1*e7be843bSPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2023-2025 The OpenSSL Project Authors. All Rights Reserved.
3*e7be843bSPierre Pronchery *
4*e7be843bSPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5*e7be843bSPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6*e7be843bSPierre Pronchery * in the file LICENSE in the source distribution or at
7*e7be843bSPierre Pronchery * https://www.openssl.org/source/license.html
8*e7be843bSPierre Pronchery */
9*e7be843bSPierre Pronchery
10*e7be843bSPierre Pronchery /*
11*e7be843bSPierre Pronchery * NB: Changes to this file should also be reflected in
12*e7be843bSPierre Pronchery * doc/man7/ossl-guide-tls-client-block.pod
13*e7be843bSPierre Pronchery */
14*e7be843bSPierre Pronchery
15*e7be843bSPierre Pronchery #include <string.h>
16*e7be843bSPierre Pronchery
17*e7be843bSPierre Pronchery /* Include the appropriate header file for SOCK_STREAM */
18*e7be843bSPierre Pronchery #ifdef _WIN32 /* Windows */
19*e7be843bSPierre Pronchery # include <winsock2.h>
20*e7be843bSPierre Pronchery #else /* Linux/Unix */
21*e7be843bSPierre Pronchery # include <sys/socket.h>
22*e7be843bSPierre Pronchery #endif
23*e7be843bSPierre Pronchery
24*e7be843bSPierre Pronchery #include <openssl/bio.h>
25*e7be843bSPierre Pronchery #include <openssl/ssl.h>
26*e7be843bSPierre Pronchery #include <openssl/err.h>
27*e7be843bSPierre Pronchery
28*e7be843bSPierre Pronchery /* Helper function to create a BIO connected to the server */
create_socket_bio(const char * hostname,const char * port,int family)29*e7be843bSPierre Pronchery static BIO *create_socket_bio(const char *hostname, const char *port, int family)
30*e7be843bSPierre Pronchery {
31*e7be843bSPierre Pronchery int sock = -1;
32*e7be843bSPierre Pronchery BIO_ADDRINFO *res;
33*e7be843bSPierre Pronchery const BIO_ADDRINFO *ai = NULL;
34*e7be843bSPierre Pronchery BIO *bio;
35*e7be843bSPierre Pronchery
36*e7be843bSPierre Pronchery /*
37*e7be843bSPierre Pronchery * Lookup IP address info for the server.
38*e7be843bSPierre Pronchery */
39*e7be843bSPierre Pronchery if (!BIO_lookup_ex(hostname, port, BIO_LOOKUP_CLIENT, family, SOCK_STREAM, 0,
40*e7be843bSPierre Pronchery &res))
41*e7be843bSPierre Pronchery return NULL;
42*e7be843bSPierre Pronchery
43*e7be843bSPierre Pronchery /*
44*e7be843bSPierre Pronchery * Loop through all the possible addresses for the server and find one
45*e7be843bSPierre Pronchery * we can connect to.
46*e7be843bSPierre Pronchery */
47*e7be843bSPierre Pronchery for (ai = res; ai != NULL; ai = BIO_ADDRINFO_next(ai)) {
48*e7be843bSPierre Pronchery /*
49*e7be843bSPierre Pronchery * Create a TCP socket. We could equally use non-OpenSSL calls such
50*e7be843bSPierre Pronchery * as "socket" here for this and the subsequent connect and close
51*e7be843bSPierre Pronchery * functions. But for portability reasons and also so that we get
52*e7be843bSPierre Pronchery * errors on the OpenSSL stack in the event of a failure we use
53*e7be843bSPierre Pronchery * OpenSSL's versions of these functions.
54*e7be843bSPierre Pronchery */
55*e7be843bSPierre Pronchery sock = BIO_socket(BIO_ADDRINFO_family(ai), SOCK_STREAM, 0, 0);
56*e7be843bSPierre Pronchery if (sock == -1)
57*e7be843bSPierre Pronchery continue;
58*e7be843bSPierre Pronchery
59*e7be843bSPierre Pronchery /* Connect the socket to the server's address */
60*e7be843bSPierre Pronchery if (!BIO_connect(sock, BIO_ADDRINFO_address(ai), BIO_SOCK_NODELAY)) {
61*e7be843bSPierre Pronchery BIO_closesocket(sock);
62*e7be843bSPierre Pronchery sock = -1;
63*e7be843bSPierre Pronchery continue;
64*e7be843bSPierre Pronchery }
65*e7be843bSPierre Pronchery
66*e7be843bSPierre Pronchery /* We have a connected socket so break out of the loop */
67*e7be843bSPierre Pronchery break;
68*e7be843bSPierre Pronchery }
69*e7be843bSPierre Pronchery
70*e7be843bSPierre Pronchery /* Free the address information resources we allocated earlier */
71*e7be843bSPierre Pronchery BIO_ADDRINFO_free(res);
72*e7be843bSPierre Pronchery
73*e7be843bSPierre Pronchery /* If sock is -1 then we've been unable to connect to the server */
74*e7be843bSPierre Pronchery if (sock == -1)
75*e7be843bSPierre Pronchery return NULL;
76*e7be843bSPierre Pronchery
77*e7be843bSPierre Pronchery /* Create a BIO to wrap the socket */
78*e7be843bSPierre Pronchery bio = BIO_new(BIO_s_socket());
79*e7be843bSPierre Pronchery if (bio == NULL) {
80*e7be843bSPierre Pronchery BIO_closesocket(sock);
81*e7be843bSPierre Pronchery return NULL;
82*e7be843bSPierre Pronchery }
83*e7be843bSPierre Pronchery
84*e7be843bSPierre Pronchery /*
85*e7be843bSPierre Pronchery * Associate the newly created BIO with the underlying socket. By
86*e7be843bSPierre Pronchery * passing BIO_CLOSE here the socket will be automatically closed when
87*e7be843bSPierre Pronchery * the BIO is freed. Alternatively you can use BIO_NOCLOSE, in which
88*e7be843bSPierre Pronchery * case you must close the socket explicitly when it is no longer
89*e7be843bSPierre Pronchery * needed.
90*e7be843bSPierre Pronchery */
91*e7be843bSPierre Pronchery BIO_set_fd(bio, sock, BIO_CLOSE);
92*e7be843bSPierre Pronchery
93*e7be843bSPierre Pronchery return bio;
94*e7be843bSPierre Pronchery }
95*e7be843bSPierre Pronchery
96*e7be843bSPierre Pronchery /*
97*e7be843bSPierre Pronchery * Simple application to send a basic HTTP/1.0 request to a server and
98*e7be843bSPierre Pronchery * print the response on the screen.
99*e7be843bSPierre Pronchery */
main(int argc,char * argv[])100*e7be843bSPierre Pronchery int main(int argc, char *argv[])
101*e7be843bSPierre Pronchery {
102*e7be843bSPierre Pronchery SSL_CTX *ctx = NULL;
103*e7be843bSPierre Pronchery SSL *ssl = NULL;
104*e7be843bSPierre Pronchery BIO *bio = NULL;
105*e7be843bSPierre Pronchery int res = EXIT_FAILURE;
106*e7be843bSPierre Pronchery int ret;
107*e7be843bSPierre Pronchery const char *request_start = "GET / HTTP/1.0\r\nConnection: close\r\nHost: ";
108*e7be843bSPierre Pronchery const char *request_end = "\r\n\r\n";
109*e7be843bSPierre Pronchery size_t written, readbytes;
110*e7be843bSPierre Pronchery char buf[160];
111*e7be843bSPierre Pronchery char *hostname, *port;
112*e7be843bSPierre Pronchery int argnext = 1;
113*e7be843bSPierre Pronchery int ipv6 = 0;
114*e7be843bSPierre Pronchery
115*e7be843bSPierre Pronchery if (argc < 3) {
116*e7be843bSPierre Pronchery printf("Usage: tls-client-block [-6] hostname port\n");
117*e7be843bSPierre Pronchery goto end;
118*e7be843bSPierre Pronchery }
119*e7be843bSPierre Pronchery
120*e7be843bSPierre Pronchery if (!strcmp(argv[argnext], "-6")) {
121*e7be843bSPierre Pronchery if (argc < 4) {
122*e7be843bSPierre Pronchery printf("Usage: tls-client-block [-6] hostname port\n");
123*e7be843bSPierre Pronchery goto end;
124*e7be843bSPierre Pronchery }
125*e7be843bSPierre Pronchery ipv6 = 1;
126*e7be843bSPierre Pronchery argnext++;
127*e7be843bSPierre Pronchery }
128*e7be843bSPierre Pronchery hostname = argv[argnext++];
129*e7be843bSPierre Pronchery port = argv[argnext];
130*e7be843bSPierre Pronchery
131*e7be843bSPierre Pronchery /*
132*e7be843bSPierre Pronchery * Create an SSL_CTX which we can use to create SSL objects from. We
133*e7be843bSPierre Pronchery * want an SSL_CTX for creating clients so we use TLS_client_method()
134*e7be843bSPierre Pronchery * here.
135*e7be843bSPierre Pronchery */
136*e7be843bSPierre Pronchery ctx = SSL_CTX_new(TLS_client_method());
137*e7be843bSPierre Pronchery if (ctx == NULL) {
138*e7be843bSPierre Pronchery printf("Failed to create the SSL_CTX\n");
139*e7be843bSPierre Pronchery goto end;
140*e7be843bSPierre Pronchery }
141*e7be843bSPierre Pronchery
142*e7be843bSPierre Pronchery /*
143*e7be843bSPierre Pronchery * Configure the client to abort the handshake if certificate
144*e7be843bSPierre Pronchery * verification fails. Virtually all clients should do this unless you
145*e7be843bSPierre Pronchery * really know what you are doing.
146*e7be843bSPierre Pronchery */
147*e7be843bSPierre Pronchery SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
148*e7be843bSPierre Pronchery
149*e7be843bSPierre Pronchery /* Use the default trusted certificate store */
150*e7be843bSPierre Pronchery if (!SSL_CTX_set_default_verify_paths(ctx)) {
151*e7be843bSPierre Pronchery printf("Failed to set the default trusted certificate store\n");
152*e7be843bSPierre Pronchery goto end;
153*e7be843bSPierre Pronchery }
154*e7be843bSPierre Pronchery
155*e7be843bSPierre Pronchery /*
156*e7be843bSPierre Pronchery * TLSv1.1 or earlier are deprecated by IETF and are generally to be
157*e7be843bSPierre Pronchery * avoided if possible. We require a minimum TLS version of TLSv1.2.
158*e7be843bSPierre Pronchery */
159*e7be843bSPierre Pronchery if (!SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION)) {
160*e7be843bSPierre Pronchery printf("Failed to set the minimum TLS protocol version\n");
161*e7be843bSPierre Pronchery goto end;
162*e7be843bSPierre Pronchery }
163*e7be843bSPierre Pronchery
164*e7be843bSPierre Pronchery /* Create an SSL object to represent the TLS connection */
165*e7be843bSPierre Pronchery ssl = SSL_new(ctx);
166*e7be843bSPierre Pronchery if (ssl == NULL) {
167*e7be843bSPierre Pronchery printf("Failed to create the SSL object\n");
168*e7be843bSPierre Pronchery goto end;
169*e7be843bSPierre Pronchery }
170*e7be843bSPierre Pronchery
171*e7be843bSPierre Pronchery /*
172*e7be843bSPierre Pronchery * Create the underlying transport socket/BIO and associate it with the
173*e7be843bSPierre Pronchery * connection.
174*e7be843bSPierre Pronchery */
175*e7be843bSPierre Pronchery bio = create_socket_bio(hostname, port, ipv6 ? AF_INET6 : AF_INET);
176*e7be843bSPierre Pronchery if (bio == NULL) {
177*e7be843bSPierre Pronchery printf("Failed to create the BIO\n");
178*e7be843bSPierre Pronchery goto end;
179*e7be843bSPierre Pronchery }
180*e7be843bSPierre Pronchery SSL_set_bio(ssl, bio, bio);
181*e7be843bSPierre Pronchery
182*e7be843bSPierre Pronchery /*
183*e7be843bSPierre Pronchery * Tell the server during the handshake which hostname we are attempting
184*e7be843bSPierre Pronchery * to connect to in case the server supports multiple hosts.
185*e7be843bSPierre Pronchery */
186*e7be843bSPierre Pronchery if (!SSL_set_tlsext_host_name(ssl, hostname)) {
187*e7be843bSPierre Pronchery printf("Failed to set the SNI hostname\n");
188*e7be843bSPierre Pronchery goto end;
189*e7be843bSPierre Pronchery }
190*e7be843bSPierre Pronchery
191*e7be843bSPierre Pronchery /*
192*e7be843bSPierre Pronchery * Ensure we check during certificate verification that the server has
193*e7be843bSPierre Pronchery * supplied a certificate for the hostname that we were expecting.
194*e7be843bSPierre Pronchery * Virtually all clients should do this unless you really know what you
195*e7be843bSPierre Pronchery * are doing.
196*e7be843bSPierre Pronchery */
197*e7be843bSPierre Pronchery if (!SSL_set1_host(ssl, hostname)) {
198*e7be843bSPierre Pronchery printf("Failed to set the certificate verification hostname");
199*e7be843bSPierre Pronchery goto end;
200*e7be843bSPierre Pronchery }
201*e7be843bSPierre Pronchery
202*e7be843bSPierre Pronchery /* Do the handshake with the server */
203*e7be843bSPierre Pronchery if (SSL_connect(ssl) < 1) {
204*e7be843bSPierre Pronchery printf("Failed to connect to the server\n");
205*e7be843bSPierre Pronchery /*
206*e7be843bSPierre Pronchery * If the failure is due to a verification error we can get more
207*e7be843bSPierre Pronchery * information about it from SSL_get_verify_result().
208*e7be843bSPierre Pronchery */
209*e7be843bSPierre Pronchery if (SSL_get_verify_result(ssl) != X509_V_OK)
210*e7be843bSPierre Pronchery printf("Verify error: %s\n",
211*e7be843bSPierre Pronchery X509_verify_cert_error_string(SSL_get_verify_result(ssl)));
212*e7be843bSPierre Pronchery goto end;
213*e7be843bSPierre Pronchery }
214*e7be843bSPierre Pronchery
215*e7be843bSPierre Pronchery /* Write an HTTP GET request to the peer */
216*e7be843bSPierre Pronchery if (!SSL_write_ex(ssl, request_start, strlen(request_start), &written)) {
217*e7be843bSPierre Pronchery printf("Failed to write start of HTTP request\n");
218*e7be843bSPierre Pronchery goto end;
219*e7be843bSPierre Pronchery }
220*e7be843bSPierre Pronchery if (!SSL_write_ex(ssl, hostname, strlen(hostname), &written)) {
221*e7be843bSPierre Pronchery printf("Failed to write hostname in HTTP request\n");
222*e7be843bSPierre Pronchery goto end;
223*e7be843bSPierre Pronchery }
224*e7be843bSPierre Pronchery if (!SSL_write_ex(ssl, request_end, strlen(request_end), &written)) {
225*e7be843bSPierre Pronchery printf("Failed to write end of HTTP request\n");
226*e7be843bSPierre Pronchery goto end;
227*e7be843bSPierre Pronchery }
228*e7be843bSPierre Pronchery
229*e7be843bSPierre Pronchery /*
230*e7be843bSPierre Pronchery * Get up to sizeof(buf) bytes of the response. We keep reading until the
231*e7be843bSPierre Pronchery * server closes the connection.
232*e7be843bSPierre Pronchery */
233*e7be843bSPierre Pronchery while (SSL_read_ex(ssl, buf, sizeof(buf), &readbytes)) {
234*e7be843bSPierre Pronchery /*
235*e7be843bSPierre Pronchery * OpenSSL does not guarantee that the returned data is a string or
236*e7be843bSPierre Pronchery * that it is NUL terminated so we use fwrite() to write the exact
237*e7be843bSPierre Pronchery * number of bytes that we read. The data could be non-printable or
238*e7be843bSPierre Pronchery * have NUL characters in the middle of it. For this simple example
239*e7be843bSPierre Pronchery * we're going to print it to stdout anyway.
240*e7be843bSPierre Pronchery */
241*e7be843bSPierre Pronchery fwrite(buf, 1, readbytes, stdout);
242*e7be843bSPierre Pronchery }
243*e7be843bSPierre Pronchery /* In case the response didn't finish with a newline we add one now */
244*e7be843bSPierre Pronchery printf("\n");
245*e7be843bSPierre Pronchery
246*e7be843bSPierre Pronchery /*
247*e7be843bSPierre Pronchery * Check whether we finished the while loop above normally or as the
248*e7be843bSPierre Pronchery * result of an error. The 0 argument to SSL_get_error() is the return
249*e7be843bSPierre Pronchery * code we received from the SSL_read_ex() call. It must be 0 in order
250*e7be843bSPierre Pronchery * to get here. Normal completion is indicated by SSL_ERROR_ZERO_RETURN.
251*e7be843bSPierre Pronchery */
252*e7be843bSPierre Pronchery if (SSL_get_error(ssl, 0) != SSL_ERROR_ZERO_RETURN) {
253*e7be843bSPierre Pronchery /*
254*e7be843bSPierre Pronchery * Some error occurred other than a graceful close down by the
255*e7be843bSPierre Pronchery * peer.
256*e7be843bSPierre Pronchery */
257*e7be843bSPierre Pronchery printf ("Failed reading remaining data\n");
258*e7be843bSPierre Pronchery goto end;
259*e7be843bSPierre Pronchery }
260*e7be843bSPierre Pronchery
261*e7be843bSPierre Pronchery /*
262*e7be843bSPierre Pronchery * The peer already shutdown gracefully (we know this because of the
263*e7be843bSPierre Pronchery * SSL_ERROR_ZERO_RETURN above). We should do the same back.
264*e7be843bSPierre Pronchery */
265*e7be843bSPierre Pronchery ret = SSL_shutdown(ssl);
266*e7be843bSPierre Pronchery if (ret < 1) {
267*e7be843bSPierre Pronchery /*
268*e7be843bSPierre Pronchery * ret < 0 indicates an error. ret == 0 would be unexpected here
269*e7be843bSPierre Pronchery * because that means "we've sent a close_notify and we're waiting
270*e7be843bSPierre Pronchery * for one back". But we already know we got one from the peer
271*e7be843bSPierre Pronchery * because of the SSL_ERROR_ZERO_RETURN above.
272*e7be843bSPierre Pronchery */
273*e7be843bSPierre Pronchery printf("Error shutting down\n");
274*e7be843bSPierre Pronchery goto end;
275*e7be843bSPierre Pronchery }
276*e7be843bSPierre Pronchery
277*e7be843bSPierre Pronchery /* Success! */
278*e7be843bSPierre Pronchery res = EXIT_SUCCESS;
279*e7be843bSPierre Pronchery end:
280*e7be843bSPierre Pronchery /*
281*e7be843bSPierre Pronchery * If something bad happened then we will dump the contents of the
282*e7be843bSPierre Pronchery * OpenSSL error stack to stderr. There might be some useful diagnostic
283*e7be843bSPierre Pronchery * information there.
284*e7be843bSPierre Pronchery */
285*e7be843bSPierre Pronchery if (res == EXIT_FAILURE)
286*e7be843bSPierre Pronchery ERR_print_errors_fp(stderr);
287*e7be843bSPierre Pronchery
288*e7be843bSPierre Pronchery /*
289*e7be843bSPierre Pronchery * Free the resources we allocated. We do not free the BIO object here
290*e7be843bSPierre Pronchery * because ownership of it was immediately transferred to the SSL object
291*e7be843bSPierre Pronchery * via SSL_set_bio(). The BIO will be freed when we free the SSL object.
292*e7be843bSPierre Pronchery */
293*e7be843bSPierre Pronchery SSL_free(ssl);
294*e7be843bSPierre Pronchery SSL_CTX_free(ctx);
295*e7be843bSPierre Pronchery return res;
296*e7be843bSPierre Pronchery }
297