I need to make a legacy app for windows XP (like it or not I am in a position that I have no other choice) that consumes a single http call. But that call is upon TLS 1.2 and I expect in the future TLS 1.3 so I've got to build my app with my own SSL.
Therefore, in my linux machine I've setup a windows XP Vm and mingw:
sudo apt-get install gcc-mingw-w64-x86-64 g++-mingw-w64-x86-64 wine64
sudo apt-get install g++-mingw-w64-i686 g++-mingw-w64-i686
And I build the openssl:
wget https://www.openssl.org/source/openssl-1.1.1q.tar.gz
tar -xvf openssl-1.1.1q.tar.gz
cd ./openssl-1.1.1q
./config enable-tls1_3 enable-tls1_2 no-asm no-async no-dso no-engine --prefix=./config enable-tls1_3 enable-tls1_2 no-asm no-async no-dso no-engine --prefix=/usr/bin/i686-w64-mingw32-gcc
make -j 16
And in ./openssl-1.1.1q I have 2 .so files:
libcrypto.so.1.1
libssl.so.1.1
Also so far I've made a following project:
| my_win_app
| - main.cpp
| - openssl-1.1.1q
| -- libcrypto.so
| -- libssl.so
The main.cpp is the following:
#define _WINSOCK_DEPRECATED_NO_WARNINGS
#define _CRT_SECURE_NO_WARNINGS
#include <winsock2.h>
#include <ws2tcpip.h>
//#include <stdlib.h>
#include <stdio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/applink.c>
// Need to link with Ws2_32.lib, Mswsock.lib, and Advapi32.lib
#pragma comment (lib, "Ws2_32.lib")
//#pragma comment (lib, "Mswsock.lib")
//#pragma comment (lib, "AdvApi32.lib")
#define DEFAULT_BUFLEN 512
#define DEFAULT_PORT "4116"
#define FAIL -1
#define WIN32_LEAN_AND_MEAN
SOCKET OpenConnection(char* hostname, int port)
{
WSADATA wsaData;
SOCKET ConnectSocket = INVALID_SOCKET;
struct addrinfo* result = NULL;
struct addrinfo* ptr = NULL;
struct addrinfo hints;
char recvbuf[DEFAULT_BUFLEN];
int iResult;
int recvbuflen = DEFAULT_BUFLEN;
// Initialize Winsock
iResult = WSAStartup(MAKEWORD(2, 2), &wsaData);
if (iResult != 0) {
printf("WSAStartup failed with error: %d\n", iResult);
return 1;
}
ZeroMemory(&hints, sizeof(hints));
hints.ai_family = AF_UNSPEC;
hints.ai_socktype = SOCK_STREAM;
hints.ai_protocol = IPPROTO_TCP;
// Resolve the server address and port
iResult = getaddrinfo("google.com", "449", &hints, &result);
if (iResult != 0) {
printf("getaddrinfo failed with error: %d\n", iResult);
WSACleanup();
return 1;
}
ptr = result;
// Create a SOCKET for connecting to server
ConnectSocket = socket(ptr->ai_family, ptr->ai_socktype, ptr->ai_protocol);
if (ConnectSocket == INVALID_SOCKET) {
printf("socket failed with error: %ld\n", WSAGetLastError());
WSACleanup();
return 1;
}
// Connect to server.
iResult = connect(ConnectSocket, ptr->ai_addr, (int)ptr->ai_addrlen);
if (iResult == SOCKET_ERROR) {
closesocket(ConnectSocket);
ConnectSocket = INVALID_SOCKET;
}
return ConnectSocket;
}
SSL_CTX* InitCTX(void)
{
OpenSSL_add_all_algorithms(); /* Load cryptos, et.al. */
SSL_load_error_strings(); /* Bring in and register error messages */
const SSL_METHOD* method = TLSv1_2_client_method(); /* Create new client-method instance */
SSL_CTX* ctx = SSL_CTX_new(method); /* Create new context */
if (ctx == NULL)
{
ERR_print_errors_fp(stderr);
abort();
}
return ctx;
}
void ShowCerts(SSL* ssl)
{
X509* cert;
char* line;
cert = SSL_get_peer_certificate(ssl); /* get the server's certificate */
if (cert != NULL)
{
printf("Server certificates:\n");
line = X509_NAME_oneline(X509_get_subject_name(cert), 0, 0);
printf("Subject: %s\n", line);
//free(line); /* free the malloc'ed string */
line = X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0);
printf("Issuer: %s\n", line);
//free(line); /* free the malloc'ed string */
X509_free(cert); /* free the malloc'ed certificate copy */
}
else
printf("Info: No client certificates configured.\n");
}
int main(int argc, char* argv[])
{
char buf[1024];
char acClientRequest[1024] = { 0 };
SSL_library_init();
char* hostname = "google.com";
char* portnum = "449";
SSL_CTX* ctx = InitCTX();
int server = OpenConnection(hostname, atoi(portnum));
SSL* ssl = SSL_new(ctx); /* create new SSL connection state */
SSL_set_fd(ssl, server); /* attach the socket descriptor */
if (SSL_connect(ssl) == FAIL) {
ERR_print_errors_fp(stderr);
} else {
const char* cpRequestMessage = "";
printf("\n\nConnected with %s encryption\n", SSL_get_cipher(ssl));
/* get any certs */
ShowCerts(ssl);
/* encrypt & send message */
SSL_write(ssl, acClientRequest, strlen(acClientRequest));
/* get reply & decrypt */
int bytes = SSL_read(ssl, buf, sizeof(buf));
buf[bytes] = 0;
printf("Received: \"%s\"\n", buf);
/* release connection state */
SSL_free(ssl);
}
/* close socket */
closesocket(server);
/* release context */
SSL_CTX_free(ctx);
return 0;
}
And what attempts to do is to fetch the google's frontpage via http 1.1 ontop of openssl using winsock. The issue is that openssl is unable to be found:
$ LANG=C i686-w64-mingw32-gcc main.cpp ./openssl-1.1.1q/libssl.so ./openssl-1.1.1q/libcrypto.so -o main.exe -lws2_32 -lopenssl
main.cpp:9:10: fatal error: openssl/ssl.h: No such file or directory
#include <openssl/ssl.h>
^~~~~~~~~~~~~~~
compilation terminated.
What I want is to link my main.cpp during cross-compilation with the openssl I've just built. But I am unable to do so. Any ideas why?
Attempt 2
I re-built my openSSL with:
cd ./openssl-1.1.1q
make clean
./Configure enable-tls1_3 no-asm no-async no-dso no-engine no-shared --cross-compile-prefix=i686-w64-mingw32- --prefix=/usr/bin/i686-w64-mingw32-gcc mingw
make -j16
And I re-tried to rebuild my application:
$ LANG=C i686-w64-mingw32-gcc main.c -lws2_32 -Iopenssl-1.1.1q/include -o main.exe
main.cpp:10:10: fatal error: openssl/applink.c: No such file or directory
#include <openssl/applink.c>
^~~~~~~~~~~~~~~~~~~
compilation terminated.
Still fails to build. As I can see I cannot build the file applink.c. Furthermore I renamed main.cpp into main.c
-I(upper eye) -- given your file layout you probably want-Iopenssl-1.1.1q/include. However, since you didn't specify a MINGW target to./configI expect this build won't actually run. At the same time you fix that, you could consider addingno-shared-- if you only have one app, static linking is simpler than managing the multiple library files.extern "C" { ... }. I don't think the mingw-ified windows headers need this, but check to be sure. Plus do you really wantgoogle.com 449? There's no server there, SSL/HTTPS or otherwise. The standard and nearly universal HTTPS port is 443.