Qt文档阅读笔记-DTLS server解析

傷城~ 2022-10-05 08:50 172阅读 0赞

此篇博文展示了如何创建一个简单的DTLS服务端：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70][]

注意：这个DTLS服务端需要和DTLS客户端一起跑，才能看出效果。

服务端实现了DtlsServer类，这个类使用了QUdpSocket，QDtlsClientVerifier，QDtls使用这些类用于和客户端的连接，完成握手及数据加密传输与读取。

class DtlsServer : public QObject
 {
 Q_OBJECT
 
 public:
 DtlsServer();
 ~DtlsServer();
 
 bool listen(const QHostAddress &address, quint16 port);
 bool isListening() const;
 void close();
 
 signals:
 void errorMessage(const QString &message);
 void warningMessage(const QString &message);
 void infoMessage(const QString &message);
 
 void datagramReceived(const QString &peerInfo, const QByteArray &cipherText,
 const QByteArray &plainText);
 
 private slots:
 void readyRead();
 void pskRequired(QSslPreSharedKeyAuthenticator *auth);
 
 private:
 void handleNewConnection(const QHostAddress &peerAddress, quint16 peerPort,
 const QByteArray &clientHello);
 
 void doHandshake(QDtls *newConnection, const QByteArray &clientHello);
 void decryptDatagram(QDtls *connection, const QByteArray &clientMessage);
 void shutdown();
 
 bool listening = false;
 QUdpSocket serverSocket;
 
 QSslConfiguration serverConfiguration;
 QDtlsClientVerifier cookieSender;
 std::vector<std::unique_ptr<QDtls>> knownClients;
 
 Q_DISABLE_COPY(DtlsServer)
 };

构造函数中QUdpSocket::readyRead()信号连接了readyRead()槽，用于获取客户端的数据报，最简单的设置了DTLS的配置：

DtlsServer::DtlsServer()
      {
          connect(&serverSocket, &QAbstractSocket::readyRead, this, &DtlsServer::readyRead);
    
          serverConfiguration = QSslConfiguration::defaultDtlsConfiguration();
          serverConfiguration.setPreSharedKeyIdentityHint("Qt DTLS example server");
          serverConfiguration.setPeerVerifyMode(QSslSocket::VerifyNone);
      }

注意：服务端未使用证书，仅仅是依赖共享密钥（PSK）握手。

listen()与QUdpSocket进行了捆绑：

bool DtlsServer::listen(const QHostAddress &address, quint16 port)
      {
          if (address != serverSocket.localAddress() || port != serverSocket.localPort()) {
              shutdown();
              listening = serverSocket.bind(address, port);
              if (!listening)
                  emit errorMessage(serverSocket.errorString());
          } else {
              listening = true;
          }
    
          return listening;
      }

readyRead()槽函数获取客户端数据报：

...
 const qint64 bytesToRead = serverSocket.pendingDatagramSize();
 if (bytesToRead <= 0) {
 emit warningMessage(tr("A spurious read notification"));
 return;
 }
 
 QByteArray dgram(bytesToRead, Qt::Uninitialized);
 QHostAddress peerAddress;
 quint16 peerPort = 0;
 const qint64 bytesRead = serverSocket.readDatagram(dgram.data(), dgram.size(),
 &peerAddress, &peerPort);
 if (bytesRead <= 0) {
 emit warningMessage(tr("Failed to read a datagram: ") + serverSocket.errorString());
 return;
 }
 
 dgram.resize(bytesRead);
 ...

随后获取客户端的IP和端口，服务端发送数据报给客户端：

...
 if (peerAddress.isNull() || !peerPort) {
 emit warningMessage(tr("Failed to extract peer info (address, port)"));
 return;
 }
 
 const auto client = std::find_if(knownClients.begin(), knownClients.end(),
 [&](const std::unique_ptr<QDtls> &connection){
 return connection->peerAddress() == peerAddress
 && connection->peerPort() == peerPort;
 });
 ...

如果是新的客户端，未知地址和端口，客户端会发送ClientHello消息，随后服务端回HelloVerifyRequest这个要先处理下：

...
      if (client == knownClients.end())
          return handleNewConnection(peerAddress, peerPort, dgram);
          ...

如果是连上的已知的客户端，服务端会进行解密：

...
      if ((*client)->isConnectionEncrypted()) {
          decryptDatagram(client->get(), dgram);
          if ((*client)->dtlsError() == QDtlsError::RemoteClosedConnectionError)
              knownClients.erase(client);
          return;
      }
          ...

以及进行握手：

...
      doHandshake(client->get(), dgram);
          ...

handleNewConnect()对客户端进行认证，以及发送HelloVerifyRequest：

void DtlsServer::handleNewConnection(const QHostAddress &peerAddress,
                                           quint16 peerPort, const QByteArray &clientHello)
      {
          if (!listening)
              return;
    
          const QString peerInfo = peer_info(peerAddress, peerPort);
          if (cookieSender.verifyClient(&serverSocket, clientHello, peerAddress, peerPort)) {
              emit infoMessage(peerInfo + tr(": verified, starting a handshake"));
          ...

如果服务端认为新来的客户端可达，那个服务端会创建一个Qtls的配置，然后进行握手：

...
 std::unique_ptr<QDtls> newConnection{new QDtls{QSslSocket::SslServerMode}};
 newConnection->setDtlsConfiguration(serverConfiguration);
 newConnection->setPeer(peerAddress, peerPort);
 newConnection->connect(newConnection.get(), &QDtls::pskRequired,
 this, &DtlsServer::pskRequired);
 knownClients.push_back(std::move(newConnection));
 doHandshake(knownClients.back().get(), clientHello);
 ...

关于握手的代码在doHandshake()中

void DtlsServer::doHandshake(QDtls *newConnection, const QByteArray &clientHello)
      {
          const bool result = newConnection->doHandshake(&serverSocket, clientHello);
          if (!result) {
              emit errorMessage(newConnection->dtlsErrorString());
              return;
          }
    
          const QString peerInfo = peer_info(newConnection->peerAddress(),
                                             newConnection->peerPort());
          switch (newConnection->handshakeState()) {
          case QDtls::HandshakeInProgress:
              emit infoMessage(peerInfo + tr(": handshake is in progress ..."));
              break;
          case QDtls::HandshakeComplete:
              emit infoMessage(tr("Connection with %1 encrypted. %2")
                               .arg(peerInfo, connection_info(newConnection)));
              break;
          default:
              Q_UNREACHABLE();
          }
      }

在握手中，QDtls::pskRequired()信号关联到pskRequired()槽函数中，并且设置了PSK：

void DtlsServer::pskRequired(QSslPreSharedKeyAuthenticator *auth)
      {
          Q_ASSERT(auth);
    
          emit infoMessage(tr("PSK callback, received a client's identity: '%1'")
                           .arg(QString::fromLatin1(auth->identity())));
          auth->setPreSharedKey(QByteArrayLiteral("\x1a\x2b\x3c\x4d\x5e\x6f"));
      }

在握手完成后，就可以进行数据的加密发送和响应了：

void DtlsServer::decryptDatagram(QDtls *connection, const QByteArray &clientMessage)
      {
          Q_ASSERT(connection->isConnectionEncrypted());
    
          const QString peerInfo = peer_info(connection->peerAddress(), connection->peerPort());
          const QByteArray dgram = connection->decryptDatagram(&serverSocket, clientMessage);
          if (dgram.size()) {
              emit datagramReceived(peerInfo, clientMessage, dgram);
              connection->writeDatagramEncrypted(&serverSocket, tr("to %1: ACK").arg(peerInfo).toLatin1());
          } else if (connection->dtlsError() == QDtlsError::NoError) {
              emit warningMessage(peerInfo + ": " + tr("0 byte dgram, could be a re-connect attempt?"));
          } else {
              emit errorMessage(peerInfo + ": " + connection->dtlsErrorString());
          }
      }

服务端关闭DTLS服务调用QDtls::shutdown()

void DtlsServer::shutdown()
      {
          for (const auto &connection : qExchange(knownClients, {}))
              connection->shutdown(&serverSocket);
    
          serverSocket.close();
      }

下面是出现问题或警告时的代码：

const QString colorizer(QStringLiteral("%2 "));
 
 void MainWindow::addErrorMessage(const QString &message)
 {
 ui->serverInfo->insertHtml(colorizer.arg(QStringLiteral("Crimson"), message));
 }
 
 void MainWindow::addWarningMessage(const QString &message)
 {
 ui->serverInfo->insertHtml(colorizer.arg(QStringLiteral("DarkOrange"), message));
 }
 
 void MainWindow::addInfoMessage(const QString &message)
 {
 ui->serverInfo->insertHtml(colorizer.arg(QStringLiteral("DarkBlue"), message));
 }
 
 void MainWindow::addClientMessage(const QString &peerInfo, const QByteArray &datagram,
 const QByteArray &plainText)
 {
 static const QString messageColor = QStringLiteral("DarkMagenta");
 static const QString formatter = QStringLiteral(" ---------------"
 " A message from %1"
 " DTLS datagram: %2"
 " As plain text: %3");
 
 const QString html = formatter.arg(peerInfo, QString::fromUtf8(datagram.toHex(' ')),
 QString::fromUtf8(plainText));
 ui->messages->insertHtml(colorizer.arg(messageColor, html));
 }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70]: /images/20221005/7c55df2795ec4df4ab39419e46b896a8.png