SSL version can be set and get.

Author: zhengshuxin

lib_acl_cpp/include/acl_cpp/stream/mbedtls_io.hpp

@@ -49,7 +49,7 @@ class ACL_CPP_API mbedtls_io : public sslbase_io {
 	 */
 	bool check_peer();
 
-	// @override sslbase_io
+	// @override sslbase_io, 目前仅支持mbedtls3.x.x系列.
 	int get_version() const;
 
 protected:

lib_acl_cpp/include/acl_cpp/stream/sslbase_conf.hpp

@@ -4,6 +4,7 @@
 
 namespace acl {
 
+class string;
 class sslbase_io;
 
 class ACL_CPP_API ssl_sni_checker {
@@ -53,6 +54,27 @@ class ACL_CPP_API sslbase_conf : public noncopyable {
 		return false;
 	}
 
+	/**
+	 * 将版本号转为字符串
+	 * @param v {int}
+	 * @return {const char*}
+	 */
+	static const char* version_s(int v) {
+		switch (v) {
+		case ssl_ver_3_0:
+			return "ssl_ver_3_0";
+		case tls_ver_1_0:
+			return "tls_ver_1_0";
+		case tls_ver_1_1:
+			return "tls_ver_1_1";
+		case tls_ver_1_2:
+			return "tls_ver_1_2";
+		case tls_ver_1_3:
+			return "tls_ver_1_3";
+		default:
+			return "ssl_ver_unknown";
+		}
+	}
 //public:
 	/**
 	 * 加载 CA 根证书(每个配置实例只需调用一次本方法)

lib_acl_cpp/include/acl_cpp/stream/sslbase_io.hpp

@@ -36,6 +36,12 @@ class ACL_CPP_API sslbase_io : public stream_hook {
 		return 0;
 	}
 
+	/**
+	 * 获得当前连接的 SSL 版本,以字符串表示
+	 * @return {const char*} 返回非空版本字符串
+	 */
+	const char* get_version_s() const;
+
 	/**
 	 * 设置套接字为阻塞模式/非阻塞模式
 	 * @param yes {bool} 当为 false 时则设为阻塞模式，否则设为非阻塞模式

lib_acl_cpp/samples/ssl/https_server/http_servlet.cpp

@@ -67,7 +67,7 @@ bool http_servlet::doPost(acl::HttpServletRequest& req,
 	acl::string buf;
 	body.build_xml(buf);
 
-	printf(">>>buf: %s\r\n", buf.c_str());
+	//printf(">>>buf: %s\r\n", buf.c_str());
 
 	bool keep_alive = req.isKeepAlive();
 
@@ -79,6 +79,6 @@ bool http_servlet::doPost(acl::HttpServletRequest& req,
 	// 发送 http 响应体，因为设置了 chunk 传输模式，所以需要多调用一次
 	// res.write 且两个参数均为 0 以表示 chunk 传输数据结束
 	bool ret = res.write(buf) && res.write(NULL, 0) && keep_alive;
-	printf(">>>write %s\r\n", ret ? "ok":"error");
+	//printf(">>>write %s\r\n", ret ? "ok":"error");
 	return ret;
 }

lib_acl_cpp/samples/ssl/https_server/master_service.cpp

@@ -93,8 +93,7 @@ static acl::sslbase_io* setup_ssl(acl::socket_stream& conn, acl::sslbase_conf& c
 		return NULL;
 	}
 
-	logger("handshake_ok");
-
+	//logger("handshake ok, ssl version: %s", ssl->get_version_s());
 	return ssl;
 }
 
@@ -119,8 +118,7 @@ bool master_service::thread_on_read(acl::socket_stream* conn)
 
 bool master_service::thread_on_accept(acl::socket_stream* conn)
 {
-	logger("connect from %s, fd: %d", conn->get_peer(true),
-		conn->sock_handle());
+	//logger("connect from %s, fd: %d", conn->get_peer(true), conn->sock_handle());
 
 	conn->set_rw_timeout(var_cfg_io_timeout);
 
@@ -139,8 +137,7 @@ bool master_service::thread_on_timeout(acl::socket_stream* conn)
 
 void master_service::thread_on_close(acl::socket_stream* conn)
 {
-	logger("disconnect from %s, fd: %d", conn->get_peer(),
-		conn->sock_handle());
+	//logger("disconnect from %s, fd: %d", conn->get_peer(), conn->sock_handle());
 
 	http_servlet* servlet = (http_servlet*) conn->get_ctx();
 	delete servlet;
@@ -194,6 +191,8 @@ void master_service::proc_on_init()
 		exit (1);
 	}
 
+	//var_cfg_tls_1_3_force = 1;
+
 	if (var_cfg_tls_1_2_force) {
 		conf_->set_version(acl::tls_ver_1_2, acl::tls_ver_1_2);
 	} else if (var_cfg_tls_1_3_force) {

lib_acl_cpp/samples/ssl/ssl_client2/ssl_client.cpp

@@ -92,7 +92,14 @@ static void usage(const char* procname)
 int main(int argc, char* argv[])
 {
 	int   ch, max_loop = 10, max_connections = 10;
-	acl::string addr("127.0.0.1:9001"), libpath("../libpolarssl.so");
+	acl::string addr("127.0.0.1:9800");
+#ifdef __linux__
+	acl::string libpath("../libmbedcrypto.so;../libmbedx509.so;../libmbedtls.so");
+#elif defined(APPLE)
+	acl::string libpath("../libmbedcrypto.dylib;../libmbedx509.dylib;../libmbedtls.dylib");
+#else
+# error "Not supported!"
+#endif
 
 	acl::acl_cpp_init();
 
@@ -139,6 +146,8 @@ int main(int argc, char* argv[])
 		__ssl_conf = new acl::polarssl_conf;
 	}
 
+	//__ssl_conf->set_version(acl::tls_ver_1_3, acl::tls_ver_1_3);
+
 	if (max_connections <= 0) {
 		max_connections = 100;
 	}

lib_acl_cpp/samples/ssl/ssl_client2/valgrind.sh

@@ -75,7 +75,8 @@ static acl::sslbase_io* setup_ssl(acl::socket_stream& conn,
 		return NULL;
 	}
 
-	logger("setup hook ok, tid: %lu", acl::thread::thread_self());
+	logger("setup hook ok, tid: %lu, ssl version: %s",
+		acl::thread::thread_self(), ssl->get_version_s());
 	return ssl;
 }
 
@@ -199,6 +200,8 @@ void master_service::proc_on_init()
 		conf_ = new acl::polarssl_conf();
 	}
 
+	//conf_->set_version(acl::tls_ver_1_3, acl::tls_ver_1_3);
+
 	// 允许服务端的 SSL 会话缓存功能
 	conf_->enable_cache(var_cfg_session_cache);
 

lib_acl_cpp/samples/ssl/ssl_server2/master_service.cpp

@@ -27,6 +27,11 @@ sslbase_io::~sslbase_io()
 	delete refers_;
 }
 
+const char* sslbase_io::get_version_s() const
+{
+	return sslbase_conf::version_s(this->get_version());
+}
+
 void sslbase_io::set_non_blocking(bool yes)
 {
 	// 此处仅设置非阻塞 IO 标志位，至于套接字是否被设置了非阻塞模式