Secure Socket with Poco - sockets

Question

I am implementing a tcp server and client using secure sockets (Poco::Net::SecureServerSocket), I attach here the code I am using:
void serverClientTest()
{
try {
Poco::Net::initializeSSL();
// Socket server
Poco::Net::Context::Ptr ptrContext =
new Poco::Net::Context(Poco::Net::Context::TLS_SERVER_USE,
"./cert4/myKey.pem",
"./cert4/myCert.pem",
"./cert4/myCert.pem",
Poco::Net::Context::VERIFY_ONCE);
Poco::SharedPtr<Poco::Net::InvalidCertificateHandler> ptrCert = new Poco::Net::AcceptCertificateHandler(true);
Poco::SharedPtr<Poco::Net::PrivateKeyPassphraseHandler> ptrPrivateKeyPassphraseHandler;
ptrPrivateKeyPassphraseHandler = new Poco::Net::KeyConsoleHandler(true);
Poco::Net::SSLManager::instance().initializeServer(ptrPrivateKeyPassphraseHandler, ptrCert, ptrContext);
Poco::Net::SocketAddress serverAddress("0.0.0.0", 8085);
Poco::Net::SecureServerSocket serverSecureSocket(serverAddress);
Poco::Net::TCPServer srv(new Poco::Net::TCPServerConnectionFactoryImpl<EchoConnection>(), serverSecureSocket);
srv.start();
Poco::Net::Context::Ptr ptrContext2 =
new Poco::Net::Context(Poco::Net::Context::TLS_CLIENT_USE,
"./cert4/myKey.pem",
"./cert4/myCert.pem",
"./cert4/myCert.pem",
Poco::Net::Context::VERIFY_ONCE);
Poco::SharedPtr<Poco::Net::InvalidCertificateHandler> ptrCert2 = new Poco::Net::AcceptCertificateHandler(true);
Poco::SharedPtr<Poco::Net::PrivateKeyPassphraseHandler>ptrPrivateKeyPassphraseHandler2(new Poco::Net::KeyConsoleHandler(false));
Poco::Net::SSLManager::instance().initializeClient(ptrPrivateKeyPassphraseHandler2, ptrCert2, ptrContext2);
Poco::Net::SocketAddress sa("127.0.0.1", 8085);
Poco::Net::SecureStreamSocket ss1(sa);
std::string data("TEST TEST");
int retSend = ss1.sendBytes(data.data(), (int) data.size());
if (retSend>0)
{
std::cout << "buffer -> : " << data.data() << std::endl;
char buffer[1024];
memset(buffer, '\0', 1024);
int retRecv = ss1.receiveBytes(buffer, sizeof(buffer));
if (retRecv > 0)
{
std::cout << "buffer <- : " << buffer << std::endl;
}
else
{
std::cout << "ERROR: recv " << retRecv << std::endl;
}
}
ss1.close();
}
catch (Poco::Exception& ex)
{
std::cout << "!! EXCEPTION "<< ex.displayText() << std::endl;
}
}
//[....]
class EchoConnection: public Poco::Net::TCPServerConnection
{
public:
EchoConnection(const Poco::Net::StreamSocket& s): Poco::Net::TCPServerConnection(s){}
void run()
{
Poco::Net::StreamSocket& ss = socket();
std::cout << "connection from client: " << ss.address() << std::endl;
try
{
// ...
}
catch (Poco::Exception& exc)
{
std::cerr << "--------------- EchoConnection: " << exc.displayText() << std::endl;
}
}
};
I would like the server to close the connection if the client certificate is not known to the server, but it happens
which, even with the context:
Poco::Net::Context::Ptr ptrContext2 =
new Poco::Net::Context(Poco::Net::Context::TLS_CLIENT_USE,
"",
"",
"./cert4/myCert.pem",
Poco::Net::Context::VERIFY_ONCE);
Thanks to anyone who can help me out.

Answer 1

void serverClientTest()
{
try {
Poco::Net::initializeSSL();
// Socket server
Poco::Net::Context::Ptr ptrContext =
new Poco::Net::Context(Poco::Net::Context::SERVER_USE,
"./server.key",
"./server.crt",
"./ca.pem",
Poco::Net::Context::VERIFY_STRICT,
9,
false,
"ALL:!ADH:!LOW:!EXP:!MD5:#STRENGTH");
Poco::SharedPtr<Poco::Net::InvalidCertificateHandler> ptrCert = new Poco::Net::AcceptCertificateHandler(true);
Poco::SharedPtr<Poco::Net::PrivateKeyPassphraseHandler> ptrPrivateKeyPassphraseHandler;
ptrPrivateKeyPassphraseHandler = new Poco::Net::KeyConsoleHandler(true);
Poco::Net::SSLManager::instance().initializeServer(ptrPrivateKeyPassphraseHandler, ptrCert, ptrContext);
Poco::Net::SocketAddress serverAddress("0.0.0.0", 8085);
Poco::Net::SecureServerSocket serverSecureSocket(serverAddress);
Poco::Net::TCPServer srv(new Poco::Net::TCPServerConnectionFactoryImpl<EchoConnection>(), serverSecureSocket);
srv.start();
Poco::Net::Context::Ptr ptrContext2 =
new Poco::Net::Context(Poco::Net::Context::CLIENT_USE,
"./client.key",
"./client.crt",
"./ca.pem",
Poco::Net::Context::VERIFY_STRICT,
9,
true,
"ALL:!ADH:!LOW:!EXP:!MD5:#STRENGTH");
Poco::SharedPtr<Poco::Net::InvalidCertificateHandler> ptrCert2 = new Poco::Net::AcceptCertificateHandler(true);
Poco::SharedPtr<Poco::Net::PrivateKeyPassphraseHandler>ptrPrivateKeyPassphraseHandler2(new Poco::Net::KeyConsoleHandler(false));
Poco::Net::SSLManager::instance().initializeClient(ptrPrivateKeyPassphraseHandler2, ptrCert2, ptrContext2);
Poco::Net::SocketAddress sa("127.0.0.1", 8085);
Poco::Net::SecureStreamSocket ss1(sa);
std::string data("TEST");
int retSend = ss1.sendBytes(data.data(), (int) data.size());
if (retSend>0)
{
char buffer[1024];
memset(buffer, '\0', 1024);
int retRecv = ss1.receiveBytes(buffer, sizeof(buffer));
if (retRecv > 0)
{
std::cout << "buffer <-: " << buffer << std::endl;
}
else
{
std::cout << "ERROR: " << retRecv << std::endl;
}
}
ss1.close();
}
catch (Poco::Exception& ex)
{
std::cout << ex.displayText() << std::endl;
}
}