Example of secure server-client program using OpenSSL in C

Example of secure server-client program using OpenSSL in C

In this example code, we will create a secure connection between client and server using the TLS1.2 protocol. In this communication, the client sends an XML request to the server which contains the username and password.

The server verifies the XML request, if it is valid then it sends a proper XML response to the client either give a message of Invalid Request.

Install the OpenSSL library, for the ubuntu use the below command.

sudo apt-get install libssl–dev

Before compiling the client and server program you will need a Certificate. You can generate your own certificate using the below command.

openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mycert.pem -out mycert.pem

Note: Here certificate name is mycert.pem.

Example Client code for TLS1.2 communication

Compile the Client : gcc -Wall -o client  Client.c -L/usr/lib -lssl -lcrypto
Run :   ./client <host_name> <port_number>

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127

#include <stdio.h> #include <errno.h> #include <unistd.h> #include <malloc.h> #include <string.h> #include <sys/socket.h> #include <resolv.h> #include <netdb.h> #include <openssl/ssl.h> #include <openssl/err.h> #define FAIL    -1 int OpenConnection(const char *hostname, int port) {   int sd;     struct hostent *host;     struct sockaddr_in addr;     if ( (host = gethostbyname(hostname)) == NULL )     {         perror(hostname);         abort();     }     sd = socket(PF_INET, SOCK_STREAM, 0);     bzero(&addr, sizeof(addr));     addr.sin_family = AF_INET;     addr.sin_port = htons(port);     addr.sin_addr.s_addr = *(long*)(host->h_addr);     if ( connect(sd, (struct sockaddr*)&addr, sizeof(addr)) != 0 )     {         close(sd);         perror(hostname);         abort();     }     return sd; } SSL_CTX* InitCTX(void) {   SSL_METHOD *method;     SSL_CTX *ctx;     OpenSSL_add_all_algorithms();  /* Load cryptos, et.al. */     SSL_load_error_strings();   /* Bring in and register error messages */     method = TLSv1_2_client_method();  /* Create new client-method instance */     ctx = SSL_CTX_new(method);   /* Create new context */     if ( ctx == NULL )     {         ERR_print_errors_fp(stderr);         abort();     }     return ctx; } void ShowCerts(SSL* ssl) {   X509 *cert;     char *line;     cert = SSL_get_peer_certificate(ssl); /* get the server's certificate */     if ( cert != NULL )     {         printf("Server certificates:\n");         line = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);         printf("Subject: %s\n", line);         free(line);       /* free the malloc'ed string */         line = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);         printf("Issuer: %s\n", line);         free(line);       /* free the malloc'ed string */         X509_free(cert);     /* free the malloc'ed certificate copy */     }     else         printf("Info: No client certificates configured.\n"); } int main(int count, char *strings[]) {   SSL_CTX *ctx;     int server;     SSL *ssl;     char buf[1024]; char acClientRequest[1024] ={0};     int bytes;     char *hostname, *portnum;     if ( count != 3 )     {         printf("usage: %s <hostname> <portnum>\n", strings[0]);         exit(0);     }     SSL_library_init();     hostname=strings[1];     portnum=strings[2];     ctx = InitCTX();     server = OpenConnection(hostname, atoi(portnum));     ssl = SSL_new(ctx);      /* create new SSL connection state */     SSL_set_fd(ssl, server);    /* attach the socket descriptor */     if ( SSL_connect(ssl) == FAIL )   /* perform the connection */         ERR_print_errors_fp(stderr);     else     {             char acUsername[16] ={0}; char acPassword[16] ={0};     const char *cpRequestMessage = "<Body>\                              <UserName>%s<UserName>\ <Password>%s<Password>\ <\Body>";         printf("Enter the User Name : "); scanf("%s",acUsername); printf("\n\nEnter the Password : "); scanf("%s",acPassword);         sprintf(acClientRequest, cpRequestMessage, acUsername,acPassword);   /* construct reply */         printf("\n\nConnected with %s encryption\n", SSL_get_cipher(ssl));         ShowCerts(ssl);        /* get any certs */         SSL_write(ssl,acClientRequest, strlen(acClientRequest));   /* encrypt & send message */         bytes = SSL_read(ssl, buf, sizeof(buf)); /* get reply & decrypt */         buf[bytes] = 0;         printf("Received: \"%s\"\n", buf);         SSL_free(ssl);        /* release connection state */     }     close(server);         /* close socket */     SSL_CTX_free(ctx);        /* release context */     return 0; }

Example Server code for TLS1.2 communication

Compile the Server : gcc -Wall -o server Server.c -L/usr/lib -lssl -lcrypto
Run : sudo ./server <portnum>

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196

#include <errno.h> #include <unistd.h> #include <malloc.h> #include <string.h> #include <arpa/inet.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <resolv.h> #include "openssl/ssl.h" #include "openssl/err.h" #define FAIL    -1 // Create the SSL socket and intialize the socket address structure int OpenListener(int port) {   int sd;     struct sockaddr_in addr;     sd = socket(PF_INET, SOCK_STREAM, 0);     bzero(&addr, sizeof(addr));     addr.sin_family = AF_INET;     addr.sin_port = htons(port);     addr.sin_addr.s_addr = INADDR_ANY;     if (bind(sd, (struct sockaddr*)&addr, sizeof(addr)) != 0 )     {         perror("can't bind port");         abort();     }     if ( listen(sd, 10) != 0 )     {         perror("Can't configure listening port");         abort();     }     return sd; } int isRoot() {     if (getuid() != 0)     {         return 0;     }     else     {         return 1;     } } SSL_CTX* InitServerCTX(void) {   SSL_METHOD *method;     SSL_CTX *ctx;     OpenSSL_add_all_algorithms();  /* load & register all cryptos, etc. */     SSL_load_error_strings();   /* load all error messages */     method = TLSv1_2_server_method();  /* create new server-method instance */     ctx = SSL_CTX_new(method);   /* create new context from method */     if ( ctx == NULL )     {         ERR_print_errors_fp(stderr);         abort();     }     return ctx; } void LoadCertificates(SSL_CTX* ctx, char* CertFile, char* KeyFile) {     /* set the local certificate from CertFile */     if ( SSL_CTX_use_certificate_file(ctx, CertFile, SSL_FILETYPE_PEM) <= 0 )     {         ERR_print_errors_fp(stderr);         abort();     }     /* set the private key from KeyFile (may be the same as CertFile) */     if ( SSL_CTX_use_PrivateKey_file(ctx, KeyFile, SSL_FILETYPE_PEM) <= 0 )     {         ERR_print_errors_fp(stderr);         abort();     }     /* verify private key */     if ( !SSL_CTX_check_private_key(ctx) )     {         fprintf(stderr, "Private key does not match the public certificate\n");         abort();     } } void ShowCerts(SSL* ssl) {   X509 *cert;     char *line;     cert = SSL_get_peer_certificate(ssl); /* Get certificates (if available) */     if ( cert != NULL )     {         printf("Server certificates:\n");         line = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);         printf("Subject: %s\n", line);         free(line);         line = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);         printf("Issuer: %s\n", line);         free(line);         X509_free(cert);     }     else         printf("No certificates.\n"); } void Servlet(SSL* ssl) /* Serve the connection -- threadable */ {   char buf[1024] = {0};        int sd, bytes;     const char* ServerResponse="<\Body>\                              <Name>aticleworld.com</Name>\ <year>1.5</year>\ <BlogType>Embedede and c\c++<\BlogType>\ <Author>amlendra<Author>\ <\Body>"; const char *cpValidMessage = "<Body>\                              <UserName>aticle<UserName>\ <Password>123<Password>\ <\Body>";     if ( SSL_accept(ssl) == FAIL )     /* do SSL-protocol accept */         ERR_print_errors_fp(stderr);     else     {         ShowCerts(ssl);        /* get any certificates */         bytes = SSL_read(ssl, buf, sizeof(buf)); /* get request */ buf[bytes] = '\0'; printf("Client msg: \"%s\"\n", buf);         if ( bytes > 0 )         {     if(strcmp(cpValidMessage,buf) == 0) { SSL_write(ssl, ServerResponse, strlen(ServerResponse)); /* send reply */ } else { SSL_write(ssl, "Invalid Message", strlen("Invalid Message")); /* send reply */ }         }         else { ERR_print_errors_fp(stderr); }                  }     sd = SSL_get_fd(ssl);       /* get socket connection */     SSL_free(ssl);         /* release SSL state */     close(sd);          /* close connection */ } int main(int count, char *Argc[]) {   SSL_CTX *ctx;     int server;     char *portnum; //Only root user have the permsion to run the server     if(!isRoot())     {         printf("This program must be run as root/sudo user!!");         exit(0);     }     if ( count != 2 )     {         printf("Usage: %s <portnum>\n", Argc[0]);         exit(0);     } // Initialize the SSL library     SSL_library_init();     portnum = Argc[1];     ctx = InitServerCTX();        /* initialize SSL */     LoadCertificates(ctx, "mycert.pem", "mycert.pem"); /* load certs */     server = OpenListener(atoi(portnum));    /* create server socket */     while (1)     {   struct sockaddr_in addr;         socklen_t len = sizeof(addr);         SSL *ssl;         int client = accept(server, (struct sockaddr*)&addr, &len);  /* accept connection as usual */         printf("Connection: %s:%d\n",inet_ntoa(addr.sin_addr), ntohs(addr.sin_port));         ssl = SSL_new(ctx);              /* get new SSL state with context */         SSL_set_fd(ssl, client);      /* set connection socket to SSL state */         Servlet(ssl);         /* service connection */     }     close(server);          /* close server socket */     SSL_CTX_free(ctx);         /* release context */ }

How to run client server program?

Server run first, using the below command we will run the server and wait for the client request.

sudo ./server  8081

Note: In above command 8081 is the port number.

After that, we will run client using the below command and send the XML request.

./client  127.0.0.1 8081

Note: In above command,  127.0.0.1 is the local host IP and 8081 is the port number.

If the client sends a valid request as per the server then server give a proper response.

Client XML Request:

1 2 3 4

"<Body> <UserName>aticle<UserName> <Password>123<Password> <Body>"

Server Response:

1 2 3 4 5 6

"<Body> <Name>aticleworld.com</Name> <year>1.5</year> <BlogType>Embedede and c c++<BlogType> <Author>amlendra<Author> <Body>"

If the client sends an invalid request to the server then server give a response to an “Invalid message”.

Client XML Request:

1 2 3 4

"<Body> <UserName>amlendra<UserName> <Password>1235<Password> <Body>"

Server Response:

“Invalid Message”