SSH Authentication for custom C Server script using TCP on Linux, connected to by iOS app

jcb0101

 

 

 

I am currently trying to construct a working version of a trivia game client on iOS, that contacts a server (written in C) on Linux(Ubuntu on Linux server hosted by Amazon).

The client program has been able to successfully contact the server over a TCP connection and have it's message processed, with the server returning a result such as finding a match from MYSQL database.

I am now completely stuck when it comes to implementing an encrypted/secure connection to send information to this custom server script. I began reading about SSL, and using certificate-key authentication/authorization and establishing this connection from an iOS app by using the key from the device's keychain assuming its the proper key. This lead to reading about TSL. I get the idea of everything but since I have this idea of trying to implement a custom server to handle information sent in, I haven't understood how to implement a certificate-key handshake for connections coming in on this specific port that the custom server script listens to.

1. Am I completely in the wrong direction thinking that I write the code to authenticate a server to a requesting user, within this script itself?
2. Would a proper direction be to: Have the server running under a specific linux user that has predefined abilities and restrictions so that nearly all that is allowed is running this script and contacting the MYSQL database? And then somehow the certificate is applied to just that user which runs the server that listens on the port designated for clients?
3. Am I completely misunderstanding how certificates-keys are to be applied and used when a client is attempting to connect to a given IP Address and Port Number over a TCP connection. For instance, would the iOS client attempt to contact the socket, and it would attempt verification with the main linux computer instance on amazon, and not the actual server script bound and listening to that same port, regardless.

Here is the linux server which uses fork() to create a new process on incoming connections:

Main function which uses fork

 

<span class="kwd">int</span><span class="pln"> main</span><span class="pun">(</span><span class="pln"> </span><span class="kwd">int</span><span class="pln"> argc</span><span class="pun">,</span><span class="pln"> </span><span class="kwd">char</span><span class="pln"> </span><span class="pun">*</span><span class="pln">argv</span><span class="pun">[]</span><span class="pln"> </span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
    </span><span class="kwd">int</span><span class="pln"> sockfd</span><span class="pun">,</span><span class="pln"> newsockfd</span><span class="pun">,</span><span class="pln"> portno</span><span class="pun">,</span><span class="pln"> clilen</span><span class="pun">;</span><span class="pln">
    </span><span class="kwd">char</span><span class="pln"> buffer</span><span class="pun">[</span><span class="lit">256</span><span class="pun">];</span><span class="pln">
    </span><span class="kwd">struct</span><span class="pln"> sockaddr_in serv_addr</span><span class="pun">,</span><span class="pln"> cli_addr</span><span class="pun">;</span><span class="pln">
    </span><span class="kwd">int</span><span class="pln"> n</span><span class="pun">,</span><span class="pln"> pid</span><span class="pun">;</span><span class="pln">

</span><span class="com">/* First call to socket() function */</span><span class="pln">
sockfd </span><span class="pun">=</span><span class="pln"> socket</span><span class="pun">(</span><span class="pln">AF_INET</span><span class="pun">,</span><span class="pln"> SOCK_STREAM</span><span class="pun">,</span><span class="pln"> </span><span class="lit">0</span><span class="pun">);</span><span class="pln">

</span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">sockfd </span><span class="pun"><</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
    perror</span><span class="pun">(</span><span class="str">"ERROR opening socket"</span><span class="pun">);</span><span class="pln">
    </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">1</span><span class="pun">);</span><span class="pln">
</span><span class="pun">}</span><span class="pln">

</span><span class="com">/* Initialize socket structure */</span><span class="pln">
bzero</span><span class="pun">((</span><span class="kwd">char</span><span class="pln"> </span><span class="pun">*)</span><span class="pln"> </span><span class="pun">&</span><span class="pln">serv_addr</span><span class="pun">,</span><span class="pln"> </span><span class="kwd">sizeof</span><span class="pun">(</span><span class="pln">serv_addr</span><span class="pun">));</span><span class="pln">
portno </span><span class="pun">=</span><span class="pln"> </span><span class="lit">8888</span><span class="pun">;</span><span class="pln"> 

serv_addr</span><span class="pun">.</span><span class="pln">sin_family </span><span class="pun">=</span><span class="pln"> AF_INET</span><span class="pun">;</span><span class="pln">
serv_addr</span><span class="pun">.</span><span class="pln">sin_addr</span><span class="pun">.</span><span class="pln">s_addr </span><span class="pun">=</span><span class="pln"> INADDR_ANY</span><span class="pun">;</span><span class="pln">
serv_addr</span><span class="pun">.</span><span class="pln">sin_port </span><span class="pun">=</span><span class="pln"> htons</span><span class="pun">(</span><span class="pln">portno</span><span class="pun">);</span><span class="pln">

</span><span class="com">/* Now bind the host address using bind() call.*/</span><span class="pln">
</span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">bind</span><span class="pun">(</span><span class="pln">sockfd</span><span class="pun">,</span><span class="pln"> </span><span class="pun">(</span><span class="kwd">struct</span><span class="pln"> sockaddr </span><span class="pun">*)</span><span class="pln"> </span><span class="pun">&</span><span class="pln">serv_addr</span><span class="pun">,</span><span class="pln"> </span><span class="kwd">sizeof</span><span class="pun">(</span><span class="pln">serv_addr</span><span class="pun">))</span><span class="pln"> </span><span class="pun"><</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
    perror</span><span class="pun">(</span><span class="str">"ERROR on binding"</span><span class="pun">);</span><span class="pln">
    </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">1</span><span class="pun">);</span><span class="pln">
</span><span class="pun">}</span><span class="pln">

</span><span class="com">/* Now start listening for the clients, here
 * process will go in sleep mode and will wait
 * for the incoming connection
 */</span><span class="pln">



listen</span><span class="pun">(</span><span class="pln">sockfd</span><span class="pun">,</span><span class="lit">5</span><span class="pun">);</span><span class="pln">
clilen </span><span class="pun">=</span><span class="pln"> </span><span class="kwd">sizeof</span><span class="pun">(</span><span class="pln">cli_addr</span><span class="pun">);</span><span class="pln">

</span><span class="kwd">while</span><span class="pln"> </span><span class="pun">((</span><span class="pln">newsockfd </span><span class="pun">=</span><span class="pln"> accept</span><span class="pun">(</span><span class="pln">sockfd</span><span class="pun">,</span><span class="pln"> </span><span class="pun">(</span><span class="kwd">struct</span><span class="pln"> sockaddr </span><span class="pun">*)</span><span class="pln"> </span><span class="pun">&</span><span class="pln">cli_addr</span><span class="pun">,</span><span class="pln"> </span><span class="pun">&</span><span class="pln">clilen</span><span class="pun">)))</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
    </span><span class="com">// Here is where the connnection is accepted and a new socket is made from it</span><span class="pln">

    </span><span class="com">// Then test cases to decide whether or not to fork the socket. (Test if it's empty.)</span><span class="pln">
    </span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">newsockfd </span><span class="pun"><</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
        perror</span><span class="pun">(</span><span class="str">"ERROR on accept"</span><span class="pun">);</span><span class="pln">
        </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">1</span><span class="pun">);</span><span class="pln">
    </span><span class="pun">}</span><span class="pln">

printf</span><span class="pun">(</span><span class="str">"IP Address: %lu"</span><span class="pun">,</span><span class="pln"> cli_addr</span><span class="pun">.</span><span class="pln">sin_addr</span><span class="pun">.</span><span class="pln">s_addr</span><span class="pun">);</span><span class="pln">
printf</span><span class="pun">(</span><span class="str">" Port: %hu "</span><span class="pun">,</span><span class="pln"> cli_addr</span><span class="pun">.</span><span class="pln">sin_port</span><span class="pun">);</span><span class="pln">

    </span><span class="com">// If the above new socket returns successful, the following is executed</span><span class="pln">
    </span><span class="com">// The fork function creates a new process.</span><span class="pln">
    </span><span class="com">/* Create child process */</span><span class="pln">
    pid </span><span class="pun">=</span><span class="pln"> fork</span><span class="pun">();</span><span class="pln">

    </span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">pid </span><span class="pun"><</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
        perror</span><span class="pun">(</span><span class="str">"ERROR on fork"</span><span class="pun">);</span><span class="pln">
        </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">1</span><span class="pun">);</span><span class="pln">
    </span><span class="pun">}</span><span class="pln">

    </span><span class="com">// If the fork is created succesfully, pass the integer for the new socket to the fork's processing function.</span><span class="pln">
    </span><span class="kwd">if</span><span class="pln"> </span><span class="pun">(</span><span class="pln">pid </span><span class="pun">==</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
        </span><span class="com">/* This is the client process */</span><span class="pln">
        </span><span class="com">// Close the original socket</span><span class="pln">
        close</span><span class="pun">(</span><span class="pln">sockfd</span><span class="pun">);</span><span class="pln">
        </span><span class="com">// Pass the copy of the socket ID to the new process</span><span class="pln">
        doprocessing</span><span class="pun">(</span><span class="pln">newsockfd</span><span class="pun">);</span><span class="pln">
        </span><span class="com">// Then exit since the new process function will handle the already established socket connection</span><span class="pln">
        </span><span class="kwd">exit</span><span class="pun">(</span><span class="lit">0</span><span class="pun">);</span><span class="pln">
    </span><span class="pun">}</span><span class="pln">
    </span><span class="kwd">else</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
        close</span><span class="pun">(</span><span class="pln">newsockfd</span><span class="pun">);</span><span class="pln">
    </span><span class="pun">}</span><span class="pln">
</span><span class="pun">}</span><span class="pln">
</span><span class="pun">}</span><span class="pln"> </span>

 

The doprocessing() function 

<span class="kwd">void</span><span class="pln"> doprocessing </span><span class="pun">(</span><span class="kwd">int</span><span class="pln"> sock</span><span class="pun">)</span><span class="pln"> </span><span class="pun">{</span><span class="pln">

</span><span class="kwd">int</span><span class="pln"> read_size</span><span class="pun">;</span><span class="pln">
</span><span class="kwd">char</span><span class="pln"> client_message</span><span class="pun">[</span><span class="lit">2000</span><span class="pun">];</span><span class="pln">

</span><span class="kwd">char</span><span class="pln"> response_message</span><span class="pun">[</span><span class="lit">100</span><span class="pun">];</span><span class="pln">

</span><span class="kwd">char</span><span class="pln"> intArray</span><span class="pun">[</span><span class="lit">10</span><span class="pun">]</span><span class="pln"> </span><span class="pun">=</span><span class="pln"> </span><span class="pun">{</span><span class="lit">0</span><span class="pun">};</span><span class="pln">


</span><span class="kwd">while</span><span class="pun">(</span><span class="pln"> </span><span class="pun">(</span><span class="pln">read_size </span><span class="pun">=</span><span class="pln"> recv</span><span class="pun">(</span><span class="pln">sock </span><span class="pun">,</span><span class="pln"> client_message </span><span class="pun">,</span><span class="pln"> </span><span class="lit">2000</span><span class="pln"> </span><span class="pun">,</span><span class="pln"> </span><span class="lit">0</span><span class="pun">))</span><span class="pln"> </span><span class="pun">></span><span class="pln"> </span><span class="lit">0</span><span class="pln"> </span><span class="pun">)</span><span class="pln">
</span><span class="pun">{</span><span class="pln">

    </span><span class="com">//DO CUSTOM SERVER STUFF HERE DEPENDING ON MESSAGE RECEIVED</span><span class="pln">
</span><span class="pun">}</span><span class="pln">
    </span><span class="kwd">else</span><span class="pln"> </span><span class="pun">{</span><span class="pln">
        printf</span><span class="pun">(</span><span class="str">"Match didnt work"</span><span class="pun">);</span><span class="pln">
    </span><span class="pun">}</span><span class="pln">

</span><span class="kwd">if</span><span class="pun">(</span><span class="pln">read_size </span><span class="pun">==</span><span class="pln"> </span><span class="lit">0</span><span class="pun">)</span><span class="pln">
</span><span class="pun">{</span><span class="pln">
    puts</span><span class="pun">(</span><span class="str">"Client disconnected"</span><span class="pun">);</span><span class="pln">
    fflush</span><span class="pun">(</span><span class="pln">stdout</span><span class="pun">);</span><span class="pln">
</span><span class="pun">}</span><span class="pln">
</span><span class="kwd">else</span><span class="pln"> </span><span class="kwd">if</span><span class="pun">(</span><span class="pln">read_size </span><span class="pun">==</span><span class="pln"> </span><span class="pun">-</span><span class="lit">1</span><span class="pun">)</span><span class="pln">
</span><span class="pun">{</span><span class="pln">
    perror</span><span class="pun">(</span><span class="str">"recv failed"</span><span class="pun">);</span><span class="pln">
</span><span class="pun">}</span>

I didn't include all of the code that comes after the server received a message and decides which functions to call to contact databases, etc... but I think I should note all of these functions are listed in the same script. I am currently doing this because I am just attempting to get everything running so I can see and understand the flow of information.

The main question is Where would I start implementing code that takes an incoming connection and goes through all of the SSL handshake steps to authenticate/authorize this server...

I have been reading everything I could find on the internet and the only thing I seem to come across is how to setup the certificates for a server like Apache, etc... and I feel like I don't understand how certificates are even implemented or if this is even a reasonable approach to writing a server script that can handle an SSL/TSL TCP connection, and process that data for queries to a MYSQL database that are on the same machine the server script is running on. Am I going about things the right way?

Thank you so much for any help! It is sincerely appreciated.