Topic: Test Code to Connect and Verify Cert

[Migrated from SourceForge forums]


xangis
(2010-08-04 19:32:59 UTC)

I'm working on building a standalone test app based on the example code.  What I have so far is this :

int client_test(int argc, char* argv[])
{
   int ret = 0;
   cout << "argc = " << argc << endl;
   for(int i = 0; i < argc; i++)
      cout << "argv[" << i << "] = " << argv << endl;

   if( argc < 3 ) {
       cout << "Not enough arguments supplied.  Usage:  test <servername> <port>" << endl;
       return 0;
   }

#ifdef _WIN32
    WSADATA wsd;
    WSAStartup(0x0002, &wsd);
#endif

    SOCKET_T sockfd = 0;

    cout << "Calling tcp_connect()" << endl;
    int port = atoi(argv[2]);
    if( port <= 0 ) {
        return 0;
        cout << "Invalid port supplied.  Must be a positive integer." << endl;
    }
    tcp_connect(sockfd, argv[1], port);
#ifdef NON_BLOCKING
    tcp_set_nonblocking(sockfd);
#endif

    cout << "Using TLSv1_client_method." << endl;
    SSL_METHOD* method = TLSv1_client_method();
    //printf("Using SSLv3_client_method.\n");
    //SSL_METHOD* method = SSLv3_client_method();
    SSL_CTX*    ctx = SSL_CTX_new(method);
    cout << "Setting certificates." << endl;
    set_certs(ctx);
    SSL* ssl = SSL_new(ctx);
    cout << "Setting SSL socket fd to " << sockfd << endl;
    SSL_set_fd(ssl, sockfd);
#ifdef NON_BLOCKING
    cout << "Calling NonBlockingSSL_Connect." << endl;
    NonBlockingSSL_Connect(ssl, ctx, sockfd);
#else
    ret = SSL_connect(ssl);
    cout << "SSL_connect return value: " << ret << endl;
#endif

    cout << "Showing peer info.\n" << endl;
    showPeer(ssl);

    const char* cipher = 0;
    int index = 0;
    char list[1024];
    strncpy(list, "cipherlist", 11);
    while ( (cipher = SSL_get_cipher_list(ssl, index++)) ) {
        strncat(list, ":", 2);
        strncat(list, cipher, strlen(cipher) + 1);
    }
    cout << list << endl;
    cout << "Using Cipher Suite: " << SSL_get_cipher(ssl) << endl;

    cout << "Sending hello with SSL_write." << endl;
    char msg[] = "hello yassl!";
    if (SSL_write(ssl, msg, sizeof(msg)) != sizeof(msg))
        ClientError(ctx, ssl, sockfd, "SSL_write failed");

    char reply[1024];
    cout << "Reading server response." << endl;
    int input = SSL_read(ssl, reply, sizeof(reply));
    if (input > 0) {
        reply[input] = 0;
        printf("Server response: %s\n", reply);
    }

    cout << "SSL_shutdown." << endl;
    SSL_shutdown(ssl);
    cout << "SSL_free." << endl;
    SSL_free(ssl);
    cout << "tcp_close" << endl;
    tcp_close(sockfd);
    cout << "SSL_CTX_free" << endl;
    SSL_CTX_free(ctx);

    return 0;
}

Whether I run the application against another server on my network with a self-signed certificate, or against mail.google.com, which has a thawte certificate, I get the following result (1039 error from taocrypt):

argc = 3
argv[0] = test
argv[1] = 192.168.1.221
argv[2] = 5001
Calling tcp_connect()
Using hostname 192.168.1.221 port 5001
Calling connect().
Using TLSv1_client_method.
Setting certificates.
Setting SSL socket fd to 684
SSL_connect: Checking errors.
SSL_connect: CONNECT_BEGIN, sending client hello.
SSL_connect: CLIENT_HELLO_SENT, getting states.
SSL_connect: FIRST_REPLY_DONE.  Send verify.
SSL_connect: Sending client key exchange.
SSL_connect: Sending change cipher.
SSL_connect: Sending finished.
SSL_connect: Flushing buffer.
SSL_connect: FINISHED_DONE.  Getting resuming info.
SSL_connect: SECOND_REPLY_DONE.  Verifying state.
SSL_connect: Second reply done.  Calling ShowTCP.
Error: 1039, ThreadID: 3768
SSL_connect: Error, 1039 (1039) returning SSL_FATAL_ERROR.
SSL_connect return value: -1
Showing peer info.
peer's cert info:
 issuer : /C=US/ST=California/L=Mountain View/O=Authentic8/CN=Jay Sorg/emailAddress=jsorg@authentic8.com
 subject: /C=US/ST=California/L=Mountain View/O=Authentic8/CN=Jay Sorg/emailAddress=jsorg@authentic8.com
cipherlist:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:AES256-RMD:AES128-RMD:DES-CBC3-RMD:DHE-RSA-AES256-RMD:DHE-RSA-AES128-RMD:DHE-RSA-DES-CBC3-RMD:DHE-DSS-AES256-RMD:DHE-DSS-AES128-RMD:DHE-DSS-DES-CBC3-RMD:RC4-SHA:RC4-MD5:DES-CBC3-SHA:DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA
Using Cipher Suite: AES256-SHA
Sending hello with SSL_write.
yassl error: SSL_write failed

I see that the error 1039 corresponds to SIG_OTHER_E,  "Bad other signature confirmation", but don't see how it's generated (or how to prevent it from happening).  What should I look into or do differently?

Thank you,
Jason


touska
(2010-08-09 17:28:21 UTC)

You're getting the error 1039 because you haven't loaded the CA certificates to properly verify the server's certificate.  In the client example ca-cert.pem is loaded so that it can verify server-cert.pem.  You'll need to do the same for the sites you wish to connect to.  Please see the note at the top the README file.