mbedtls mbedtls_ssl_handshake失败

最新推荐文章于 2025-06-25 13:25:47 发布

原创最新推荐文章于 2025-06-25 13:25:47 发布 · 757 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#iot #ssl #linux

在学习mbedtls中，尝试使用PSK加密套件来进行通信，于是写了一个简单的sever和client。

client程序运行到mbedtls_ssl_handshake出现失败，返回-6C00，错误原因：Internal error (eg, unexpected failure in lower-level module)。

运行环境是wsl2下的ubuntu20.04

在网上找了很多资料也没有解决。请问有人遇到过这种情况吗，怎么处理？

以下是服务端代码

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdarg.h>

#include "mbedtls/net_sockets.h"
#include "mbedtls/ssl.h"
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"


#define SERVER_IP "172.19.25.42"
#define SERVER_PORT "4433"


// 预共享密钥
static const unsigned char psk_key[] = {
    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
    0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11
};


// 预共享密钥标识
static const char psk_identity[] = "Client_Identity";


int main() {
    mbedtls_net_context server_fd;
    mbedtls_ssl_context ssl;
    mbedtls_ssl_config conf;
    mbedtls_ctr_drbg_context ctr_drbg;
    mbedtls_entropy_context entropy;
    int ret;


    // 初始化网络、SSL、SSL 配置、熵源和 CTR_DRBG 上下文
    mbedtls_net_init(&server_fd);
    mbedtls_ssl_init(&ssl);
    mbedtls_ssl_config_init(&conf);
    mbedtls_entropy_init(&entropy);
    mbedtls_ctr_drbg_init(&ctr_drbg);


    // 初始化熵源和 CTR_DRBG
    ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);
    if (ret!= 0) {
        printf("Failed to seed the random number generator!\n");
        goto exit_cleanup;
    }


    // 设置 SSL 配置默认值
    mbedtls_ssl_config_defaults(&conf,MBEDTLS_SSL_IS_SERVER,MBEDTLS_SSL_TRANSPORT_STREAM,MBEDTLS_SSL_PRESET_DEFAULT);
    mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg);


    // 配置 PSK 信息
    mbedtls_ssl_conf_psk(&conf, psk_key, sizeof(psk_key), (const unsigned char *)psk_identity, strlen(psk_identity));


    // 仅使用 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 密码套件
    const int ciphersuites = MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256;
    mbedtls_ssl_conf_ciphersuites(&conf, &ciphersuites);


    // 绑定和监听端口
    ret = mbedtls_net_bind(&server_fd, SERVER_IP, SERVER_PORT, MBEDTLS_NET_PROTO_TCP);
    if (ret!= 0) {
        printf("Failed to bind to port %s\n", SERVER_PORT);
        goto exit_cleanup;
    }


    printf("Listening on port %s...\n", SERVER_PORT);


    // 接受客户端连接
    mbedtls_net_context client_fd;
    mbedtls_net_init(&client_fd);
    ret = mbedtls_net_accept(&server_fd, &client_fd, NULL,0,NULL);
    if (ret!= 0) {
        printf("Failed to accept client connection\n");
        goto exit_cleanup;
    }

    // char buf[256];
    // while(1)
    // {
    //     memset(buf,0,256);
    //     read(client_fd.fd,buf,256);
    //     printf("buf = %s\n",buf);
    //     sleep(2);
    // }

    printf("Client connected\n");


    // 初始化 SSL 上下文
    mbedtls_ssl_setup(&ssl, &conf);
    mbedtls_ssl_set_bio(&ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, NULL);


    // 进行 SSL/TLS 握手
    // ret = mbedtls_ssl_handshake(&ssl);
    // if (ret!= 0) {
    //     printf("SSL/TLS handshake failed! ret = %d\n",ret);
    //     goto exit_cleanup;
    // }

    while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
    {
        if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
        {
            printf( " failed\n  ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret );
            goto exit_cleanup;
        }
    }


    printf("SSL/TLS handshake successful!\n");


    // 发送和接收数据
    char send_buffer[] = "Hello, client!";
    ret = mbedtls_ssl_write(&ssl, (const unsigned char *)send_buffer, strlen(send_buffer));
    if (ret < 0) {
        printf("Failed to send data!\n");
        goto exit_cleanup;
    } else {
        printf("Sent %d bytes: %s\n", ret, send_buffer);
    }


    unsigned char recv_buffer[1024];
    ret = mbedtls_ssl_read(&ssl, recv_buffer, sizeof(recv_buffer) - 1);
    if (ret < 0) {
        printf("Failed to receive data!\n");
        goto exit_cleanup;
    } else {
        recv_buffer[ret] = '\0';
        printf("Received %d bytes: %s\n", ret, recv_buffer);
    }


exit_cleanup:
    // 释放资源
    mbedtls_net_free(&server_fd);
    mbedtls_net_free(&client_fd);
    mbedtls_ssl_free(&ssl);
    mbedtls_ssl_config_free(&conf);
    mbedtls_ctr_drbg_free(&ctr_drbg);
    mbedtls_entropy_free(&entropy);


    return ret;
}

以下是客户端代码

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdarg.h>

#include "mbedtls/net_sockets.h"
#include "mbedtls/ssl.h"
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"


#define SERVER_IP "172.19.25.42"
#define SERVER_PORT "4433"


// 预共享密钥，需与服务端匹配
static const unsigned char psk_key[] = {
    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
    0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11
};


// 预共享密钥标识，需与服务端匹配
static const char psk_identity[] = "Client_Identity";


int main() {
    mbedtls_net_context server_fd;
    mbedtls_ssl_context ssl;
    mbedtls_ssl_config conf;
    mbedtls_ctr_drbg_context ctr_drbg;
    mbedtls_entropy_context entropy;
    int ret;


    // 初始化网络、SSL、SSL 配置、熵源和 CTR_DRBG 上下文
    mbedtls_net_init(&server_fd);
    mbedtls_ssl_init(&ssl);
    mbedtls_ssl_config_init(&conf);
    mbedtls_entropy_init(&entropy);
    mbedtls_ctr_drbg_init(&ctr_drbg);


    // 初始化熵源和 CTR_DRBG
    ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);
    if (ret!= 0) {
        printf("Failed to seed the random number generator!\n");
        goto exit_cleanup;
    }


    // 设置 SSL 配置默认值
    mbedtls_ssl_config_defaults(&conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);
    mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg);


    // 配置 PSK 信息
    mbedtls_ssl_conf_psk(&conf, psk_key, sizeof(psk_key), (const unsigned char *)psk_identity, strlen(psk_identity));


    // 仅使用 MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 密码套件
    const int ciphersuites = MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256;
    mbedtls_ssl_conf_ciphersuites(&conf, &ciphersuites);


    // 建立与服务器的网络连接
    ret = mbedtls_net_connect(&server_fd, SERVER_IP, SERVER_PORT, MBEDTLS_NET_PROTO_TCP);
    if (ret!= 0) {
        printf("Failed to connect to server at %s:%s\n", SERVER_IP, SERVER_PORT);
        goto exit_cleanup;
    }

    // while(1)
    // {
    //     write(server_fd.fd,"hello",6);
    //     sleep(2);
    // }

    // 初始化 SSL 上下文
    mbedtls_ssl_setup(&ssl, &conf);
    mbedtls_ssl_set_bio(&ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL);


    //进行 SSL/TLS 握手
    ret = mbedtls_ssl_handshake(&ssl);
    if (ret!= 0) {
        printf("SSL/TLS handshake failed! ret = %d\n",ret);
        goto exit_cleanup;
    }

    printf("SSL/TLS handshake successful!\n");

    // 发送和接收数据
    char send_buffer[] = "Hello, server!";
    ret = mbedtls_ssl_write(&ssl, (const unsigned char *)send_buffer, strlen(send_buffer));
    if (ret < 0) {
        printf("Failed to send data!\n");
        goto exit_cleanup;
    } else {
        printf("Sent %d bytes: %s\n", ret, send_buffer);
    }


    unsigned char recv_buffer[1024];
    ret = mbedtls_ssl_read(&ssl, recv_buffer, sizeof(recv_buffer) - 1);
    if (ret < 0) {
        printf("Failed to receive data!\n");
        goto exit_cleanup;
    } else {
        recv_buffer[ret] = '\0';
        printf("Received %d bytes: %s\n", ret, recv_buffer);
    }


exit_cleanup:
    // 释放资源
    mbedtls_net_free(&server_fd);
    mbedtls_ssl_free(&ssl);
    mbedtls_ssl_config_free(&conf);
    mbedtls_ctr_drbg_free(&ctr_drbg);
    mbedtls_entropy_free(&entropy);


    return ret;
}