boost asio encryption in a loop without closing connection - c++

Question

I am trying to expand examples in boost asio library.
What I have been successful at so far.
1) Running the echo client and server.
http://www.boost.org/doc/libs/1_59_0/doc/html/boost_asio/example/cpp11/echo/blocking_tcp_echo_client.cpp
http://www.boost.org/doc/libs/1_59_0/doc/html/boost_asio/example/cpp11/echo/blocking_tcp_echo_server.cpp
2) Expanding the echo server to read messages until end of file of standard input.
3) Running the ssl client server example.
http://www.boost.org/doc/libs/1_53_0/doc/html/boost_asio/example/ssl/client.cpp
http://www.boost.org/doc/libs/1_53_0/doc/html/boost_asio/example/ssl/server.cpp
What I need help on:
I would like to be able to put the messages send/receive in a loop in the client. I do not want to put a loop around
client c(io_service, ctx, iterator);
io_service.run();
because that would verify the certificate for every message. I tried putting a loop around handle_handshake and other functions, but they didn't work. The send would not occur until the end of the function. I would never receive a response.
I am willing to avoid using asynchronous IO, but I still want the encryption.

Answer 1

I had to start with the blocking client, and add what I needed from the ssl client and ssl example using https:
This works with the ssl server unmodified.
//
// ssl_blocking_tcp_echo_client.cpp
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
//
// Copyright (c) 2003-2015 Christopher M. Kohlhoff (chris at kohlhoff dot com)
//
// Distributed under the Boost Software License, Version 1.0. (See accompanying
// file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
//
#include <cstdlib>
#include <cstring>
#include <iostream>
#include <boost/bind.hpp>
#include <boost/asio.hpp>
#include <boost/asio/ssl.hpp>
using boost::asio::ip::tcp;
enum { max_length = 1024 };
bool verify_certificate(bool preverified,
boost::asio::ssl::verify_context& ctx)
{
// The verify callback can be used to check whether the certificate that is
// being presented is valid for the peer. For example, RFC 2818 describes
// the steps involved in doing this for HTTPS. Consult the OpenSSL
// documentation for more details. Note that the callback is called once
// for each certificate in the certificate chain, starting from the root
// certificate authority.
// In this example we will simply print the certificate's subject name.
char subject_name[256];
X509* cert = X509_STORE_CTX_get_current_cert(ctx.native_handle());
X509_NAME_oneline(X509_get_subject_name(cert), subject_name, 256);
std::cout << "Verifying " << subject_name << "\n";
return preverified;
}
int main(int argc, char* argv[])
{
try
{
if (argc != 3)
{
std::cerr << "Usage: blocking_tcp_echo_client <host> <port>\n";
return 1;
}
boost::asio::io_service io_service;
boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23);
ctx.load_verify_file("server.crt");
ctx.set_verify_mode(boost::asio::ssl::verify_peer);
boost::asio::ssl::stream<boost::asio::ip::tcp::socket> socket(io_service, ctx);
tcp::resolver resolver(io_service);
boost::asio::connect(socket.lowest_layer(), resolver.resolve({argv[1], argv[2]}) );
socket.set_verify_callback(
boost::bind(&verify_certificate, _1, _2));
socket.handshake(boost::asio::ssl::stream<boost::asio::ip::tcp::socket>::client);
while(std::cin)
{
std::cout << "Enter message: ";
char request[max_length];
std::cin.getline(request, max_length);
size_t request_length = std::strlen(request);
boost::asio::write(socket, boost::asio::buffer(request, request_length));
char reply[max_length];
size_t reply_length = boost::asio::read(socket,
boost::asio::buffer(reply, request_length));
std::cout << "Reply is: ";
std::cout.write(reply, reply_length);
std::cout << "\n";
}
}
catch (std::exception& e)
{
std::cerr << "Exception: " << e.what() << "\n";
}
return 0;
}
Before starting this, I modified server and client based on Shootfast's answer to this question. I had to modify it slightly because something was too short. I changed this command to 2048 instead of the original 512.
openssl dhparam -out dh512.pem 2048
Quoted below.
OK, for anyone finding this in the future, you need to create your certificates and sign them appropriately.
Here are the commands for linux:
//Generate a private key
openssl genrsa -des3 -out server.key 1024
//Generate Certificate signing request
openssl req -new -key server.key -out server.csr
//Sign certificate with private key
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
//Remove password requirement (needed for example)
cp server.key server.key.secure
openssl rsa -in server.key.secure -out server.key
//Generate dhparam file
openssl dhparam -out dh512.pem 2048
Once you've done that, you need to change the filenames in server.cpp and client.cpp.
server.cpp
context_.use_certificate_chain_file("server.crt");
context_.use_private_key_file("server.key", boost::asio::ssl::context::pem);
context_.use_tmp_dh_file("dh512.pem");
client.cpp
ctx.load_verify_file("server.crt");
Then it should all work!