-0x7180 - SSL - Verification of the message MAC failed

azma84 · November 28, 2020, 8:12am

The SSL server is the one from the examples mbedtls/ssl_server.c at development · Mbed-TLS/mbedtls · GitHub
It is configured on port 8080.
The server runs on the linux operating system
Linux commands give the following:
uname -a
Linux termv7 4.15.0-91-generic #92-Ubuntu SMP Fri Feb 28 11:09:48 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

On the client side, the sim800 module is used.

Log file:
http://lists.trustedfirmware.org/pipermail/mbed-tls/attachments/20201124/f1a4e5fa/attachment-0001.txt

File contents TermV-terminals-server.key:

subject=/C=RU/ST=Sample/L=Sample/O=Sample/OU=Sample/CN=localhost
issuer=/C=RU/ST=Sample/L=Sample/O=Sample/OU=Sample/CN=Sample
-----BEGIN CERTIFICATE-----
MIIDTjCCAjYCFBhhDBE3BeiTMD0dzFYOGILO8yq0MA0GCSqGSIb3DQEBCwUAMGIx
CzAJBgNVBAYTAlJVMQ8wDQYDVQQIDAZTYW1wbGUxDzANBgNVBAcMBlNhbXBsZTEP
MA0GA1UECgwGU2FtcGxlMQ8wDQYDVQQLDAZTYW1wbGUxDzANBgNVBAMMBlNhbXBs
ZTAeFw0yMDAxMTgxODA5MDlaFw0yNDAxMTcxODA5MDlaMGUxCzAJBgNVBAYTAlJV
MQ8wDQYDVQQIDAZTYW1wbGUxDzANBgNVBAcMBlNhbXBsZTEPMA0GA1UECgwGU2Ft
cGxlMQ8wDQYDVQQLDAZTYW1wbGUxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBALQSjObDf16fv02qH+3FtI4eX2tPfj+u
XsSF8KK6OpcNNfHv17LB9NRUGbZdeikvL5mjB1qd8Qt5YBzSYvvNmuQqn/ZZhEhg
9zqDd+j6dsl03OSW42qSP59M22plqhHZv1ZpkbpHSnEbbwbIVhgx1GuJvMHbQKxw
et3UobG9M7q0/6Z2hlvbiuQgZWpc6+vnGGFUzVFjJhsUMgewU1UwTtfahOVegv9v
ocuj+AOHzzH2+l72ybpKIFKZ6eXjr3sVp1lIPXm+gUNLqkReNV2QVk4H/j2ow3xu
hdHjiPQ+6o6dgbCHeCvbf7Qs35S8YlQH/Mn2bik2NIMKucdq7S35AEsCAwEAATAN
BgkqhkiG9w0BAQsFAAOCAQEAhANjStGtYfPJ2Ibkbn6ct4bWLPe6sFBvbwYow3Fd
lBz0oxBukhJDOrPa4OqJDpnWenXkEcUrulI2JG5sIylOg3QlwlmgPoJU9fkpmr+u
xNVlTxBSh1BVp0sccC+LxNRyDMl4C89R1TjPpPjoRU4cciY9N0oygPjTj0c26qBU
iqwtyJTeeJYJUdplCMvXFOt8deqi/NBpBGnEfo8P/IeM/iCWLD5VtloHX/R0C+au
q6803qd1/Gd0pIdsELQKrR6mBz6sWukg2f25GheLQVV7Wz/elZD8MwYwjYLoCtIP
65Ae3Eb6S2KlsVPzMj09u6kQ+KPfZtKu8tiUSc+11hurRw==
-----END CERTIFICATE-----

File contents TermV-terminals-server.crt:

Server sources:

#include <stdio.h>

/*

SSL server demonstration program
Copyright The Mbed TLS Contributors
SPDX-License-Identifier: Apache-2.0
Licensed under the Apache License, Version 2.0 (the “License”); you may
not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an “AS IS” BASIS, WITHOUT
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

#if !defined(MBEDTLS_CONFIG_FILE)
#include “mbedtls/config.h”
#else
#include MBEDTLS_CONFIG_FILE
#endif

#if defined(MBEDTLS_PLATFORM_C)
#include “mbedtls/platform.h”
#else
#include <stdio.h>
#include <stdlib.h>
#define mbedtls_time time
#define mbedtls_time_t time_t
#define mbedtls_fprintf fprintf
#define mbedtls_printf printf
#define mbedtls_exit exit
#define MBEDTLS_EXIT_SUCCESS EXIT_SUCCESS
#define MBEDTLS_EXIT_FAILURE EXIT_FAILURE
#endif

#if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_CERTS_C) ||
!defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_SSL_TLS_C) ||
!defined(MBEDTLS_SSL_SRV_C) || !defined(MBEDTLS_NET_C) ||
!defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_CTR_DRBG_C) ||
!defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_FS_IO) ||
!defined(MBEDTLS_PEM_PARSE_C)
int main( void )
{
mbedtls_printf("MBEDTLS_BIGNUM_C and/or MBEDTLS_CERTS_C and/or MBEDTLS_ENTROPY_C "
"and/or MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_SRV_C and/or "
"MBEDTLS_NET_C and/or MBEDTLS_RSA_C and/or "
"MBEDTLS_CTR_DRBG_C and/or MBEDTLS_X509_CRT_PARSE_C "
“and/or MBEDTLS_PEM_PARSE_C not defined.\n”);
mbedtls_exit( 0 );
}
#else

#include <stdlib.h>
#include <string.h>

#if defined(_WIN32)
#include <windows.h>
#endif

#include “mbedtls/entropy.h”
#include “mbedtls/ctr_drbg.h”
#include “mbedtls/certs.h”
#include “mbedtls/x509.h”
#include “mbedtls/ssl.h”
#include “mbedtls/net_sockets.h”
#include “mbedtls/error.h”
#include “mbedtls/debug.h”

#if defined(MBEDTLS_SSL_CACHE_C)
#include “mbedtls/ssl_cache.h”
#endif

#define HTTP_RESPONSE
“HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n”
“

mbed TLS Test Server

\r\n”
“

Successful connection using: %s

\r\n”

#define DEBUG_LEVEL 5

static void my_debug( void *ctx, int level,
const char *file, int line,
const char *str )
{
((void) level);

mbedtls_fprintf( (FILE *) ctx, "%s:%04d: %s", file, line, str );
fflush(  (FILE *) ctx  );

}

int main( void )
{
int ret, len;
mbedtls_net_context listen_fd, client_fd;
unsigned char buf[1024];
const char *pers = “ssl_server”;

mbedtls_entropy_context entropy;
mbedtls_ctr_drbg_context ctr_drbg;
mbedtls_ssl_context ssl;
mbedtls_ssl_config conf;
mbedtls_x509_crt srvcert;
mbedtls_pk_context pkey;

#if defined(MBEDTLS_SSL_CACHE_C)
mbedtls_ssl_cache_context cache;
#endif

mbedtls_net_init( &listen_fd );
mbedtls_net_init( &client_fd );
mbedtls_ssl_init( &ssl );
mbedtls_ssl_config_init( &conf );

#if defined(MBEDTLS_SSL_CACHE_C)
mbedtls_ssl_cache_init( &cache );
#endif
mbedtls_x509_crt_init( &srvcert );
mbedtls_pk_init( &pkey );
mbedtls_entropy_init( &entropy );
mbedtls_ctr_drbg_init( &ctr_drbg );

#if defined(MBEDTLS_DEBUG_C)
mbedtls_debug_set_threshold( DEBUG_LEVEL );
#endif

/*
 * 1. Load the certificates and private RSA key
 */
mbedtls_printf( "\n  . Loading the server cert. and key..." );
fflush( stdout );

/*
 * This demonstration program uses embedded test certificates.
 * Instead, you may want to use mbedtls_x509_crt_parse_file() to read the
 * server and CA certificates, as well as mbedtls_pk_parse_keyfile().
 */

ret = mbedtls_x509_crt_parse_file( &srvcert,"/etc/minpay/cert/TermV-terminals-server.crt");

if( ret != 0 )
{
    mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse returned %d\n\n", ret );
    goto exit;
}


ret =  mbedtls_pk_parse_keyfile( &pkey,"/etc/minpay/cert/TermV-terminals-server.key", NULL );

if( ret != 0 )
{
    mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse returned %d\n\n", ret );
    goto exit;
}


mbedtls_printf( " ok\n" );

/*
 * 2. Setup the listening TCP socket
 */
mbedtls_printf( "  . Bind on https://localhost:8080/ ..." );
fflush( stdout );

if( ( ret = mbedtls_net_bind( &listen_fd, NULL, "8080", MBEDTLS_NET_PROTO_TCP ) ) != 0 )
{
    mbedtls_printf( " failed\n  ! mbedtls_net_bind returned %d\n\n", ret );
    goto exit;
}

mbedtls_printf( " ok\n" );

/*
 * 3. Seed the RNG
 */
mbedtls_printf( "  . Seeding the random number generator..." );
fflush( stdout );

if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
                           (const unsigned char *) pers,
                           strlen( pers ) ) ) != 0 )
{
    mbedtls_printf( " failed\n  ! mbedtls_ctr_drbg_seed returned %d\n", ret );
    goto exit;
}

mbedtls_printf( " ok\n" );

/*
 * 4. Setup stuff
 */
mbedtls_printf( "  . Setting up the SSL data...." );
fflush( stdout );

if( ( ret = mbedtls_ssl_config_defaults( &conf,
                MBEDTLS_SSL_IS_SERVER,
                MBEDTLS_SSL_TRANSPORT_STREAM,
                MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
{
    mbedtls_printf( " failed\n  ! mbedtls_ssl_config_defaults returned %d\n\n", ret );
    goto exit;
}

mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );

#if defined(MBEDTLS_SSL_CACHE_C)
mbedtls_ssl_conf_session_cache( &conf, &cache,
mbedtls_ssl_cache_get,
mbedtls_ssl_cache_set );
#endif

mbedtls_ssl_conf_ca_chain( &conf, srvcert.next, NULL );
if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &srvcert, &pkey ) ) != 0 )
{
    mbedtls_printf( " failed\n  ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret );
    goto exit;
}

if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
{
    mbedtls_printf( " failed\n  ! mbedtls_ssl_setup returned %d\n\n", ret );
    goto exit;
}

mbedtls_printf( " ok\n" );

reset:
#ifdef MBEDTLS_ERROR_C
if( ret != 0 )
{
char error_buf[100];
mbedtls_strerror( ret, error_buf, 100 );
mbedtls_printf(“Last error was: %d - %s\n\n”, ret, error_buf );
}
#endif

mbedtls_net_free( &client_fd );

mbedtls_ssl_session_reset( &ssl );

/*
 * 3. Wait until a client connects
 */
mbedtls_printf( "  . Waiting for a remote connection ..." );
fflush( stdout );

if( ( ret = mbedtls_net_accept( &listen_fd, &client_fd,
                                NULL, 0, NULL ) ) != 0 )
{
    mbedtls_printf( " failed\n  ! mbedtls_net_accept returned %d\n\n", ret );
    goto exit;
}

mbedtls_ssl_set_bio( &ssl, &client_fd, mbedtls_net_send, mbedtls_net_recv, NULL );

mbedtls_printf( " ok\n" );

/*
 * 5. Handshake
 */
mbedtls_printf( "  . Performing the SSL/TLS handshake..." );
fflush( stdout );

while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
{
    if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
    {
        mbedtls_printf( " failed\n  ! mbedtls_ssl_handshake returned %d\n\n", ret );
        goto reset;
    }
}

mbedtls_printf( " ok\n" );

/*
 * 6. Read the HTTP Request
 */
mbedtls_printf( "  < Read from client:" );
fflush( stdout );

do
{
    len = sizeof( buf ) - 1;
    memset( buf, 0, sizeof( buf ) );
    ret = mbedtls_ssl_read( &ssl, buf, len );

    if( ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE )
        continue;

    if( ret <= 0 )
    {
        switch( ret )
        {
            case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
                mbedtls_printf( " connection was closed gracefully\n" );
                break;

            case MBEDTLS_ERR_NET_CONN_RESET:
                mbedtls_printf( " connection was reset by peer\n" );
                break;

            default:
                mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", (unsigned int) -ret );
                break;
        }

        break;
    }

    len = ret;
    mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf );

    if( ret > 0 )
        break;
}
while( 1 );

/*
 * 7. Write the 200 Response
 */
mbedtls_printf( "  > Write to client:" );
fflush( stdout );

len = sprintf( (char *) buf, HTTP_RESPONSE,
               mbedtls_ssl_get_ciphersuite( &ssl ) );

while( ( ret = mbedtls_ssl_write( &ssl, buf, len ) ) <= 0 )
{
    if( ret == MBEDTLS_ERR_NET_CONN_RESET )
    {
        mbedtls_printf( " failed\n  ! peer closed the connection\n\n" );
        goto reset;
    }

    if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
    {
        mbedtls_printf( " failed\n  ! mbedtls_ssl_write returned %d\n\n", ret );
        goto exit;
    }
}

len = ret;
mbedtls_printf( " %d bytes written\n\n%s\n", len, (char *) buf );

mbedtls_printf( "  . Closing the connection..." );

while( ( ret = mbedtls_ssl_close_notify( &ssl ) ) < 0 )
{
    if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
        ret != MBEDTLS_ERR_SSL_WANT_WRITE )
    {
        mbedtls_printf( " failed\n  ! mbedtls_ssl_close_notify returned %d\n\n", ret );
        goto reset;
    }
}

mbedtls_printf( " ok\n" );

ret = 0;
goto reset;

exit:

#ifdef MBEDTLS_ERROR_C
if( ret != 0 )
{
char error_buf[100];
mbedtls_strerror( ret, error_buf, 100 );
mbedtls_printf(“Last error was: %d - %s\n\n”, ret, error_buf );
}
#endif

mbedtls_net_free( &client_fd );
mbedtls_net_free( &listen_fd );

mbedtls_x509_crt_free( &srvcert );
mbedtls_pk_free( &pkey );
mbedtls_ssl_free( &ssl );
mbedtls_ssl_config_free( &conf );

#if defined(MBEDTLS_SSL_CACHE_C)
mbedtls_ssl_cache_free( &cache );
#endif
mbedtls_ctr_drbg_free( &ctr_drbg );
mbedtls_entropy_free( &entropy );

#if defined(_WIN32)
mbedtls_printf( " Press Enter to exit this program.\n" );
fflush( stdout ); getchar();
#endif

mbedtls_exit( ret );

}
#endif /* MBEDTLS_BIGNUM_C && MBEDTLS_CERTS_C && MBEDTLS_ENTROPY_C &&
MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_SRV_C && MBEDTLS_NET_C &&
MBEDTLS_RSA_C && MBEDTLS_CTR_DRBG_C && MBEDTLS_X509_CRT_PARSE_C
&& MBEDTLS_FS_IO && MBEDTLS_PEM_PARSE_C */

Topic		Replies	Views
Decryption fails with 0x7180 (Verification of the message MAC failed) Platform specific questions	11	3632	December 11, 2018
Verification of the message MAC failed Crypto and SSL questions	3	3984	February 21, 2019
Error 0x7780 during handshake Mbed TLS mbed_tls	7	8549	May 10, 2023
Mbed TLS Server MBEDTLS_SSL_VERIFY_REQUIRED handshake fails Generic mbed_tls	0	394	October 11, 2023
TLS handshake issue Generic mbed_client , mbed_tls	5	5119	October 7, 2018

-0x7180 - SSL - Verification of the message MAC failed

mbed TLS Test Server

Related topics