[error] client connection faild

[noraj]

Hi @yorickdewid,

I launched the server, launched a user.

User :

telnet 127.0.0.1 5000
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
\ACTIVE
Connection closed by foreign host.

Server :

./chat_server
<[SERVER STARTED]>
[error] client connection faild

But when I run a command both user and server crash.

So if(SSL_accept(cli->ssl) == -1) is not respected.

In the main cli->ssl is initialized like that :

ctx = SSL_CTX_new(SSLv3_server_method());
load_certificate(ctx, cert, key);
[...]
ssl = SSL_new(ctx);
SSL_set_fd(ssl, connfd);
[...]
cli->ssl = ssl;

Is that the way ctx is loaded that is wrong or my certificate/key are not correct ?

I created my cert and key with this command :

openssl req \
       -newkey rsa:2048 -nodes -keyout domain.key \
       -x509 -days 365 -out domain.crt
mv domain.key key.pem
mv domain.crt cert.pem

[yorickdewid]

I would almost say the self signed certificate is rejected. You can avoid this by setting SSL_CTX_set_verify

[noraj]

I took a look at openssl doc, ssl_ctx_set_verify and added SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL); between

ctx = SSL_CTX_new(SSLv3_server_method());
SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);                                                              
load_certificate(ctx, cert, key);

But I still have the same error.

[noraj]

I understand that SSL_CTX_set_verify is for the certificate and SSL_set_verify if for the clients so I added SSL_set_verify(ssl, SSL_VERIFY_NONE, NULL); but now have a seg fault.

[noraj]

I also tried to override the callback :

SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, krx_ssl_verify_peer);

with

int krx_ssl_verify_peer(int ok, X509_STORE_CTX* ctx) {
    return 1;
}

But I stil have [error] client connection faild.

[noraj]

OK I find where does it come from : TELNET can't handle ssl so instead of use telnet I used openssl client : openssl s_client -connect 127.0.0.1:5000 and it worked

[yorickdewid]

Yes telnet is not capable of handling SSL. You can also have a look at netcat