPierre Pronchery {
32*e7be843bSPierre Pronchery int sock = -1;
33*e7be843bSPierre Pronchery BIO_ADDRINFO *res;
34*e7be843bSPierre Pronchery const BIO_ADDRINFO *ai = NULL;
35*e7be843bSPierre Pronchery BIO *bio;
36*e7be843bSPierre Pronchery
37*e7be843bSPierre Pronchery /*
38*e7be843bSPierre Pronchery * Lookup IP address info for the server.
39*e7be843bSPierre Pronchery */
40*e7be843bSPierre Pronchery if (!BIO_lookup_ex(hostname, port, BIO_LOOKUP_CLIENT, family, SOCK_DGRAM, 0,
41*e7be843bSPierre Pronchery &res))
42*e7be843bSPierre Pronchery return NULL;
43*e7be843bSPierre Pronchery
44*e7be843bSPierre Pronchery /*
45*e7be843bSPierre Pronchery * Loop through all the possible addresses for the server and find one
46*e7be843bSPierre Pronchery * we can connect to.
47*e7be843bSPierre Pronchery */
48*e7be843bSPierre Pronchery for (ai = res; ai != NULL; ai = BIO_ADDRINFO_next(ai)) {
49*e7be843bSPierre Pronchery /*
50*e7be843bSPierre Pronchery * Create a UDP socket. We could equally use non-OpenSSL calls such
51*e7be843bSPierre Pronchery * as "socket" here for this and the subsequent connect and close
52*e7be843bSPierre Pronchery * functions. But for portability reasons and also so that we get
53*e7be843bSPierre Pronchery * errors on the OpenSSL stack in the event of a failure we use
54*e7be843bSPierre Pronchery * OpenSSL's versions of these functions.
55*e7be843bSPierre Pronchery */
56*e7be843bSPierre Pronchery sock = BIO_socket(BIO_ADDRINFO_family(ai), SOCK_DGRAM, 0, 0);
57*e7be843bSPierre Pronchery if (sock == -1)
58*e7be843bSPierre Pronchery continue;
59*e7be843bSPierre Pronchery
60*e7be843bSPierre Pronchery /* Connect the socket to the server's address */
61*e7be843bSPierre Pronchery if (!BIO_connect(sock, BIO_ADDRINFO_address(ai), 0)) {
62*e7be843bSPierre Pronchery BIO_closesocket(sock);
63*e7be843bSPierre Pronchery sock = -1;
64*e7be843bSPierre Pronchery continue;
65*e7be843bSPierre Pronchery }
66*e7be843bSPierre Pronchery
67*e7be843bSPierre Pronchery /* Set to nonblocking mode */
68*e7be843bSPierre Pronchery if (!BIO_socket_nbio(sock, 1)) {
69*e7be843bSPierre Pronchery BIO_closesocket(sock);
70*e7be843bSPierre Pronchery sock = -1;
71*e7be843bSPierre Pronchery continue;
72*e7be843bSPierre Pronchery }
73*e7be843bSPierre Pronchery
74*e7be843bSPierre Pronchery break;
75*e7be843bSPierre Pronchery }
76*e7be843bSPierre Pronchery
77*e7be843bSPierre Pronchery if (sock != -1) {
78*e7be843bSPierre Pronchery *peer_addr = BIO_ADDR_dup(BIO_ADDRINFO_address(ai));
79*e7be843bSPierre Pronchery if (*peer_addr == NULL) {
80*e7be843bSPierre Pronchery BIO_closesocket(sock);
81*e7be843bSPierre Pronchery return NULL;
82*e7be843bSPierre Pronchery }
83*e7be843bSPierre Pronchery }
84*e7be843bSPierre Pronchery
85*e7be843bSPierre Pronchery /* Free the address information resources we allocated earlier */
86*e7be843bSPierre Pronchery BIO_ADDRINFO_free(res);
87*e7be843bSPierre Pronchery
88*e7be843bSPierre Pronchery /* If sock is -1 then we've been unable to connect to the server */
89*e7be843bSPierre Pronchery if (sock == -1)
90*e7be843bSPierre Pronchery return NULL;
91*e7be843bSPierre Pronchery
92*e7be843bSPierre Pronchery /* Create a BIO to wrap the socket */
93*e7be843bSPierre Pronchery bio = BIO_new(BIO_s_datagram());
94*e7be843bSPierre Pronchery if (bio == NULL) {
95*e7be843bSPierre Pronchery BIO_closesocket(sock);
96*e7be843bSPierre Pronchery return NULL;
97*e7be843bSPierre Pronchery }
98*e7be843bSPierre Pronchery
99*e7be843bSPierre Pronchery /*
100*e7be843bSPierre Pronchery * Associate the newly created BIO with the underlying socket. By
101*e7be843bSPierre Pronchery * passing BIO_CLOSE here the socket will be automatically closed when
102*e7be843bSPierre Pronchery * the BIO is freed. Alternatively you can use BIO_NOCLOSE, in which
103*e7be843bSPierre Pronchery * case you must close the socket explicitly when it is no longer
104*e7be843bSPierre Pronchery * needed.
105*e7be843bSPierre Pronchery */
106*e7be843bSPierre Pronchery BIO_set_fd(bio, sock, BIO_CLOSE);
107*e7be843bSPierre Pronchery
108*e7be843bSPierre Pronchery return bio;
109*e7be843bSPierre Pronchery }
110*e7be843bSPierre Pronchery
111*e7be843bSPierre Pronchery /*
112*e7be843bSPierre Pronchery * Simple application to send a basic HTTP/1.0 request to a server and
113*e7be843bSPierre Pronchery * print the response on the screen. Note that HTTP/1.0 over QUIC is
114*e7be843bSPierre Pronchery * non-standard and will not typically be supported by real world servers. This
115*e7be843bSPierre Pronchery * is for demonstration purposes only.
116*e7be843bSPierre Pronchery */
main(int argc,char * argv[])117*e7be843bSPierre Pronchery int main(int argc, char *argv[])
118*e7be843bSPierre Pronchery {
119*e7be843bSPierre Pronchery SSL_CTX *ctx = NULL;
120*e7be843bSPierre Pronchery SSL *ssl = NULL;
121*e7be843bSPierre Pronchery BIO *bio = NULL;
122*e7be843bSPierre Pronchery int res = EXIT_FAILURE;
123*e7be843bSPierre Pronchery int ret;
124*e7be843bSPierre Pronchery unsigned char alpn[] = { 8, 'h', 't', 't', 'p', '/', '1', '.', '0' };
125*e7be843bSPierre Pronchery const char *request_start = "GET / HTTP/1.0\r\nConnection: close\r\nHost: ";
126*e7be843bSPierre Pronchery const char *request_end = "\r\n\r\n";
127*e7be843bSPierre Pronchery size_t written, readbytes;
128*e7be843bSPierre Pronchery char buf[160];
129*e7be843bSPierre Pronchery BIO_ADDR *peer_addr = NULL;
130*e7be843bSPierre Pronchery char *hostname, *port;
131*e7be843bSPierre Pronchery int argnext = 1;
132*e7be843bSPierre Pronchery int ipv6 = 0;
133*e7be843bSPierre Pronchery
134*e7be843bSPierre Pronchery if (argc < 3) {
135*e7be843bSPierre Pronchery printf("Usage: quic-client-block [-6] hostname port\n");
136*e7be843bSPierre Pronchery goto end;
137*e7be843bSPierre Pronchery }
138*e7be843bSPierre Pronchery
139*e7be843bSPierre Pronchery if (!strcmp(argv[argnext], "-6")) {
140*e7be843bSPierre Pronchery if (argc < 4) {
141*e7be843bSPierre Pronchery printf("Usage: quic-client-block [-6] hostname port\n");
142*e7be843bSPierre Pronchery goto end;
143*e7be843bSPierre Pronchery }
144*e7be843bSPierre Pronchery ipv6 = 1;
145*e7be843bSPierre Pronchery argnext++;
146*e7be843bSPierre Pronchery }
147*e7be843bSPierre Pronchery hostname = argv[argnext++];
148*e7be843bSPierre Pronchery port = argv[argnext];
149*e7be843bSPierre Pronchery
150*e7be843bSPierre Pronchery /*
151*e7be843bSPierre Pronchery * Create an SSL_CTX which we can use to create SSL objects from. We
152*e7be843bSPierre Pronchery * want an SSL_CTX for creating clients so we use
153*e7be843bSPierre Pronchery * OSSL_QUIC_client_method() here.
154*e7be843bSPierre Pronchery */
155*e7be843bSPierre Pronchery ctx = SSL_CTX_new(OSSL_QUIC_client_method());
156*e7be843bSPierre Pronchery if (ctx == NULL) {
157*e7be843bSPierre Pronchery printf("Failed to create the SSL_CTX\n");
158*e7be843bSPierre Pronchery goto end;
159*e7be843bSPierre Pronchery }
160*e7be843bSPierre Pronchery
161*e7be843bSPierre Pronchery /*
162*e7be843bSPierre Pronchery * Configure the client to abort the handshake if certificate
163*e7be843bSPierre Pronchery * verification fails. Virtually all clients should do this unless you
164*e7be843bSPierre Pronchery * really know what you are doing.
165*e7be843bSPierre Pronchery */
166*e7be843bSPierre Pronchery SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
167*e7be843bSPierre Pronchery
168*e7be843bSPierre Pronchery /* Use the default trusted certificate store */
169*e7be843bSPierre Pronchery if (!SSL_CTX_set_default_verify_paths(ctx)) {
170*e7be843bSPierre Pronchery printf("Failed to set the default trusted certificate store\n");
171*e7be843bSPierre Pronchery goto end;
172*e7be843bSPierre Pronchery }
173*e7be843bSPierre Pronchery
174*e7be843bSPierre Pronchery /* Create an SSL object to represent the TLS connection */
175*e7be843bSPierre Pronchery ssl = SSL_new(ctx);
176*e7be843bSPierre Pronchery if (ssl == NULL) {
177*e7be843bSPierre Pronchery printf("Failed to create the SSL object\n");
178*e7be843bSPierre Pronchery goto end;
179*e7be843bSPierre Pronchery }
180*e7be843bSPierre Pronchery
181*e7be843bSPierre Pronchery /*
182*e7be843bSPierre Pronchery * Create the underlying transport socket/BIO and associate it with the
183*e7be843bSPierre Pronchery * connection.
184*e7be843bSPierre Pronchery */
185*e7be843bSPierre Pronchery bio = create_socket_bio(hostname, port, ipv6 ? AF_INET6 : AF_INET, &peer_addr);
186*e7be843bSPierre Pronchery if (bio == NULL) {
187*e7be843bSPierre Pronchery printf("Failed to crete the BIO\n");
188*e7be843bSPierre Pronchery goto end;
189*e7be843bSPierre Pronchery }
190*e7be843bSPierre Pronchery SSL_set_bio(ssl, bio, bio);
191*e7be843bSPierre Pronchery
192*e7be843bSPierre Pronchery /*
193*e7be843bSPierre Pronchery * Tell the server during the handshake which hostname we are attempting
194*e7be843bSPierre Pronchery * to connect to in case the server supports multiple hosts.
195*e7be843bSPierre Pronchery */
196*e7be843bSPierre Pronchery if (!SSL_set_tlsext_host_name(ssl, hostname)) {
197*e7be843bSPierre Pronchery printf("Failed to set the SNI hostname\n");
198*e7be843bSPierre Pronchery goto end;
199*e7be843bSPierre Pronchery }
200*e7be843bSPierre Pronchery
201*e7be843bSPierre Pronchery /*
202*e7be843bSPierre Pronchery * Ensure we check during certificate verification that the server has
203*e7be843bSPierre Pronchery * supplied a certificate for the hostname that we were expecting.
204*e7be843bSPierre Pronchery * Virtually all clients should do this unless you really know what you
205*e7be843bSPierre Pronchery * are doing.
206*e7be843bSPierre Pronchery */
207*e7be843bSPierre Pronchery if (!SSL_set1_host(ssl, hostname)) {
208*e7be843bSPierre Pronchery printf("Failed to set the certificate verification hostname");
209*e7be843bSPierre Pronchery goto end;
210*e7be843bSPierre Pronchery }
211*e7be843bSPierre Pronchery
212*e7be843bSPierre Pronchery /* SSL_set_alpn_protos returns 0 for success! */
213*e7be843bSPierre Pronchery if (SSL_set_alpn_protos(ssl, alpn, sizeof(alpn)) != 0) {
214*e7be843bSPierre Pronchery printf("Failed to set the ALPN for the connection\n");
215*e7be843bSPierre Pronchery goto end;
216*e7be843bSPierre Pronchery }
217*e7be843bSPierre Pronchery
218*e7be843bSPierre Pronchery /* Set the IP address of the remote peer */
219*e7be843bSPierre Pronchery if (!SSL_set1_initial_peer_addr(ssl, peer_addr)) {
220*e7be843bSPierre Pronchery printf("Failed to set the initial peer address\n");
221*e7be843bSPierre Pronchery goto end;
222*e7be843bSPierre Pronchery }
223*e7be843bSPierre Pronchery
224*e7be843bSPierre Pronchery /* Do the handshake with the server */
225*e7be843bSPierre Pronchery if (SSL_connect(ssl) < 1) {
226*e7be843bSPierre Pronchery printf("Failed to connect to the server\n");
227*e7be843bSPierre Pronchery /*
228*e7be843bSPierre Pronchery * If the failure is due to a verification error we can get more
229*e7be843bSPierre Pronchery * information about it from SSL_get_verify_result().
230*e7be843bSPierre Pronchery */
231*e7be843bSPierre Pronchery if (SSL_get_verify_result(ssl) != X509_V_OK)
232*e7be843bSPierre Pronchery printf("Verify error: %s\n",
233*e7be843bSPierre Pronchery X509_verify_cert_error_string(SSL_get_verify_result(ssl)));
234*e7be843bSPierre Pronchery goto end;
235*e7be843bSPierre Pronchery }
236*e7be843bSPierre Pronchery
237*e7be843bSPierre Pronchery /* Write an HTTP GET request to the peer */
238*e7be843bSPierre Pronchery if (!SSL_write_ex(ssl, request_start, strlen(request_start), &written)) {
239*e7be843bSPierre Pronchery printf("Failed to write start of HTTP request\n");
240*e7be843bSPierre Pronchery goto end;
241*e7be843bSPierre Pronchery }
242*e7be843bSPierre Pronchery if (!SSL_write_ex(ssl, hostname, strlen(hostname), &written)) {
243*e7be843bSPierre Pronchery printf("Failed to write hostname in HTTP request\n");
244*e7be843bSPierre Pronchery goto end;
245*e7be843bSPierre Pronchery }
246*e7be843bSPierre Pronchery if (!SSL_write_ex2(ssl, request_end, strlen(request_end),
247*e7be843bSPierre Pronchery SSL_WRITE_FLAG_CONCLUDE, &written)) {
248*e7be843bSPierre Pronchery printf("Failed to write end of HTTP request\n");
249*e7be843bSPierre Pronchery goto end;
250*e7be843bSPierre Pronchery }
251*e7be843bSPierre Pronchery
252*e7be843bSPierre Pronchery /*
253*e7be843bSPierre Pronchery * Get up to sizeof(buf) bytes of the response. We keep reading until the
254*e7be843bSPierre Pronchery * server closes the connection.
255*e7be843bSPierre Pronchery */
256*e7be843bSPierre Pronchery while (SSL_read_ex(ssl, buf, sizeof(buf), &readbytes)) {
257*e7be843bSPierre Pronchery /*
258*e7be843bSPierre Pronchery * OpenSSL does not guarantee that the returned data is a string or
259*e7be843bSPierre Pronchery * that it is NUL terminated so we use fwrite() to write the exact
260*e7be843bSPierre Pronchery * number of bytes that we read. The data could be non-printable or
261*e7be843bSPierre Pronchery * have NUL characters in the middle of it. For this simple example
262*e7be843bSPierre Pronchery * we're going to print it to stdout anyway.
263*e7be843bSPierre Pronchery */
264*e7be843bSPierre Pronchery fwrite(buf, 1, readbytes, stdout);
265*e7be843bSPierre Pronchery }
266*e7be843bSPierre Pronchery /* In case the response didn't finish with a newline we add one now */
267*e7be843bSPierre Pronchery printf("\n");
268*e7be843bSPierre Pronchery
269*e7be843bSPierre Pronchery /*
270*e7be843bSPierre Pronchery * Check whether we finished the while loop above normally or as the
271*e7be843bSPierre Pronchery * result of an error. The 0 argument to SSL_get_error() is the return
272*e7be843bSPierre Pronchery * code we received from the SSL_read_ex() call. It must be 0 in order
273*e7be843bSPierre Pronchery * to get here. Normal completion is indicated by SSL_ERROR_ZERO_RETURN. In
274*e7be843bSPierre Pronchery * QUIC terms this means that the peer has sent FIN on the stream to
275*e7be843bSPierre Pronchery * indicate that no further data will be sent.
276*e7be843bSPierre Pronchery */
277*e7be843bSPierre Pronchery switch (SSL_get_error(ssl, 0)) {
278*e7be843bSPierre Pronchery case SSL_ERROR_ZERO_RETURN:
279*e7be843bSPierre Pronchery /* Normal completion of the stream */
280*e7be843bSPierre Pronchery break;
281*e7be843bSPierre Pronchery
282*e7be843bSPierre Pronchery case SSL_ERROR_SSL:
283*e7be843bSPierre Pronchery /*
284*e7be843bSPierre Pronchery * Some stream fatal error occurred. This could be because of a stream
285*e7be843bSPierre Pronchery * reset - or some failure occurred on the underlying connection.
286*e7be843bSPierre Pronchery */
287*e7be843bSPierre Pronchery switch (SSL_get_stream_read_state(ssl)) {
288*e7be843bSPierre Pronchery case SSL_STREAM_STATE_RESET_REMOTE:
289*e7be843bSPierre Pronchery printf("Stream reset occurred\n");
290*e7be843bSPierre Pronchery /* The stream has been reset but the connection is still healthy. */
291*e7be843bSPierre Pronchery break;
292*e7be843bSPierre Pronchery
293*e7be843bSPierre Pronchery case SSL_STREAM_STATE_CONN_CLOSED:
294*e7be843bSPierre Pronchery printf("Connection closed\n");
295*e7be843bSPierre Pronchery /* Connection is already closed. Skip SSL_shutdown() */
296*e7be843bSPierre Pronchery goto end;
297*e7be843bSPierre Pronchery
298*e7be843bSPierre Pronchery default:
299*e7be843bSPierre Pronchery printf("Unknown stream failure\n");
300*e7be843bSPierre Pronchery break;
301*e7be843bSPierre Pronchery }
302*e7be843bSPierre Pronchery break;
303*e7be843bSPierre Pronchery
304*e7be843bSPierre Pronchery default:
305*e7be843bSPierre Pronchery /* Some other unexpected error occurred */
306*e7be843bSPierre Pronchery printf ("Failed reading remaining data\n");
307*e7be843bSPierre Pronchery break;
308*e7be843bSPierre Pronchery }
309*e7be843bSPierre Pronchery
310*e7be843bSPierre Pronchery /*
311*e7be843bSPierre Pronchery * Repeatedly call SSL_shutdown() until the connection is fully
312*e7be843bSPierre Pronchery * closed.
313*e7be843bSPierre Pronchery */
314*e7be843bSPierre Pronchery do {
315*e7be843bSPierre Pronchery ret = SSL_shutdown(ssl);
316*e7be843bSPierre Pronchery if (ret < 0) {
317*e7be843bSPierre Pronchery printf("Error shutting down: %d\n", ret);
318*e7be843bSPierre Pronchery goto end;
319*e7be843bSPierre Pronchery }
320*e7be843bSPierre Pronchery } while (ret != 1);
321*e7be843bSPierre Pronchery
322*e7be843bSPierre Pronchery /* Success! */
323*e7be843bSPierre Pronchery res = EXIT_SUCCESS;
324*e7be843bSPierre Pronchery end:
325*e7be843bSPierre Pronchery /*
326*e7be843bSPierre Pronchery * If something bad happened then we will dump the contents of the
327*e7be843bSPierre Pronchery * OpenSSL error stack to stderr. There might be some useful diagnostic
328*e7be843bSPierre Pronchery * information there.
329*e7be843bSPierre Pronchery */
330*e7be843bSPierre Pronchery if (res == EXIT_FAILURE)
331*e7be843bSPierre Pronchery ERR_print_errors_fp(stderr);
332*e7be843bSPierre Pronchery
333*e7be843bSPierre Pronchery /*
334*e7be843bSPierre Pronchery * Free the resources we allocated. We do not free the BIO object here
335*e7be843bSPierre Pronchery * because ownership of it was immediately transferred to the SSL object
336*e7be843bSPierre Pronchery * via SSL_set_bio(). The BIO will be freed when we free the SSL object.
337*e7be843bSPierre Pronchery */
338*e7be843bSPierre Pronchery SSL_free(ssl);
339*e7be843bSPierre Pronchery SSL_CTX_free(ctx);
340*e7be843bSPierre Pronchery BIO_ADDR_free(peer_addr);
341*e7be843bSPierre Pronchery return res;
342*e7be843bSPierre Pronchery }
343