/* * UDP proxy: emulate an unreliable UDP connection for DTLS testing * * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ /* * Warning: this is an internal utility program we use for tests. * It does break some abstractions from the NET layer, and is thus NOT an * example of good general usage. */ #define MBEDTLS_ALLOW_PRIVATE_ACCESS #include "mbedtls/build_info.h" #if defined(MBEDTLS_PLATFORM_C) #include "mbedtls/platform.h" #else #include #include #if defined(MBEDTLS_HAVE_TIME) #include #define mbedtls_time time #define mbedtls_time_t time_t #endif #define mbedtls_printf printf #define mbedtls_calloc calloc #define mbedtls_free free #define mbedtls_exit exit #define MBEDTLS_EXIT_SUCCESS EXIT_SUCCESS #define MBEDTLS_EXIT_FAILURE EXIT_FAILURE #endif /* MBEDTLS_PLATFORM_C */ #if !defined(MBEDTLS_NET_C) int main(void) { mbedtls_printf("MBEDTLS_NET_C not defined.\n"); mbedtls_exit(0); } #else #include "mbedtls/net_sockets.h" #include "mbedtls/error.h" #include "mbedtls/ssl.h" #include "mbedtls/timing.h" #include /* For select() */ #if (defined(_WIN32) || defined(_WIN32_WCE)) && !defined(EFIX64) && \ !defined(EFI32) #include #include #if defined(_MSC_VER) #if defined(_WIN32_WCE) #pragma comment( lib, "ws2.lib" ) #else #pragma comment( lib, "ws2_32.lib" ) #endif #endif /* _MSC_VER */ #else /* ( _WIN32 || _WIN32_WCE ) && !EFIX64 && !EFI32 */ #if defined(MBEDTLS_HAVE_TIME) || (defined(MBEDTLS_TIMING_C) && !defined(MBEDTLS_TIMING_ALT)) #include #endif #include #include #include #endif /* ( _WIN32 || _WIN32_WCE ) && !EFIX64 && !EFI32 */ #define MAX_MSG_SIZE 16384 + 2048 /* max record/datagram size */ #define DFL_SERVER_ADDR "localhost" #define DFL_SERVER_PORT "4433" #define DFL_LISTEN_ADDR "localhost" #define DFL_LISTEN_PORT "5556" #define DFL_PACK 0 #if defined(MBEDTLS_TIMING_C) #define USAGE_PACK \ " pack=%%d default: 0 (don't pack)\n" \ " options: t > 0 (pack for t milliseconds)\n" #else #define USAGE_PACK #endif #define USAGE \ "\n usage: udp_proxy param=<>...\n" \ "\n acceptable parameters:\n" \ " server_addr=%%s default: localhost\n" \ " server_port=%%d default: 4433\n" \ " listen_addr=%%s default: localhost\n" \ " listen_port=%%d default: 4433\n" \ "\n" \ " duplicate=%%d default: 0 (no duplication)\n" \ " duplicate about 1:N packets randomly\n" \ " delay=%%d default: 0 (no delayed packets)\n" \ " delay about 1:N packets randomly\n" \ " delay_ccs=0/1 default: 0 (don't delay ChangeCipherSpec)\n" \ " delay_cli=%%s Handshake message from client that should be\n" \ " delayed. Possible values are 'ClientHello',\n" \ " 'Certificate', 'CertificateVerify', and\n" \ " 'ClientKeyExchange'.\n" \ " May be used multiple times, even for the same\n" \ " message, in which case the respective message\n" \ " gets delayed multiple times.\n" \ " delay_srv=%%s Handshake message from server that should be\n" \ " delayed. Possible values are 'HelloRequest',\n" \ " 'ServerHello', 'ServerHelloDone', 'Certificate'\n" \ " 'ServerKeyExchange', 'NewSessionTicket',\n" \ " 'HelloVerifyRequest' and ''CertificateRequest'.\n" \ " May be used multiple times, even for the same\n" \ " message, in which case the respective message\n" \ " gets delayed multiple times.\n" \ " drop=%%d default: 0 (no dropped packets)\n" \ " drop about 1:N packets randomly\n" \ " mtu=%%d default: 0 (unlimited)\n" \ " drop packets larger than N bytes\n" \ " bad_ad=0/1 default: 0 (don't add bad ApplicationData)\n" \ " bad_cid=%%d default: 0 (don't corrupt Connection IDs)\n" \ " duplicate 1:N packets containing a CID,\n" \ " modifying CID in first instance of the packet.\n" \ " protect_hvr=0/1 default: 0 (don't protect HelloVerifyRequest)\n" \ " protect_len=%%d default: (don't protect packets of this size)\n" \ " inject_clihlo=0/1 default: 0 (don't inject fake ClientHello)\n" \ "\n" \ " seed=%%d default: (use current time)\n" \ USAGE_PACK \ "\n" /* * global options */ #define MAX_DELAYED_HS 10 static struct options { const char *server_addr; /* address to forward packets to */ const char *server_port; /* port to forward packets to */ const char *listen_addr; /* address for accepting client connections */ const char *listen_port; /* port for accepting client connections */ int duplicate; /* duplicate 1 in N packets (none if 0) */ int delay; /* delay 1 packet in N (none if 0) */ int delay_ccs; /* delay ChangeCipherSpec */ char *delay_cli[MAX_DELAYED_HS]; /* handshake types of messages from * client that should be delayed. */ uint8_t delay_cli_cnt; /* Number of entries in delay_cli. */ char *delay_srv[MAX_DELAYED_HS]; /* handshake types of messages from * server that should be delayed. */ uint8_t delay_srv_cnt; /* Number of entries in delay_srv. */ int drop; /* drop 1 packet in N (none if 0) */ int mtu; /* drop packets larger than this */ int bad_ad; /* inject corrupted ApplicationData record */ unsigned bad_cid; /* inject corrupted CID record */ int protect_hvr; /* never drop or delay HelloVerifyRequest */ int protect_len; /* never drop/delay packet of the given size*/ int inject_clihlo; /* inject fake ClientHello after handshake */ unsigned pack; /* merge packets into single datagram for * at most \c merge milliseconds if > 0 */ unsigned int seed; /* seed for "random" events */ } opt; static void exit_usage(const char *name, const char *value) { if (value == NULL) { mbedtls_printf(" unknown option or missing value: %s\n", name); } else { mbedtls_printf(" option %s: illegal value: %s\n", name, value); } mbedtls_printf(USAGE); mbedtls_exit(1); } static void get_options(int argc, char *argv[]) { int i; char *p, *q; opt.server_addr = DFL_SERVER_ADDR; opt.server_port = DFL_SERVER_PORT; opt.listen_addr = DFL_LISTEN_ADDR; opt.listen_port = DFL_LISTEN_PORT; opt.pack = DFL_PACK; /* Other members default to 0 */ opt.delay_cli_cnt = 0; opt.delay_srv_cnt = 0; memset(opt.delay_cli, 0, sizeof(opt.delay_cli)); memset(opt.delay_srv, 0, sizeof(opt.delay_srv)); for (i = 1; i < argc; i++) { p = argv[i]; if ((q = strchr(p, '=')) == NULL) { exit_usage(p, NULL); } *q++ = '\0'; if (strcmp(p, "server_addr") == 0) { opt.server_addr = q; } else if (strcmp(p, "server_port") == 0) { opt.server_port = q; } else if (strcmp(p, "listen_addr") == 0) { opt.listen_addr = q; } else if (strcmp(p, "listen_port") == 0) { opt.listen_port = q; } else if (strcmp(p, "duplicate") == 0) { opt.duplicate = atoi(q); if (opt.duplicate < 0 || opt.duplicate > 20) { exit_usage(p, q); } } else if (strcmp(p, "delay") == 0) { opt.delay = atoi(q); if (opt.delay < 0 || opt.delay > 20 || opt.delay == 1) { exit_usage(p, q); } } else if (strcmp(p, "delay_ccs") == 0) { opt.delay_ccs = atoi(q); if (opt.delay_ccs < 0 || opt.delay_ccs > 1) { exit_usage(p, q); } } else if (strcmp(p, "delay_cli") == 0 || strcmp(p, "delay_srv") == 0) { uint8_t *delay_cnt; char **delay_list; size_t len; char *buf; if (strcmp(p, "delay_cli") == 0) { delay_cnt = &opt.delay_cli_cnt; delay_list = opt.delay_cli; } else { delay_cnt = &opt.delay_srv_cnt; delay_list = opt.delay_srv; } if (*delay_cnt == MAX_DELAYED_HS) { mbedtls_printf(" too many uses of %s: only %d allowed\n", p, MAX_DELAYED_HS); exit_usage(p, NULL); } len = strlen(q); buf = mbedtls_calloc(1, len + 1); if (buf == NULL) { mbedtls_printf(" Allocation failure\n"); exit(1); } memcpy(buf, q, len + 1); delay_list[(*delay_cnt)++] = buf; } else if (strcmp(p, "drop") == 0) { opt.drop = atoi(q); if (opt.drop < 0 || opt.drop > 20 || opt.drop == 1) { exit_usage(p, q); } } else if (strcmp(p, "pack") == 0) { #if defined(MBEDTLS_TIMING_C) opt.pack = (unsigned) atoi(q); #else mbedtls_printf(" option pack only defined if MBEDTLS_TIMING_C is enabled\n"); exit(1); #endif } else if (strcmp(p, "mtu") == 0) { opt.mtu = atoi(q); if (opt.mtu < 0 || opt.mtu > MAX_MSG_SIZE) { exit_usage(p, q); } } else if (strcmp(p, "bad_ad") == 0) { opt.bad_ad = atoi(q); if (opt.bad_ad < 0 || opt.bad_ad > 1) { exit_usage(p, q); } } #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) else if (strcmp(p, "bad_cid") == 0) { opt.bad_cid = (unsigned) atoi(q); } #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ else if (strcmp(p, "protect_hvr") == 0) { opt.protect_hvr = atoi(q); if (opt.protect_hvr < 0 || opt.protect_hvr > 1) { exit_usage(p, q); } } else if (strcmp(p, "protect_len") == 0) { opt.protect_len = atoi(q); if (opt.protect_len < 0) { exit_usage(p, q); } } else if (strcmp(p, "inject_clihlo") == 0) { opt.inject_clihlo = atoi(q); if (opt.inject_clihlo < 0 || opt.inject_clihlo > 1) { exit_usage(p, q); } } else if (strcmp(p, "seed") == 0) { opt.seed = atoi(q); if (opt.seed == 0) { exit_usage(p, q); } } else { exit_usage(p, NULL); } } } static const char *msg_type(unsigned char *msg, size_t len) { if (len < 1) { return "Invalid"; } switch (msg[0]) { case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC: return "ChangeCipherSpec"; case MBEDTLS_SSL_MSG_ALERT: return "Alert"; case MBEDTLS_SSL_MSG_APPLICATION_DATA: return "ApplicationData"; case MBEDTLS_SSL_MSG_CID: return "CID"; case MBEDTLS_SSL_MSG_HANDSHAKE: break; /* See below */ default: return "Unknown"; } if (len < 13 + 12) { return "Invalid handshake"; } /* * Our handshake message are less than 2^16 bytes long, so they should * have 0 as the first byte of length, frag_offset and frag_length. * Otherwise, assume they are encrypted. */ if (msg[14] || msg[19] || msg[22]) { return "Encrypted handshake"; } switch (msg[13]) { case MBEDTLS_SSL_HS_HELLO_REQUEST: return "HelloRequest"; case MBEDTLS_SSL_HS_CLIENT_HELLO: return "ClientHello"; case MBEDTLS_SSL_HS_SERVER_HELLO: return "ServerHello"; case MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST: return "HelloVerifyRequest"; case MBEDTLS_SSL_HS_NEW_SESSION_TICKET: return "NewSessionTicket"; case MBEDTLS_SSL_HS_CERTIFICATE: return "Certificate"; case MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE: return "ServerKeyExchange"; case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST: return "CertificateRequest"; case MBEDTLS_SSL_HS_SERVER_HELLO_DONE: return "ServerHelloDone"; case MBEDTLS_SSL_HS_CERTIFICATE_VERIFY: return "CertificateVerify"; case MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE: return "ClientKeyExchange"; case MBEDTLS_SSL_HS_FINISHED: return "Finished"; default: return "Unknown handshake"; } } #if defined(MBEDTLS_TIMING_C) /* Return elapsed time in milliseconds since the first call */ static unsigned elapsed_time(void) { static int initialized = 0; static struct mbedtls_timing_hr_time hires; if (initialized == 0) { (void) mbedtls_timing_get_timer(&hires, 1); initialized = 1; return 0; } return mbedtls_timing_get_timer(&hires, 0); } typedef struct { mbedtls_net_context *ctx; const char *description; unsigned packet_lifetime; unsigned num_datagrams; unsigned char data[MAX_MSG_SIZE]; size_t len; } ctx_buffer; static ctx_buffer outbuf[2]; static int ctx_buffer_flush(ctx_buffer *buf) { int ret; mbedtls_printf(" %05u flush %s: %u bytes, %u datagrams, last %u ms\n", elapsed_time(), buf->description, (unsigned) buf->len, buf->num_datagrams, elapsed_time() - buf->packet_lifetime); ret = mbedtls_net_send(buf->ctx, buf->data, buf->len); buf->len = 0; buf->num_datagrams = 0; return ret; } static unsigned ctx_buffer_time_remaining(ctx_buffer *buf) { unsigned const cur_time = elapsed_time(); if (buf->num_datagrams == 0) { return (unsigned) -1; } if (cur_time - buf->packet_lifetime >= opt.pack) { return 0; } return opt.pack - (cur_time - buf->packet_lifetime); } static int ctx_buffer_append(ctx_buffer *buf, const unsigned char *data, size_t len) { int ret; if (len > (size_t) INT_MAX) { return -1; } if (len > sizeof(buf->data)) { mbedtls_printf(" ! buffer size %u too large (max %u)\n", (unsigned) len, (unsigned) sizeof(buf->data)); return -1; } if (sizeof(buf->data) - buf->len < len) { if ((ret = ctx_buffer_flush(buf)) <= 0) { mbedtls_printf("ctx_buffer_flush failed with -%#04x", (unsigned int) -ret); return ret; } } memcpy(buf->data + buf->len, data, len); buf->len += len; if (++buf->num_datagrams == 1) { buf->packet_lifetime = elapsed_time(); } return (int) len; } #endif /* MBEDTLS_TIMING_C */ static int dispatch_data(mbedtls_net_context *ctx, const unsigned char *data, size_t len) { int ret; #if defined(MBEDTLS_TIMING_C) ctx_buffer *buf = NULL; if (opt.pack > 0) { if (outbuf[0].ctx == ctx) { buf = &outbuf[0]; } else if (outbuf[1].ctx == ctx) { buf = &outbuf[1]; } if (buf == NULL) { return -1; } return ctx_buffer_append(buf, data, len); } #endif /* MBEDTLS_TIMING_C */ ret = mbedtls_net_send(ctx, data, len); if (ret < 0) { mbedtls_printf("net_send returned -%#04x\n", (unsigned int) -ret); } return ret; } typedef struct { mbedtls_net_context *dst; const char *way; const char *type; unsigned len; unsigned char buf[MAX_MSG_SIZE]; } packet; /* Print packet. Outgoing packets come with a reason (forward, dupl, etc.) */ void print_packet(const packet *p, const char *why) { #if defined(MBEDTLS_TIMING_C) if (why == NULL) { mbedtls_printf(" %05u dispatch %s %s (%u bytes)\n", elapsed_time(), p->way, p->type, p->len); } else { mbedtls_printf(" %05u dispatch %s %s (%u bytes): %s\n", elapsed_time(), p->way, p->type, p->len, why); } #else if (why == NULL) { mbedtls_printf(" dispatch %s %s (%u bytes)\n", p->way, p->type, p->len); } else { mbedtls_printf(" dispatch %s %s (%u bytes): %s\n", p->way, p->type, p->len, why); } #endif fflush(stdout); } /* * In order to test the server's behaviour when receiving a ClientHello after * the connection is established (this could be a hard reset from the client, * but the server must not drop the existing connection before establishing * client reachability, see RFC 6347 Section 4.2.8), we memorize the first * ClientHello we see (which can't have a cookie), then replay it after the * first ApplicationData record - then we're done. * * This is controlled by the inject_clihlo option. * * We want an explicit state and a place to store the packet. */ typedef enum { ICH_INIT, /* haven't seen the first ClientHello yet */ ICH_CACHED, /* cached the initial ClientHello */ ICH_INJECTED, /* ClientHello already injected, done */ } inject_clihlo_state_t; static inject_clihlo_state_t inject_clihlo_state; static packet initial_clihlo; int send_packet(const packet *p, const char *why) { int ret; mbedtls_net_context *dst = p->dst; /* save initial ClientHello? */ if (opt.inject_clihlo != 0 && inject_clihlo_state == ICH_INIT && strcmp(p->type, "ClientHello") == 0) { memcpy(&initial_clihlo, p, sizeof(packet)); inject_clihlo_state = ICH_CACHED; } /* insert corrupted CID record? */ if (opt.bad_cid != 0 && strcmp(p->type, "CID") == 0 && (rand() % opt.bad_cid) == 0) { unsigned char buf[MAX_MSG_SIZE]; memcpy(buf, p->buf, p->len); /* The CID resides at offset 11 in the DTLS record header. */ buf[11] ^= 1; print_packet(p, "modified CID"); if ((ret = dispatch_data(dst, buf, p->len)) <= 0) { mbedtls_printf(" ! dispatch returned %d\n", ret); return ret; } } /* insert corrupted ApplicationData record? */ if (opt.bad_ad && strcmp(p->type, "ApplicationData") == 0) { unsigned char buf[MAX_MSG_SIZE]; memcpy(buf, p->buf, p->len); if (p->len <= 13) { mbedtls_printf(" ! can't corrupt empty AD record"); } else { ++buf[13]; print_packet(p, "corrupted"); } if ((ret = dispatch_data(dst, buf, p->len)) <= 0) { mbedtls_printf(" ! dispatch returned %d\n", ret); return ret; } } print_packet(p, why); if ((ret = dispatch_data(dst, p->buf, p->len)) <= 0) { mbedtls_printf(" ! dispatch returned %d\n", ret); return ret; } /* Don't duplicate Application Data, only handshake covered */ if (opt.duplicate != 0 && strcmp(p->type, "ApplicationData") != 0 && rand() % opt.duplicate == 0) { print_packet(p, "duplicated"); if ((ret = dispatch_data(dst, p->buf, p->len)) <= 0) { mbedtls_printf(" ! dispatch returned %d\n", ret); return ret; } } /* Inject ClientHello after first ApplicationData */ if (opt.inject_clihlo != 0 && inject_clihlo_state == ICH_CACHED && strcmp(p->type, "ApplicationData") == 0) { print_packet(&initial_clihlo, "injected"); if ((ret = dispatch_data(dst, initial_clihlo.buf, initial_clihlo.len)) <= 0) { mbedtls_printf(" ! dispatch returned %d\n", ret); return ret; } inject_clihlo_state = ICH_INJECTED; } return 0; } #define MAX_DELAYED_MSG 5 static size_t prev_len; static packet prev[MAX_DELAYED_MSG]; void clear_pending(void) { memset(&prev, 0, sizeof(prev)); prev_len = 0; } void delay_packet(packet *delay) { if (prev_len == MAX_DELAYED_MSG) { return; } memcpy(&prev[prev_len++], delay, sizeof(packet)); } int send_delayed(void) { uint8_t offset; int ret; for (offset = 0; offset < prev_len; offset++) { ret = send_packet(&prev[offset], "delayed"); if (ret != 0) { return ret; } } clear_pending(); return 0; } /* * Avoid dropping or delaying a packet that was already dropped or delayed * ("held") twice: this only results in uninteresting timeouts. We can't rely * on type to identify packets, since during renegotiation they're all * encrypted. So, rely on size mod 2048 (which is usually just size). * * We only hold packets at the level of entire datagrams, not at the level * of records. In particular, if the peer changes the way it packs multiple * records into a single datagram, we don't necessarily count the number of * times a record has been held correctly. However, the only known reason * why a peer would change datagram packing is disabling the latter on * retransmission, in which case we'd hold involved records at most * HOLD_MAX + 1 times. */ static unsigned char held[2048] = { 0 }; #define HOLD_MAX 2 int handle_message(const char *way, mbedtls_net_context *dst, mbedtls_net_context *src) { int ret; packet cur; size_t id; uint8_t delay_idx; char **delay_list; uint8_t delay_list_len; /* receive packet */ if ((ret = mbedtls_net_recv(src, cur.buf, sizeof(cur.buf))) <= 0) { mbedtls_printf(" ! mbedtls_net_recv returned %d\n", ret); return ret; } cur.len = ret; cur.type = msg_type(cur.buf, cur.len); cur.way = way; cur.dst = dst; print_packet(&cur, NULL); id = cur.len % sizeof(held); if (strcmp(way, "S <- C") == 0) { delay_list = opt.delay_cli; delay_list_len = opt.delay_cli_cnt; } else { delay_list = opt.delay_srv; delay_list_len = opt.delay_srv_cnt; } /* Check if message type is in the list of messages * that should be delayed */ for (delay_idx = 0; delay_idx < delay_list_len; delay_idx++) { if (delay_list[delay_idx] == NULL) { continue; } if (strcmp(delay_list[delay_idx], cur.type) == 0) { /* Delay message */ delay_packet(&cur); /* Remove entry from list */ mbedtls_free(delay_list[delay_idx]); delay_list[delay_idx] = NULL; return 0; } } /* do we want to drop, delay, or forward it? */ if ((opt.mtu != 0 && cur.len > (unsigned) opt.mtu) || (opt.drop != 0 && strcmp(cur.type, "CID") != 0 && strcmp(cur.type, "ApplicationData") != 0 && !(opt.protect_hvr && strcmp(cur.type, "HelloVerifyRequest") == 0) && cur.len != (size_t) opt.protect_len && held[id] < HOLD_MAX && rand() % opt.drop == 0)) { ++held[id]; } else if ((opt.delay_ccs == 1 && strcmp(cur.type, "ChangeCipherSpec") == 0) || (opt.delay != 0 && strcmp(cur.type, "CID") != 0 && strcmp(cur.type, "ApplicationData") != 0 && !(opt.protect_hvr && strcmp(cur.type, "HelloVerifyRequest") == 0) && cur.len != (size_t) opt.protect_len && held[id] < HOLD_MAX && rand() % opt.delay == 0)) { ++held[id]; delay_packet(&cur); } else { /* forward and possibly duplicate */ if ((ret = send_packet(&cur, "forwarded")) != 0) { return ret; } /* send previously delayed messages if any */ ret = send_delayed(); if (ret != 0) { return ret; } } return 0; } int main(int argc, char *argv[]) { int ret = 1; int exit_code = MBEDTLS_EXIT_FAILURE; uint8_t delay_idx; mbedtls_net_context listen_fd, client_fd, server_fd; #if defined(MBEDTLS_TIMING_C) struct timeval tm; #endif struct timeval *tm_ptr = NULL; int nb_fds; fd_set read_fds; mbedtls_net_init(&listen_fd); mbedtls_net_init(&client_fd); mbedtls_net_init(&server_fd); get_options(argc, argv); /* * Decisions to drop/delay/duplicate packets are pseudo-random: dropping * exactly 1 in N packets would lead to problems when a flight has exactly * N packets: the same packet would be dropped on every resend. * * In order to be able to reproduce problems reliably, the seed may be * specified explicitly. */ if (opt.seed == 0) { #if defined(MBEDTLS_HAVE_TIME) opt.seed = (unsigned int) mbedtls_time(NULL); #else opt.seed = 1; #endif /* MBEDTLS_HAVE_TIME */ mbedtls_printf(" . Pseudo-random seed: %u\n", opt.seed); } srand(opt.seed); /* * 0. "Connect" to the server */ mbedtls_printf(" . Connect to server on UDP/%s/%s ...", opt.server_addr, opt.server_port); fflush(stdout); if ((ret = mbedtls_net_connect(&server_fd, opt.server_addr, opt.server_port, MBEDTLS_NET_PROTO_UDP)) != 0) { mbedtls_printf(" failed\n ! mbedtls_net_connect returned %d\n\n", ret); goto exit; } mbedtls_printf(" ok\n"); /* * 1. Setup the "listening" UDP socket */ mbedtls_printf(" . Bind on UDP/%s/%s ...", opt.listen_addr, opt.listen_port); fflush(stdout); if ((ret = mbedtls_net_bind(&listen_fd, opt.listen_addr, opt.listen_port, MBEDTLS_NET_PROTO_UDP)) != 0) { mbedtls_printf(" failed\n ! mbedtls_net_bind returned %d\n\n", ret); goto exit; } mbedtls_printf(" ok\n"); /* * 2. Wait until a client connects */ accept: mbedtls_net_free(&client_fd); mbedtls_printf(" . Waiting for a remote connection ..."); fflush(stdout); if ((ret = mbedtls_net_accept(&listen_fd, &client_fd, NULL, 0, NULL)) != 0) { mbedtls_printf(" failed\n ! mbedtls_net_accept returned %d\n\n", ret); goto exit; } mbedtls_printf(" ok\n"); /* * 3. Forward packets forever (kill the process to terminate it) */ clear_pending(); memset(held, 0, sizeof(held)); nb_fds = client_fd.fd; if (nb_fds < server_fd.fd) { nb_fds = server_fd.fd; } if (nb_fds < listen_fd.fd) { nb_fds = listen_fd.fd; } ++nb_fds; #if defined(MBEDTLS_TIMING_C) if (opt.pack > 0) { outbuf[0].ctx = &server_fd; outbuf[0].description = "S <- C"; outbuf[0].num_datagrams = 0; outbuf[0].len = 0; outbuf[1].ctx = &client_fd; outbuf[1].description = "S -> C"; outbuf[1].num_datagrams = 0; outbuf[1].len = 0; } #endif /* MBEDTLS_TIMING_C */ while (1) { #if defined(MBEDTLS_TIMING_C) if (opt.pack > 0) { unsigned max_wait_server, max_wait_client, max_wait; max_wait_server = ctx_buffer_time_remaining(&outbuf[0]); max_wait_client = ctx_buffer_time_remaining(&outbuf[1]); max_wait = (unsigned) -1; if (max_wait_server == 0) { ctx_buffer_flush(&outbuf[0]); } else { max_wait = max_wait_server; } if (max_wait_client == 0) { ctx_buffer_flush(&outbuf[1]); } else { if (max_wait_client < max_wait) { max_wait = max_wait_client; } } if (max_wait != (unsigned) -1) { tm.tv_sec = max_wait / 1000; tm.tv_usec = (max_wait % 1000) * 1000; tm_ptr = &tm; } else { tm_ptr = NULL; } } #endif /* MBEDTLS_TIMING_C */ FD_ZERO(&read_fds); FD_SET(server_fd.fd, &read_fds); FD_SET(client_fd.fd, &read_fds); FD_SET(listen_fd.fd, &read_fds); if ((ret = select(nb_fds, &read_fds, NULL, NULL, tm_ptr)) < 0) { perror("select"); goto exit; } if (FD_ISSET(listen_fd.fd, &read_fds)) { goto accept; } if (FD_ISSET(client_fd.fd, &read_fds)) { if ((ret = handle_message("S <- C", &server_fd, &client_fd)) != 0) { goto accept; } } if (FD_ISSET(server_fd.fd, &read_fds)) { if ((ret = handle_message("S -> C", &client_fd, &server_fd)) != 0) { goto accept; } } } exit_code = MBEDTLS_EXIT_SUCCESS; exit: #ifdef MBEDTLS_ERROR_C if (exit_code != MBEDTLS_EXIT_SUCCESS) { char error_buf[100]; mbedtls_strerror(ret, error_buf, 100); mbedtls_printf("Last error was: -0x%04X - %s\n\n", (unsigned int) -ret, error_buf); fflush(stdout); } #endif for (delay_idx = 0; delay_idx < MAX_DELAYED_HS; delay_idx++) { mbedtls_free(opt.delay_cli[delay_idx]); mbedtls_free(opt.delay_srv[delay_idx]); } mbedtls_net_free(&client_fd); mbedtls_net_free(&server_fd); mbedtls_net_free(&listen_fd); mbedtls_exit(exit_code); } #endif /* MBEDTLS_NET_C */