2 * Copyright (C) 2004, 2005, 2007, 2008, 2009, 2010 Free Software
5 * Author: Simon Josefsson
7 * This file is part of GNUTLS.
9 * GNUTLS is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * GNUTLS is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with GNUTLS; if not, write to the Free Software Foundation,
21 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
24 /* Parts copied from GnuTLS example programs. */
33 #include <sys/types.h>
34 #include <sys/socket.h>
36 #include <netinet/in.h>
37 #include <arpa/inet.h>
39 #include <gnutls/gnutls.h>
40 #include <gnutls/extra.h>
48 /* A very basic TLS client, with anonymous authentication.
52 #define MSG "Hello TLS"
55 client_avp (gnutls_session_t session
, void *ptr
,
56 const char *last
, size_t lastlen
, char **new, size_t * newlen
)
62 printf ("client: received %d bytes AVP: `%.*s'\n",
63 (int)lastlen
, (int) lastlen
, last
);
65 printf ("client: new application phase\n");
70 p
= "client's first AVP, next will be empty";
82 p
= "final client AVP, we'll restart next";
90 p
= readline ("Client TLS/IA AVP: ");
92 *new = gnutls_strdup (p
);
95 *newlen
= strlen (*new);
97 printf ("client: sending %d bytes AVP: `%s'\n", (int)*newlen
, *new);
99 gnutls_ia_permute_inner_secret (session
, 3, "foo");
108 gnutls_session_t session
;
109 char buffer
[MAX_BUF
+ 1];
110 gnutls_anon_client_credentials_t anoncred
;
111 gnutls_ia_client_credentials_t iacred
;
112 /* Need to enable anonymous KX specifically. */
113 const int kx_prio
[] = { GNUTLS_KX_ANON_DH
, 0 };
115 ret
= gnutls_global_init ();
117 fail ("global_init: %d\n", ret
);
118 ret
= gnutls_global_init_extra ();
120 fail ("global_init_extra: %d\n", ret
);
122 gnutls_anon_allocate_client_credentials (&anoncred
);
123 gnutls_ia_allocate_client_credentials (&iacred
);
125 /* Initialize TLS session
127 gnutls_init (&session
, GNUTLS_CLIENT
);
129 /* Use default priorities */
130 gnutls_set_default_priority (session
);
131 gnutls_kx_set_priority (session
, kx_prio
);
133 /* put the anonymous credentials to the current session
135 gnutls_credentials_set (session
, GNUTLS_CRD_ANON
, anoncred
);
136 gnutls_credentials_set (session
, GNUTLS_CRD_IA
, iacred
);
138 /* connect to the peer
142 gnutls_transport_set_ptr (session
, (gnutls_transport_ptr_t
) sd
);
145 gnutls_ia_set_client_avp_function (iacred
, client_avp
);
147 /* Perform the TLS handshake
149 ret
= gnutls_handshake (session
);
153 fail ("client: Handshake failed\n");
159 success ("client: Handshake was completed\n");
163 To test TLS/IA alert's (the server will print that a fatal alert
165 gnutls_alert_send(session, GNUTLS_AL_FATAL,
166 GNUTLS_A_INNER_APPLICATION_FAILURE);
169 if (!gnutls_ia_handshake_p (session
))
170 fail ("client: No TLS/IA negotiation\n");
173 success ("client: TLS/IA handshake\n");
175 ret
= gnutls_ia_handshake (session
);
179 fail ("client: TLS/IA handshake failed\n");
185 success ("client: TLS/IA Handshake was completed\n");
189 gnutls_record_send (session
, MSG
, strlen (MSG
));
191 ret
= gnutls_record_recv (session
, buffer
, MAX_BUF
);
194 success ("client: Peer has closed the TLS connection\n");
199 fail ("client: Error: %s\n", gnutls_strerror (ret
));
205 printf ("- Received %d bytes: ", ret
);
206 for (ii
= 0; ii
< ret
; ii
++)
208 fputc (buffer
[ii
], stdout
);
210 fputs ("\n", stdout
);
213 gnutls_bye (session
, GNUTLS_SHUT_RDWR
);
219 gnutls_deinit (session
);
221 gnutls_ia_free_client_credentials (iacred
);
223 gnutls_anon_free_client_credentials (anoncred
);
225 gnutls_global_deinit ();
228 /* This is a sample TLS 1.0 echo server, for anonymous authentication only.
231 #define SA struct sockaddr
233 #define PORT 5556 /* listen to 5556 port */
236 /* These are global */
237 gnutls_anon_server_credentials_t anoncred
;
238 gnutls_ia_server_credentials_t iacred
;
240 static gnutls_session_t
241 initialize_tls_session (void)
243 gnutls_session_t session
;
244 const int kx_prio
[] = { GNUTLS_KX_ANON_DH
, 0 };
246 gnutls_init (&session
, GNUTLS_SERVER
);
248 /* avoid calling all the priority functions, since the defaults
251 gnutls_set_default_priority (session
);
252 gnutls_kx_set_priority (session
, kx_prio
);
254 gnutls_credentials_set (session
, GNUTLS_CRD_ANON
, anoncred
);
256 gnutls_dh_set_prime_bits (session
, DH_BITS
);
261 static gnutls_dh_params_t dh_params
;
264 generate_dh_params (void)
266 const gnutls_datum_t p3
= { (char *) pkcs3
, strlen (pkcs3
) };
267 /* Generate Diffie-Hellman parameters - for use with DHE
268 * kx algorithms. These should be discarded and regenerated
269 * once a day, once a week or once a month. Depending on the
270 * security requirements.
272 gnutls_dh_params_init (&dh_params
);
273 return gnutls_dh_params_import_pkcs3 (dh_params
, &p3
, GNUTLS_X509_FMT_PEM
);
276 int err
, listen_sd
, i
;
278 struct sockaddr_in sa_serv
;
279 struct sockaddr_in sa_cli
;
280 socklen_t client_len
;
282 gnutls_session_t session
;
283 char buffer
[MAX_BUF
+ 1];
287 server_avp (gnutls_session_t session
, void *ptr
,
288 const char *last
, size_t lastlen
, char **new, size_t * newlen
)
294 printf ("server: received %d bytes AVP: `%.*s'\n",
295 (int)lastlen
, (int) lastlen
, last
);
297 gnutls_ia_permute_inner_secret (session
, 3, "foo");
302 p
= "first server AVP";
306 p
= "second server AVP, next will be empty, then a intermediate finish";
318 p
= "server avp, after intermediate finish, next another intermediate";
326 p
= "server avp, next will be the finish phase";
337 p
= readline ("Server TLS/IA AVP (type '1' to sync, '2' to finish): ");
342 if (strcmp (p
, "1") == 0)
344 success ("server: Sending IntermediatePhaseFinished...\n");
348 if (strcmp (p
, "2") == 0)
350 success ("server: Sending FinalPhaseFinished...\n");
354 *new = gnutls_strdup (p
);
357 *newlen
= strlen (*new);
359 printf ("server: sending %d bytes AVP: `%s'\n", (int)*newlen
, *new);
369 listen_sd
= socket (AF_INET
, SOCK_STREAM
, 0);
373 fail ("server: socket failed\n");
377 memset (&sa_serv
, '\0', sizeof (sa_serv
));
378 sa_serv
.sin_family
= AF_INET
;
379 sa_serv
.sin_addr
.s_addr
= INADDR_ANY
;
380 sa_serv
.sin_port
= htons (PORT
); /* Server Port number */
382 setsockopt (listen_sd
, SOL_SOCKET
, SO_REUSEADDR
, (void *) &optval
,
385 err
= bind (listen_sd
, (SA
*) & sa_serv
, sizeof (sa_serv
));
389 fail ("server: bind failed\n");
393 err
= listen (listen_sd
, 1024);
397 fail ("server: listen failed\n");
401 success ("server: ready. Listening to port '%d'\n", PORT
);
407 /* this must be called once in the program
409 ret
= gnutls_global_init ();
411 fail ("global_init: %d\n", ret
);
412 ret
= gnutls_global_init_extra ();
414 fail ("global_init_extra: %d\n", ret
);
416 gnutls_anon_allocate_server_credentials (&anoncred
);
417 gnutls_ia_allocate_server_credentials (&iacred
);
419 success ("Launched, generating DH parameters...\n");
421 generate_dh_params ();
423 gnutls_anon_set_server_dh_params (anoncred
, dh_params
);
425 client_len
= sizeof (sa_cli
);
427 session
= initialize_tls_session ();
429 sd
= accept (listen_sd
, (SA
*) & sa_cli
, &client_len
);
431 success ("server: connection from %s, port %d\n",
432 inet_ntop (AF_INET
, &sa_cli
.sin_addr
, topbuf
,
433 sizeof (topbuf
)), ntohs (sa_cli
.sin_port
));
435 gnutls_transport_set_ptr (session
, (gnutls_transport_ptr_t
) sd
);
438 gnutls_credentials_set (session
, GNUTLS_CRD_IA
, iacred
);
439 gnutls_ia_set_server_avp_function (iacred
, server_avp
);
441 ret
= gnutls_handshake (session
);
445 gnutls_deinit (session
);
446 fail ("server: Handshake has failed (%s)\n\n", gnutls_strerror (ret
));
449 success ("server: Handshake was completed\n");
451 if (!gnutls_ia_handshake_p (session
))
452 fail ("server: No TLS/IA negotiation\n");
455 success ("server: TLS/IA handshake\n");
457 ret
= gnutls_ia_handshake (session
);
461 fail ("server: TLS/IA handshake failed\n");
467 success ("server: TLS/IA Handshake was completed\n");
471 /* see the Getting peer's information example */
472 /* print_info(session); */
477 memset (buffer
, 0, MAX_BUF
+ 1);
478 ret
= gnutls_record_recv (session
, buffer
, MAX_BUF
);
482 success ("server: Peer has closed the GNUTLS connection\n");
487 if (ret
== GNUTLS_E_FATAL_ALERT_RECEIVED
)
489 gnutls_alert_description_t alert
;
491 alert
= gnutls_alert_get (session
);
492 err
= gnutls_alert_get_name (alert
);
494 printf ("Fatal alert: %s\n", err
);
497 fail ("server: Received corrupted data(%d). Closing...\n", ret
);
502 /* echo data back to the client
504 gnutls_record_send (session
, buffer
, strlen (buffer
));
507 /* do not wait for the peer to close the connection.
509 gnutls_bye (session
, GNUTLS_SHUT_WR
);
512 gnutls_deinit (session
);
516 gnutls_ia_free_server_credentials (iacred
);
518 gnutls_anon_free_server_credentials (anoncred
);
520 gnutls_dh_params_deinit (dh_params
);
522 gnutls_global_deinit ();
524 success ("server: finished\n");