Initial project import

tools/v/examples/ssl_server/cert/ca.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIUTbcFMmB84wg6eqDRJbmo49aOTdMwDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yMzA3MzAxNzM0MThaGA8yMDUw
+MTIxNDE3MzQxOFowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBANPfvg3G/3+j2NX5qDf0gw9iSnCiUa1T1inxlnfP
+vMVINDkH22yUSeValyuIrpF94m23ANo0yOXQJxbIt8PbwaRYTq1EzxlGkkXUHob3
+m1qJLH1qLacJeLMPj3J7kUXVWL65Qb7d2gtwMvegJ5I5U4ntLjXAmIV4z4PpZ2tP
+MsERacj/alb0EDS77P4JcbRzYvP/3FyFokel5TF/nLV3hXc5Eu6LjCzbEEus1MLd
+rgcpODUlw8Gf0M0nAjxijVpXAVo6XYRQ/00+zjPaKxjtQ/ds/O7zRTNxnUVvh1oH
+Pnif9rkVBLkVjmSU/C7jvAKqrWPU9b24hXpnfSIirkn3tO8CAwEAAaNTMFEwHQYD
+VR0OBBYEFPx8Ivgj5Gi4XyHFZ/zGgZU4kGc7MB8GA1UdIwQYMBaAFPx8Ivgj5Gi4
+XyHFZ/zGgZU4kGc7MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AJYSckwJSZlj8baEMvAJLs55Bm5wR1QZaj7mz8tBxK8zd9PdW3fTebil6jtGLpXT
+CHi+vaa5HsM2QXnYaZCSlawD3WWZ+LZ9lJVuWC+iWfRq6TC/gEd+3zCE70CeeAAu
+0pZC2Luvvgm5a6qfKoA4lEvlB2Yr0pX2GhXYOGvIeSMWpohKyKmiJEi83kJvzjnl
+BsFIR6FB1wO2+nrfLCzmjwPQx0ie2h+fPwf5Y2C0pPBYVwXpP94EEZW+lQgPXx5I
+6X8HPVNMtu4lToe746ctQlA4YDwge5mmiGUgF95Y3/O9Z2vjPqeN826oR89YFFZF
+JFtrrBskGW5fOzKOXLc96pE=
+-----END CERTIFICATE-----

tools/v/examples/ssl_server/cert/client.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEEzCCAvsCFG64Q2g46jZb3kRbDOJWX/BwjSp5MA0GCSqGSIb3DQEBCwUAMEUx
+CzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRl
+cm5ldCBXaWRnaXRzIFB0eSBMdGQwIBcNMjMwNzMwMTczNDQzWhgPMjA1MDEyMTQx
+NzM0NDNaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYD
+VQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQDqDmHNMesBQ6S/ZU+xW4sO18Q+WfvXEaMdEfN5D8wyazP3
+mA7VTsNjliHrLFDiaTX9dR9Js+SwqmLpZTZoxBzn6wDuuM9fswvISnVERgZZdFas
+lkgci4iXVE2TREEqh6Ak4CAUyGiBhHm1CaT7txvq7wTghs+cgDR5hItK7EpxD7gv
+jc1sNco9Ha1GecUB0L4fCmp3ss88vvDU4ta4eLTsW/SZbTKRMawih4hp00d0v83s
+Of5iIP6kWsM9X5Oe2Fm5XaObMlCdWHIBP2aB5i2ZqYUKTl8uKExpeobcsmpvHiSb
+tAAaeFo/5shyCAXx/i55KYA2oRm71XeIBnllIBMEfKPV3AReO6p+MZFnioPxUWY0
+gWqlSzsoLJ6NxHYWeC15OQhKQ6jEO7u3SAivacG5VVEywQ7EiY3b+ncwcZt9QK8q
+UckwwnbWHZJwJcp0vHj3/Mmvawm1dWR3CVauFW3ze/l3Ik92wJBDkULhv6r07zfv
+SlL2Am7+wPWfeOomx+Kh/rnGcXATcH17dVFH/mjhTjclOuM38e7oGoQhm9lZ9kaD
+wIuu1X0+XutuY55uze9yVY9qRSIJraBuZ9mreVIVj9FG0kpVplrTr7oBlGA1Nc3i
+1IuilE36T4qmP50WzJ6Yy38+J7My23bUyyOXIFhX/LTpPVjhZq5tVH+WmmqW0wID
+AQABMA0GCSqGSIb3DQEBCwUAA4IBAQAbD+EVc4Ev7uXKUQV0s3nETp2odz1G8eZ/
+drAVnWJpZEeWW98ZeVfyYglqWc9G8McYpiKeac9WF+gga8F2Cn3RjMvufqr0Ggcy
+byytgJeLolukhTV/JJk8o+CUAB2xgk8+DVEiZ+7G4L/4V613VmL1B+jRHWknO/Js
+uArppuSduvmkakWOGMBGLUPUcep/vIepHByjOeq1czsdrsLokjBXjMAwXAVRSkBs
+mazD9yK95R5oG0KDmIPpfDddwvp7Xq4t3pTtMwXPYaDG+sPovsGsGYRkTnouOlKh
+ae4/jRb8ut9AqOxZRUsBzT8MJXg4cFec8qrhPe3abzxN4amqOxlj
+-----END CERTIFICATE-----

tools/v/examples/ssl_server/cert/makecerts.sh

@@ -0,0 +1,22 @@
+# generates the certificates used by the server_sni_advanced.v example
+
+# default
+gen_key type=rsa rsa_keysize=4096 filename=0x.dk.key
+cert_write selfsign=1 issuer_key=0x.dk.key                    \
+                         issuer_name=CN=0x.dk,O=0x,C=DK        \
+                         not_before=20130101000000 not_after=20251231235959   \
+                         is_ca=1 max_pathlen=0 output_file=0x.dk.crt
+
+# 1x.dk
+gen_key type=rsa rsa_keysize=4096 filename=1x.dk.key
+cert_write selfsign=1 issuer_key=1x.dk.key                    \
+                         issuer_name=CN=1x.dk,O=1x.dk,C=DK        \
+                         not_before=20130101000000 not_after=20251231235959   \
+                         is_ca=1 max_pathlen=0 output_file=1x.dk.crt
+
+# 2x.dk
+gen_key type=rsa rsa_keysize=4096 filename=2x.dk.key
+cert_write selfsign=1 issuer_key=2x.dk.key                    \
+                         issuer_name=CN=2x.dk,O=2x.dk,C=DK        \
+                         not_before=20130101000000 not_after=20251231235959   \
+                         is_ca=1 max_pathlen=0 output_file=2x.dk.crt

tools/v/examples/ssl_server/cert/server.crt

@@ -0,0 +1,26 @@
+No extensions in certificate
+-----BEGIN CERTIFICATE-----
+MIIEOTCCAyECFG64Q2g46jZb3kRbDOJWX/BwjSp4MA0GCSqGSIb3DQEBCwUAMEUx
+CzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRl
+cm5ldCBXaWRnaXRzIFB0eSBMdGQwIBcNMjMwNzMwMTczNDE4WhgPMjA1MDEyMTQx
+NzM0MThaMGsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRQwEgYD
+VQQHDAtMb3MgQW5nZWxlczEdMBsGA1UECgwUQ2F0YWx5c3QgRGV2ZWxvcG1lbnQx
+EjAQBgNVBAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBAKUcJ5cizbhreUlC0plQngCeE+/ysZJo8TmnhEF4cFnTVCHmvzz7f5w7/Zma
+4maRzE3KT52qSA2PkX6Wr9RgnM93K93a3dfiUHaZ+DbWFnb1w/gp7TG5bgvwfjcb
+KVnkP+BIMbT90kQrLI0H89LrouvCHDvl74EvAdyYgupLTdjZ5Q5Xe9P5rUhLajw6
+iN8+NtfrQh2hDOWnbg9nQK/zjIVvvvjMQOUzda9Rq4ViAphiLNufojQhHJrlIpkP
+oR+YENiDXRcaire5RVWjzfoQGDbTJLJL8fNV1HMjJArUuCg8yIyL1wooe+XWqscg
+MzJoiCjSdai5zTF+lzcBLrm0olqB7YDCHS3x3K4C3DDRSoyFSEHRQpbSQbc6jTo6
+TuWcC9o/5fIMzzHrahqoRZG7syFyHYNtezhsFobqMX4E15gV6tBf6CMpTlXMH3ss
+DreZl900n1UcNtp7aQw2JIdRrLMW2I6UAit1o/FBYjkg/QCqPL7lw1nv0COraI74
+CU+I7opYJJgEalOkZciapB6ARMgWD1/J9qO4q98H0jETP1bh78lwLPxRe1W5fukD
+YCazJONIt4Bgdff8C2r+KhEoWQxK5VnjIdbL9E1nxscPr/4U77siCmHKdPINCrsD
+CWqxUHiuyJmkw9NCrerZoIxTBFAUc+sdibvq1M528jf1IvXXAgMBAAEwDQYJKoZI
+hvcNAQELBQADggEBAGoxRyyY+YraVOlFMzmyf+TeCQVibOJvKmY/HUjqCujgoj6o
+7UwYDAPyfzuVerDj2IzJ9bFB818iOIQUaO8Gw70EOzDifZFCm9/pET3SD7aGd4Kk
+DjCbjml/MNidVezPXNcdAM+XJ56jd2owk/pB4jaw3bkNcmn0aSnFg421fZibrTcS
+VRPCHIvV8gSqJk9ENO5EGIGU1VmTR909aIYB2fYyyW/1fyP/gn7d1Afy8CimZ1uD
+mUl5qQ5/CY378MmnODiGhsHJeH+ws77yLPwnh8eVtISwYMu9qfNRYFnotK7a5mxU
+CWpoSR77NmCUCQOarzb34soL2zZlIK9Lx+4VQPo=
+-----END CERTIFICATE-----

tools/v/examples/ssl_server/client.v

@@ -0,0 +1,17 @@
+import io
+import os
+import net.mbedtls
+
+fn main() {
+	mut client := mbedtls.new_ssl_conn(mbedtls.SSLConnectConfig{
+		verify:   os.resource_abs_path('cert/ca.crt')
+		cert:     os.resource_abs_path('cert/client.crt')
+		cert_key: os.resource_abs_path('cert/client.key')
+		validate: true
+	})!
+
+	client.dial('localhost', 8443)!
+	client.write_string('GET / HTTP/1.1\r\n\r\n')!
+	mut reader := io.new_buffered_reader(reader: client)
+	println(reader.read_line()!)
+}

tools/v/examples/ssl_server/server.v

@@ -0,0 +1,20 @@
+import io
+import os
+import net.mbedtls
+
+fn main() {
+	mut server := mbedtls.new_ssl_listener('0.0.0.0:8443', mbedtls.SSLConnectConfig{
+		verify:   os.resource_abs_path('cert/ca.crt')
+		cert:     os.resource_abs_path('cert/server.crt')
+		cert_key: os.resource_abs_path('cert/server.key')
+		validate: true // mTLS
+	})!
+
+	mut client := server.accept()!
+	mut reader := io.new_buffered_reader(reader: client)
+	mut request := reader.read_line()!
+	println(request)
+	client.write_string('HTTP/1.1 200 OK\r\n')!
+	client.shutdown()!
+	server.shutdown()!
+}

tools/v/examples/ssl_server/server_sni.v

@@ -0,0 +1,70 @@
+import io
+import os
+import net.mbedtls
+
+// This example shows a very minimal HTTP server, that supports SNI.
+// Server Name Indication (SNI) is defined in RFC 6066.
+// See https://mbed-tls.readthedocs.io/en/latest/kb/how-to/use-sni/
+
+// Use the following commands, in separate shells, to test that it works,
+// after you start the server:
+//   curl -ik --resolve 1x.dk:8443:0.0.0.0        https://1x.dk:8443/abcd
+//   curl -ik --resolve example.com:8443:0.0.0.0  https://example.com:8443/xyz
+// Both of them should work, and the server should show that it tried to load
+// certificates, responding to the given domain name in each of the requests.
+
+// callback to return the certificates to use for the connection
+fn get_cert(mut _listener mbedtls.SSLListener, host string) !&mbedtls.SSLCerts {
+	println('reading certificates for ${host} ...')
+
+	// For our example, just always use the same certificates. In a real server,
+	// that should be dependent on the host parameter, and perhaps there should
+	// be some caching, so that they are not read each time for each request from
+	// the filesystem.
+
+	cert := os.read_file('cert/server.crt') or {
+		return error('Failed to read certificate ${host}: ${err}')
+	}
+	key := os.read_file('cert/server.key') or { return error('Failed to read key ${host}: ${err}') }
+	println('read certs for ${host}')
+
+	if mut c := mbedtls.new_sslcerts_in_memory('', cert, key) {
+		return c
+	} else {
+		return error('mbedtls.new_sslcerts_in_memory err: ${err}')
+	}
+}
+
+fn main() {
+	mut server := mbedtls.new_ssl_listener('0.0.0.0:8443', mbedtls.SSLConnectConfig{
+		verify:          os.resource_abs_path('cert/ca.crt')
+		cert:            os.resource_abs_path('cert/server.crt')
+		cert_key:        os.resource_abs_path('cert/server.key')
+		validate:        false
+		get_certificate: get_cert // set the SNI callback to enable this feature
+	})!
+	println('Listening on https://0.0.0.0:8443/ ...')
+	for {
+		mut client := server.accept() or {
+			println('accept error: ${err}')
+			continue
+		}
+		mut reader := io.new_buffered_reader(reader: client)
+		for {
+			line := reader.read_line() or { break }
+			if line.len == 0 {
+				break
+			}
+			println(line)
+		}
+		client.write_string('HTTP/1.1 200 OK\r\n') or { continue }
+
+		client.write_string('Content-Type: text/html\r\n') or { continue }
+		client.write_string('Connection: close\r\n') or { continue }
+		client.write_string('\r\n') or { continue }
+
+		client.write_string('Hello\n') or { continue }
+		client.shutdown()!
+	}
+	server.shutdown()!
+}

tools/v/examples/ssl_server/server_sni_advanced.v

@@ -0,0 +1,120 @@
+import net.mbedtls
+import os
+import io
+import net.http
+
+// first run cert/makecerts.sh to generate the certificates for this server
+
+// start the server with:
+// v run server_sni_advanced.v
+
+// test using curl:
+
+// connection using the 1x.dk certificate
+// curl -vik --resolve 1x.dk:8443:0.0.0.0 https://1x.dk:8443/
+
+// connection using the 2x.dk certificate
+// curl -vik --resolve 2x.dk:8443:0.0.0.0 https://2x.dk:8443/
+
+// default certificate (no sni callback)
+// curl -vik https://0.0.0.0:8443/
+
+@[heap]
+struct CertManager {
+mut:
+	// cache for the certificates
+	certs map[string]&mbedtls.SSLCerts
+}
+
+fn (mut cm CertManager) get_cert(mut _l mbedtls.SSLListener, host string) !&mbedtls.SSLCerts {
+	println('${host}')
+
+	if c := cm.certs[host] {
+		println('read certs for ${host} already ready')
+		return c
+	} else {
+		cert := os.read_file('cert/${host}.crt') or {
+			return error('Failed to read certificate ${host}: ${err}')
+		}
+		key := os.read_file('cert/${host}.key') or {
+			return error('Failed to read key ${host}: ${err}')
+		}
+		println('read certs for ${host}')
+
+		if mut c := mbedtls.new_sslcerts_in_memory('', cert, key) {
+			cm.certs[host] = c
+			return c
+		} else {
+			return error('mbedtls.new_sslcerts_in_memory err: ${err}')
+		}
+	}
+}
+
+fn main() {
+	// Load the default certificates
+	cert := os.read_file('cert/0x.dk.crt') or {
+		eprintln('Failed to read certificate: ${err}')
+		return
+	}
+	key := os.read_file('cert/0x.dk.key') or {
+		eprintln('Failed to read key: ${err}')
+		return
+	}
+
+	cm := CertManager{}
+
+	// Create the SSL configuration
+	mut config := mbedtls.SSLConnectConfig{
+		cert:                   cert
+		cert_key:               key
+		in_memory_verification: true // !importent
+		get_certificate:        cm.get_cert
+	}
+
+	mut server := mbedtls.new_ssl_listener('0.0.0.0:8443', config) or {
+		println('new_ssl_listener : ${err.msg()} : ${err.code()}')
+		return
+	}
+	println('Listening on https://0.0.0.0:8443')
+
+	// Accept and handle connections
+	for {
+		mut client := server.accept() or {
+			println('accept : ${err.msg()} : ${err.code()}')
+			continue
+		}
+		go handle_connection(mut client)
+	}
+
+	server.shutdown() or {
+		println('server.shutdown : ${err.msg()} : ${err.code()}')
+		return
+	}
+}
+
+fn handle_connection(mut ssl_conn mbedtls.SSLConn) {
+	mut reader := io.new_buffered_reader(reader: ssl_conn)
+
+	request := http.parse_request(mut reader) or {
+		println('parse_request failed : ${err}')
+		return
+	}
+
+	println('Received request: ${request.url}')
+
+	// Respond to the request
+	body := 'Hello, HTTPS!'
+	res := http.new_response(http.ResponseConfig{
+		body: body
+	})
+
+	ssl_conn.write(res.bytes()) or {
+		eprintln('Failed to write response: ${err}')
+		return
+	}
+
+	ssl_conn.shutdown() or {
+		eprintln('Failed to shutdown connection: ${err}')
+		return
+	}
+}