openssl - BIO_do_handshake() 总是返回 0

Question

 int rtn =  BIO_do_handshake(sbio);

printf("\n.. returns  %d   .. \n",rtn);


if( rtn <= 0)
{
    fprintf(stderr, "Error in SSL handshake\n");
    ERR_print_errors_fp(stderr);

}

我从 here 写了这段代码

但是 BIO_do_handshake() 总是返回 0 为什么？

证书没问题!!

有任何想法吗 ？？

请帮我..

谢谢

Answer 1

我们确实需要查看更多代码，但这是我如何使用 BIO_new_ssl_connect和 friend 。你打过电话吗BIO_new_ssl_connect ?你打过电话吗BIO_set_conn_hostname ?你打过电话吗BIO_do_connconnect ?

下面的代码连接到 www.random.org 并将结果打印到屏幕上。还有一些其他的检查你必须做，但它们不在热使用的范围内BIO_new_ssl_connect和 friend 。

此外，生物读取循环并不健壮，所以不要在生产代码中使用它(示例有另一个目的)。最后，您可以使用 ERR_print_errors_fp用于打印错误。在生产中，我做其他事情所以ERR_print_errors_fp通常是不够的(因此是简单的 fprintf 的原因)。

long ret = 1;
unsigned long ssl_err = 0;

SSL_CTX* ctx = NULL;
BIO *bio = NULL, *out = NULL;
SSL *ssl = NULL;

/* Cipher suites, https://www.openssl.org/docs/apps/ciphers.html */
const char* const PREFERRED_CIPHERS = "kEECDH:kEDH:kRSA:AESGCM:AES256:AES128:3DES:SHA256:SHA84:SHA1:!aNULL:!eNULL:!EXP:!LOW:!MEDIUM!MD5";

do {
    /* https://www.openssl.org/docs/ssl/SSL_library_init.html */
    ret = SSL_library_init();
    ssl_err = ERR_get_error();

    ASSERT(ret == 1);
    if(!(ret == 1))
    {
        fprintf(stderr, "SSL_library_init: %lu (0x%lx)\n", ssl_err , ssl_err);
        break; /* failed */
    }

    /* https://www.openssl.org/docs/ssl/SSL_CTX_new.html */
    const SSL_METHOD* method = SSLv23_method();
    ssl_err = ERR_get_error();

    ASSERT(NULL != method);
    if(!(NULL != method))
    {
        fprintf(stderr, "SSLv23_method failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break; /* failed */
    }

    /* http://www.openssl.org/docs/ssl/ctx_new.html */
    ctx = SSL_CTX_new(method);
    ssl_err = ERR_get_error();

    ASSERT(ctx != NULL);
    if(!(ctx != NULL))
    {
        fprintf(stderr, "SSL_CTX_new failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break; /* failed */
    }

    /* https://www.openssl.org/docs/ssl/ctx_set_verify.html */
    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, bio_pin_pubkey_callback);
    /* Cannot fail ??? */

    /* https://www.openssl.org/docs/ssl/ctx_set_verify.html */
    SSL_CTX_set_verify_depth(ctx, 5);
    /* Cannot fail ??? */

    /* Remove most egregious. Because SSLv2 and SSLv3 have been removed,  */
    /* a TLSv1.0 handshake is used. The client accepts TLSv1.0 and above. */
    const long flags = SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
    long old_opts = SSL_CTX_set_options(ctx, flags);
    UNUSED(old_opts);

    /* http://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html */
    ret = SSL_CTX_load_verify_locations(ctx, "random-org-chain.pem", NULL);
    ssl_err = ERR_get_error();

    ASSERT(1 == ret);
    if(!(1 == ret))
    {
        /* Non-fatal, but something else will probably break later */
        fprintf(stderr, "SSL_CTX_load_verify_locations failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        /* break; */
    }

    /* https://www.openssl.org/docs/crypto/BIO_f_ssl.html */
    bio = BIO_new_ssl_connect(ctx);
    ssl_err = ERR_get_error();

    ASSERT(bio != NULL);
    if(!(bio != NULL))
    {
        fprintf(stderr, "BIO_new_ssl_connect failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break; /* failed */
    }

    /* https://www.openssl.org/docs/crypto/BIO_f_ssl.html */
    /* This copies an internal pointer. No need to free.  */
    BIO_get_ssl(bio, &ssl);
    ssl_err = ERR_get_error();

    ASSERT(ssl != NULL);
    if(!(ssl != NULL))
    {
        fprintf(stderr, "BIO_get_ssl failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break; /* failed */
    }

    /* https://www.openssl.org/docs/ssl/ssl.html#DEALING_WITH_PROTOCOL_CONTEXTS */
    /* https://www.openssl.org/docs/ssl/SSL_CTX_set_cipher_list.html            */
    ret = SSL_set_cipher_list(ssl, PREFERRED_CIPHERS);
    ssl_err = ERR_get_error();

    ASSERT(1 == ret);
    if(!(1 == ret))
    {
        fprintf(stderr, "SSL_set_cipher_list failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break;
    }

    /* https://www.openssl.org/docs/crypto/BIO_s_connect.html */
    ret = BIO_set_conn_hostname(bio, HOST_NAME ":" HOST_PORT);
    ssl_err = ERR_get_error();

    ASSERT(1 == ret);
    if(!(1 == ret))
    {
        fprintf(stderr, "BIO_set_conn_hostname failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break;
    }

    /* https://www.openssl.org/docs/crypto/BIO_s_file.html */
    out = BIO_new_fp(stdout, BIO_NOCLOSE);
    ssl_err = ERR_get_error();

    ASSERT(NULL != out);
    if(!(NULL != out))
    {
        fprintf(stderr, "BIO_new_fp failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break;
    }

    /* https://www.openssl.org/docs/crypto/BIO_s_connect.html */
    ret = BIO_do_connect(bio);
    ssl_err = ERR_get_error();

    ASSERT(1 == ret);
    if(!(1 == ret))
    {
        fprintf(stderr, "BIO_do_connect failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break;
    }

    /* https://www.openssl.org/docs/crypto/BIO_f_ssl.html */
    ret = BIO_do_handshake(bio);
    ssl_err = ERR_get_error();

    ASSERT(1 == ret);
    if(!(1 == ret))
    {
        fprintf(stderr, "BIO_do_handshake failed: %lu (0x%lx)\n", ssl_err , ssl_err);
        break;
    }

    /* Could examine ssl here to get connection info */
    BIO_write(out, "\n", 1);
    BIO_puts(bio, "GET / HTTP/1.0\r\nConnection: close\r\n\r\n");
BIO_READ_TOP:
    {
        char buff[1536]; int len = 0;

        /* https://www.openssl.org/docs/crypto/BIO_read.html */
        len = BIO_read(bio, buff, sizeof(buff));

        if(len > 0)
            BIO_write(out, buff, len);

        if(BIO_should_retry(bio)) goto BIO_READ_TOP;
    }

    func_ret = SUCCESS;

} while (0);

if(out)
    BIO_free(out);

if(bio != NULL)
    BIO_free_all(bio);

if(NULL != ctx)
    SSL_CTX_free(ctx);