src/common.c

   1 /*
   2  * Copyright (C) 2000-2012 Free Software Foundation, Inc.
   3  * Author: Nikos Mavrogiannopoulos
   4  *
   5  * This file is part of GnuTLS.
   6  *
   7  * GnuTLS is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation, either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * GnuTLS is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include <config.h>
  22
  23 /* Work around problem reported in
  24    <http://permalink.gmane.org/gmane.comp.lib.gnulib.bugs/15755>.*/
  25 #if GETTIMEOFDAY_CLOBBERS_LOCALTIME
  26 #undef localtime
  27 #endif
  28
  29 #include <getpass.h>
  30
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <string.h>
  34 #include <gnutls/gnutls.h>
  35 #include <gnutls/x509.h>
  36 #include <gnutls/openpgp.h>
  37 #include <gnutls/crypto.h>
  38 #include <time.h>
  39 #include <common.h>
  40
  41 #ifdef ENABLE_PKCS11
  42 # include <gnutls/pkcs11.h>
  43 #endif
  44
  45 #define SU(x) (x!=NULL?x:"Unknown")
  46
  47 const char str_unknown[] = "(unknown)";
  48
  49 /* Hex encodes the given data.
  50  */
  51 const char *
  52 raw_to_string (const unsigned char *raw, size_t raw_size)
  53 {
  54     static char buf[1024];
  55     size_t i;
  56     if (raw_size == 0)
  57         return "(empty)";
  58
  59     if (raw_size * 3 + 1 >= sizeof (buf))
  60         return "(too large)";
  61
  62     for (i = 0; i < raw_size; i++)
  63       {
  64           sprintf (&(buf[i * 3]), "%02X%s", raw[i],
  65                    (i == raw_size - 1) ? "" : ":");
  66       }
  67     buf[sizeof (buf) - 1] = '\0';
  68
  69     return buf;
  70 }
  71
  72 static void
  73 print_x509_info_compact (gnutls_session_t session)
  74 {
  75     gnutls_x509_crt_t crt;
  76     const gnutls_datum_t *cert_list;
  77     unsigned int cert_list_size = 0;
  78     int ret;
  79     gnutls_datum_t cinfo;
  80
  81     cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
  82     if (cert_list_size == 0)
  83       {
  84           fprintf (stderr, "No certificates found!\n");
  85           return;
  86       }
  87
  88     gnutls_x509_crt_init (&crt);
  89     ret =
  90           gnutls_x509_crt_import (crt, &cert_list[0],
  91                                   GNUTLS_X509_FMT_DER);
  92     if (ret < 0)
  93       {
  94         fprintf (stderr, "Decoding error: %s\n",
  95                  gnutls_strerror (ret));
  96         return;
  97       }
  98
  99     ret =
 100       gnutls_x509_crt_print (crt, GNUTLS_CRT_PRINT_COMPACT, &cinfo);
 101     if (ret == 0)
 102       {
 103         printf ("- X.509 cert: %s\n", cinfo.data);
 104         gnutls_free (cinfo.data);
 105       }
 106
 107     gnutls_x509_crt_deinit (crt);
 108 }
 109
 110 static void
 111 print_x509_info (gnutls_session_t session, int flag, int print_cert)
 112 {
 113     gnutls_x509_crt_t crt;
 114     const gnutls_datum_t *cert_list;
 115     unsigned int cert_list_size = 0, j;
 116     int ret;
 117
 118     cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
 119     if (cert_list_size == 0)
 120       {
 121           fprintf (stderr, "No certificates found!\n");
 122           return;
 123       }
 124
 125     printf ("- Certificate type: X.509\n");
 126     printf ("- Got a certificate list of %d certificates.\n",
 127             cert_list_size);
 128
 129     for (j = 0; j < cert_list_size; j++)
 130       {
 131           gnutls_datum_t cinfo;
 132
 133           gnutls_x509_crt_init (&crt);
 134           ret =
 135               gnutls_x509_crt_import (crt, &cert_list[j],
 136                                       GNUTLS_X509_FMT_DER);
 137           if (ret < 0)
 138             {
 139                 fprintf (stderr, "Decoding error: %s\n",
 140                          gnutls_strerror (ret));
 141                 return;
 142             }
 143
 144           printf ("- Certificate[%d] info:\n - ", j);
 145           if (flag == GNUTLS_CRT_PRINT_COMPACT && j > 0) flag = GNUTLS_CRT_PRINT_ONELINE;
 146
 147           ret =
 148             gnutls_x509_crt_print (crt, flag, &cinfo);
 149           if (ret == 0)
 150             {
 151                 printf ("%s\n", cinfo.data);
 152                 gnutls_free (cinfo.data);
 153             }
 154
 155           if (print_cert)
 156             {
 157                 size_t size = 0;
 158                 char *p = NULL;
 159
 160                 ret =
 161                     gnutls_x509_crt_export (crt, GNUTLS_X509_FMT_PEM, p,
 162                                             &size);
 163                 if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER)
 164                   {
 165                       p = malloc (size+1);
 166                       if (!p)
 167                         {
 168                             fprintf (stderr, "gnutls_malloc\n");
 169                             exit (1);
 170                         }
 171
 172                       ret =
 173                           gnutls_x509_crt_export (crt, GNUTLS_X509_FMT_PEM,
 174                                                   p, &size);
 175                   }
 176                 if (ret < 0)
 177                   {
 178                       fprintf (stderr, "Encoding error: %s\n",
 179                                gnutls_strerror (ret));
 180                       return;
 181                   }
 182
 183                 p[size] = 0;
 184                 fputs ("\n", stdout);
 185                 fputs (p, stdout);
 186                 fputs ("\n", stdout);
 187
 188                 gnutls_free (p);
 189             }
 190
 191           gnutls_x509_crt_deinit (crt);
 192       }
 193 }
 194
 195 /* returns true or false, depending on whether the hostname
 196  * matches to certificate */
 197 static int
 198 verify_x509_hostname (gnutls_session_t session, const char *hostname)
 199 {
 200   gnutls_x509_crt_t crt;
 201   const gnutls_datum_t *cert_list;
 202   unsigned int cert_list_size = 0;
 203   int ret;
 204
 205   cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
 206   if (cert_list_size == 0)
 207     {
 208       fprintf (stderr, "No certificates found!\n");
 209       return 0;
 210     }
 211
 212   gnutls_x509_crt_init (&crt);
 213   ret =
 214       gnutls_x509_crt_import (crt, &cert_list[0],
 215                               GNUTLS_X509_FMT_DER);
 216   if (ret < 0)
 217     {
 218       fprintf (stderr, "Decoding error: %s\n",
 219                gnutls_strerror (ret));
 220       return 0;
 221     }
 222
 223   /* Check the hostname of the first certificate if it matches
 224    * the name of the host we connected to.
 225    */
 226   if (hostname != NULL)
 227     {
 228       if (gnutls_x509_crt_check_hostname (crt, hostname) == 0)
 229         {
 230           printf
 231              ("- The hostname in the certificate does NOT match '%s'\n",
 232               hostname);
 233           ret = 0;
 234         }
 235       else
 236         {
 237           printf ("- The hostname in the certificate matches '%s'.\n",
 238                   hostname);
 239           ret = 1;
 240         }
 241     }
 242
 243   gnutls_x509_crt_deinit (crt);
 244
 245   return ret;
 246 }
 247
 248 #ifdef ENABLE_OPENPGP
 249 /* returns true or false, depending on whether the hostname
 250  * matches to certificate */
 251 static int
 252 verify_openpgp_hostname (gnutls_session_t session, const char *hostname)
 253 {
 254   gnutls_openpgp_crt_t crt;
 255   const gnutls_datum_t *cert_list;
 256   unsigned int cert_list_size = 0;
 257   int ret;
 258
 259   cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
 260   if (cert_list_size == 0)
 261     {
 262       fprintf (stderr, "No certificates found!\n");
 263       return 0;
 264     }
 265
 266   gnutls_openpgp_crt_init (&crt);
 267   ret =
 268       gnutls_openpgp_crt_import (crt, &cert_list[0],
 269                               GNUTLS_OPENPGP_FMT_RAW);
 270   if (ret < 0)
 271     {
 272       fprintf (stderr, "Decoding error: %s\n",
 273                gnutls_strerror (ret));
 274       return 0;
 275     }
 276
 277   /* Check the hostname of the first certificate if it matches
 278    * the name of the host we connected to.
 279    */
 280   if (gnutls_openpgp_crt_check_hostname (crt, hostname) == 0)
 281     {
 282       printf
 283              ("- The hostname in the certificate does NOT match '%s'\n",
 284               hostname);
 285       ret = 0;
 286     }
 287   else
 288     {
 289       printf ("- The hostname in the certificate matches '%s'.\n",
 290               hostname);
 291       ret = 1;
 292     }
 293
 294   gnutls_openpgp_crt_deinit (crt);
 295
 296   return ret;
 297 }
 298
 299 static void
 300 print_openpgp_info_compact (gnutls_session_t session)
 301 {
 302
 303     gnutls_openpgp_crt_t crt;
 304     const gnutls_datum_t *cert_list;
 305     unsigned int cert_list_size = 0;
 306     int ret;
 307
 308     cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
 309
 310     if (cert_list_size > 0)
 311       {
 312           gnutls_datum_t cinfo;
 313
 314           gnutls_openpgp_crt_init (&crt);
 315           ret = gnutls_openpgp_crt_import (crt, &cert_list[0],
 316                                            GNUTLS_OPENPGP_FMT_RAW);
 317           if (ret < 0)
 318             {
 319                 fprintf (stderr, "Decoding error: %s\n",
 320                          gnutls_strerror (ret));
 321                 return;
 322             }
 323
 324           ret =
 325               gnutls_openpgp_crt_print (crt, GNUTLS_CRT_PRINT_COMPACT, &cinfo);
 326           if (ret == 0)
 327             {
 328                 printf ("- OpenPGP cert: %s\n", cinfo.data);
 329                 gnutls_free (cinfo.data);
 330             }
 331
 332           gnutls_openpgp_crt_deinit (crt);
 333       }
 334 }
 335
 336 static void
 337 print_openpgp_info (gnutls_session_t session, int flag, int print_cert)
 338 {
 339
 340     gnutls_openpgp_crt_t crt;
 341     const gnutls_datum_t *cert_list;
 342     unsigned int cert_list_size = 0;
 343     int ret;
 344
 345     printf ("- Certificate type: OpenPGP\n");
 346
 347     cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
 348
 349     if (cert_list_size > 0)
 350       {
 351           gnutls_datum_t cinfo;
 352
 353           gnutls_openpgp_crt_init (&crt);
 354           ret = gnutls_openpgp_crt_import (crt, &cert_list[0],
 355                                            GNUTLS_OPENPGP_FMT_RAW);
 356           if (ret < 0)
 357             {
 358                 fprintf (stderr, "Decoding error: %s\n",
 359                          gnutls_strerror (ret));
 360                 return;
 361             }
 362
 363           ret =
 364               gnutls_openpgp_crt_print (crt, flag, &cinfo);
 365           if (ret == 0)
 366             {
 367                 printf ("- %s\n", cinfo.data);
 368                 gnutls_free (cinfo.data);
 369             }
 370
 371           if (print_cert)
 372             {
 373                 size_t size = 0;
 374                 char *p = NULL;
 375
 376                 ret =
 377                     gnutls_openpgp_crt_export (crt,
 378                                                GNUTLS_OPENPGP_FMT_BASE64,
 379                                                p, &size);
 380                 if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER)
 381                   {
 382                       p = malloc (size);
 383                       if (!p)
 384                         {
 385                             fprintf (stderr, "gnutls_malloc\n");
 386                             exit (1);
 387                         }
 388
 389                       ret =
 390                           gnutls_openpgp_crt_export (crt,
 391                                                      GNUTLS_OPENPGP_FMT_BASE64,
 392                                                      p, &size);
 393                   }
 394                 if (ret < 0)
 395                   {
 396                       fprintf (stderr, "Encoding error: %s\n",
 397                                gnutls_strerror (ret));
 398                       return;
 399                   }
 400
 401                 fputs (p, stdout);
 402                 fputs ("\n", stdout);
 403
 404                 gnutls_free (p);
 405             }
 406
 407           gnutls_openpgp_crt_deinit (crt);
 408       }
 409 }
 410
 411 #endif
 412
 413 /* returns false (0) if not verified, or true (1) otherwise
 414  */
 415 int
 416 cert_verify (gnutls_session_t session, const char* hostname)
 417 {
 418     int rc;
 419     unsigned int status = 0;
 420     int type;
 421
 422     rc = gnutls_certificate_verify_peers2 (session, &status);
 423     if (rc == GNUTLS_E_NO_CERTIFICATE_FOUND)
 424       {
 425           printf ("- Peer did not send any certificate.\n");
 426           return 0;
 427       }
 428
 429     if (rc < 0)
 430       {
 431           printf ("- Could not verify certificate (err: %s)\n",
 432                   gnutls_strerror (rc));
 433           return 0;
 434       }
 435
 436     type = gnutls_certificate_type_get (session);
 437     if (type == GNUTLS_CRT_X509)
 438       {
 439
 440           if (status & GNUTLS_CERT_REVOKED)
 441               printf ("- Peer's certificate chain revoked\n");
 442           if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
 443               printf ("- Peer's certificate issuer is unknown\n");
 444           if (status & GNUTLS_CERT_SIGNER_NOT_CA)
 445               printf ("- Peer's certificate issuer is not a CA\n");
 446           if (status & GNUTLS_CERT_INSECURE_ALGORITHM)
 447               printf
 448                   ("- Peer's certificate chain uses insecure algorithm\n");
 449           if (status & GNUTLS_CERT_NOT_ACTIVATED)
 450               printf
 451                   ("- Peer's certificate chain uses not yet valid certificate\n");
 452           if (status & GNUTLS_CERT_EXPIRED)
 453               printf
 454                   ("- Peer's certificate chain uses expired certificate\n");
 455           if (status & GNUTLS_CERT_INVALID)
 456               printf ("- Peer's certificate is NOT trusted\n");
 457           else
 458               printf ("- Peer's certificate is trusted\n");
 459
 460           rc = verify_x509_hostname (session, hostname);
 461           if (rc == 0) status |= GNUTLS_CERT_INVALID;
 462       }
 463     else if (type == GNUTLS_CRT_OPENPGP)
 464       {
 465           if (status & GNUTLS_CERT_INVALID)
 466               printf ("- Peer's key is invalid\n");
 467           else
 468               printf ("- Peer's key is valid\n");
 469           if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
 470               printf ("- Could not find a signer of the peer's key\n");
 471
 472           rc = verify_openpgp_hostname (session, hostname);
 473           if (rc == 0) status |= GNUTLS_CERT_INVALID;
 474       }
 475     else
 476       {
 477         fprintf(stderr, "Unknown certificate type\n");
 478         status |= GNUTLS_CERT_INVALID;
 479       }
 480
 481     if (status)
 482       return 0;
 483
 484     return 1;
 485 }
 486
 487 static void
 488 print_dh_info (gnutls_session_t session, const char *str, int print)
 489 {
 490     printf ("- %sDiffie-Hellman parameters\n", str);
 491     printf (" - Using prime: %d bits\n",
 492             gnutls_dh_get_prime_bits (session));
 493     printf (" - Secret key: %d bits\n",
 494             gnutls_dh_get_secret_bits (session));
 495     printf (" - Peer's public key: %d bits\n",
 496             gnutls_dh_get_peers_public_bits (session));
 497
 498     if (print)
 499       {
 500           int ret;
 501           gnutls_datum_t raw_gen = { NULL, 0 };
 502           gnutls_datum_t raw_prime = { NULL, 0 };
 503           gnutls_dh_params_t dh_params = NULL;
 504           unsigned char *params_data = NULL;
 505           size_t params_data_size = 0;
 506
 507           ret = gnutls_dh_get_group (session, &raw_gen, &raw_prime);
 508           if (ret)
 509             {
 510                 fprintf (stderr, "gnutls_dh_get_group %d\n", ret);
 511                 goto out;
 512             }
 513
 514           ret = gnutls_dh_params_init (&dh_params);
 515           if (ret)
 516             {
 517                 fprintf (stderr, "gnutls_dh_params_init %d\n", ret);
 518                 goto out;
 519             }
 520
 521           ret =
 522               gnutls_dh_params_import_raw (dh_params, &raw_prime,
 523                                            &raw_gen);
 524           if (ret)
 525             {
 526                 fprintf (stderr, "gnutls_dh_params_import_raw %d\n", ret);
 527                 goto out;
 528             }
 529
 530           ret = gnutls_dh_params_export_pkcs3 (dh_params,
 531                                                GNUTLS_X509_FMT_PEM,
 532                                                params_data,
 533                                                &params_data_size);
 534           if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
 535             {
 536                 fprintf (stderr, "gnutls_dh_params_export_pkcs3 %d\n",
 537                          ret);
 538                 goto out;
 539             }
 540
 541           params_data = gnutls_malloc (params_data_size);
 542           if (!params_data)
 543             {
 544                 fprintf (stderr, "gnutls_malloc %d\n", ret);
 545                 goto out;
 546             }
 547
 548           ret = gnutls_dh_params_export_pkcs3 (dh_params,
 549                                                GNUTLS_X509_FMT_PEM,
 550                                                params_data,
 551                                                &params_data_size);
 552           if (ret)
 553             {
 554                 fprintf (stderr, "gnutls_dh_params_export_pkcs3-2 %d\n",
 555                          ret);
 556                 goto out;
 557             }
 558
 559           printf (" - PKCS#3 format:\n\n%.*s\n", (int) params_data_size,
 560                   params_data);
 561
 562         out:
 563           gnutls_free (params_data);
 564           gnutls_free (raw_prime.data);
 565           gnutls_free (raw_gen.data);
 566           gnutls_dh_params_deinit (dh_params);
 567       }
 568 }
 569
 570 static void
 571 print_ecdh_info (gnutls_session_t session, const char *str)
 572 {
 573     int curve;
 574
 575     printf ("- %sEC Diffie-Hellman parameters\n", str);
 576
 577     curve = gnutls_ecc_curve_get (session);
 578
 579     printf (" - Using curve: %s\n", gnutls_ecc_curve_get_name (curve));
 580     printf (" - Curve size: %d bits\n",
 581             gnutls_ecc_curve_get_size (curve) * 8);
 582
 583 }
 584
 585 int
 586 print_info (gnutls_session_t session, int print_cert, int verbose)
 587 {
 588     const char *tmp;
 589     gnutls_credentials_type_t cred;
 590     gnutls_kx_algorithm_t kx;
 591     unsigned char session_id[33];
 592     size_t session_id_size = sizeof (session_id);
 593
 594     /* print session ID */
 595     gnutls_session_get_id (session, session_id, &session_id_size);
 596     printf ("- Session ID: %s\n",
 597             raw_to_string (session_id, session_id_size));
 598
 599     /* print the key exchange's algorithm name
 600      */
 601     kx = gnutls_kx_get (session);
 602
 603     cred = gnutls_auth_get_type (session);
 604     switch (cred)
 605       {
 606 #ifdef ENABLE_ANON
 607       case GNUTLS_CRD_ANON:
 608           if (kx == GNUTLS_KX_ANON_ECDH)
 609               print_ecdh_info (session, "Anonymous ");
 610           else
 611               print_dh_info (session, "Anonymous ", verbose);
 612           break;
 613 #endif
 614 #ifdef ENABLE_SRP
 615       case GNUTLS_CRD_SRP:
 616           /* This should be only called in server
 617            * side.
 618            */
 619           if (gnutls_srp_server_get_username (session) != NULL)
 620               printf ("- SRP authentication. Connected as '%s'\n",
 621                       gnutls_srp_server_get_username (session));
 622           break;
 623 #endif
 624 #ifdef ENABLE_PSK
 625       case GNUTLS_CRD_PSK:
 626           /* This returns NULL in server side.
 627            */
 628           if (gnutls_psk_client_get_hint (session) != NULL)
 629               printf ("- PSK authentication. PSK hint '%s'\n",
 630                       gnutls_psk_client_get_hint (session));
 631           /* This returns NULL in client side.
 632            */
 633           if (gnutls_psk_server_get_username (session) != NULL)
 634               printf ("- PSK authentication. Connected as '%s'\n",
 635                       gnutls_psk_server_get_username (session));
 636           if (kx == GNUTLS_KX_DHE_PSK)
 637               print_dh_info (session, "Ephemeral ", verbose);
 638           if (kx == GNUTLS_KX_ECDHE_PSK)
 639               print_ecdh_info (session, "Ephemeral ");
 640           break;
 641 #endif
 642       case GNUTLS_CRD_IA:
 643           printf ("- TLS/IA authentication\n");
 644           break;
 645       case GNUTLS_CRD_CERTIFICATE:
 646           {
 647               char dns[256];
 648               size_t dns_size = sizeof (dns);
 649               unsigned int type;
 650
 651               /* This fails in client side */
 652               if (gnutls_server_name_get
 653                   (session, dns, &dns_size, &type, 0) == 0)
 654                 {
 655                     printf ("- Given server name[%d]: %s\n", type, dns);
 656                 }
 657           }
 658
 659           print_cert_info (session, verbose, print_cert);
 660
 661           if (kx == GNUTLS_KX_DHE_RSA || kx == GNUTLS_KX_DHE_DSS)
 662               print_dh_info (session, "Ephemeral ", verbose);
 663           else if (kx == GNUTLS_KX_ECDHE_RSA
 664                    || kx == GNUTLS_KX_ECDHE_ECDSA)
 665               print_ecdh_info (session, "Ephemeral ");
 666       }
 667
 668     tmp =
 669         SU (gnutls_protocol_get_name
 670             (gnutls_protocol_get_version (session)));
 671     printf ("- Version: %s\n", tmp);
 672
 673     tmp = SU (gnutls_kx_get_name (kx));
 674     printf ("- Key Exchange: %s\n", tmp);
 675
 676     tmp = SU (gnutls_cipher_get_name (gnutls_cipher_get (session)));
 677     printf ("- Cipher: %s\n", tmp);
 678
 679     tmp = SU (gnutls_mac_get_name (gnutls_mac_get (session)));
 680     printf ("- MAC: %s\n", tmp);
 681
 682     tmp =
 683         SU (gnutls_compression_get_name
 684             (gnutls_compression_get (session)));
 685     printf ("- Compression: %s\n", tmp);
 686
 687     if (verbose)
 688       {
 689           gnutls_datum_t cb;
 690           int rc;
 691
 692           rc = gnutls_session_channel_binding (session,
 693                                                GNUTLS_CB_TLS_UNIQUE, &cb);
 694           if (rc)
 695               fprintf (stderr, "Channel binding error: %s\n",
 696                        gnutls_strerror (rc));
 697           else
 698             {
 699                 size_t i;
 700
 701                 printf ("- Channel binding 'tls-unique': ");
 702                 for (i = 0; i < cb.size; i++)
 703                     printf ("%02x", cb.data[i]);
 704                 printf ("\n");
 705             }
 706       }
 707
 708     /* Warning: Do not print anything more here. The 'Compression:'
 709        output MUST be the last non-verbose output.  This is used by
 710        Emacs starttls.el code. */
 711
 712     fflush (stdout);
 713
 714     return 0;
 715 }
 716
 717 void
 718 print_cert_info (gnutls_session_t session, int verbose, int print_cert)
 719 {
 720 int flag;
 721
 722     if (verbose) flag = GNUTLS_CRT_PRINT_FULL;
 723     else flag = GNUTLS_CRT_PRINT_COMPACT;
 724
 725     if (gnutls_certificate_client_get_request_status (session) != 0)
 726         printf ("- Server has requested a certificate.\n");
 727
 728     switch (gnutls_certificate_type_get (session))
 729       {
 730       case GNUTLS_CRT_X509:
 731           print_x509_info (session, flag, print_cert);
 732           break;
 733 #ifdef ENABLE_OPENPGP
 734       case GNUTLS_CRT_OPENPGP:
 735           print_openpgp_info (session, flag, print_cert);
 736           break;
 737 #endif
 738       default:
 739           printf ("Unknown type\n");
 740           break;
 741       }
 742 }
 743
 744 void
 745 print_cert_info_compact (gnutls_session_t session)
 746 {
 747
 748     if (gnutls_certificate_client_get_request_status (session) != 0)
 749         printf ("- Server has requested a certificate.\n");
 750
 751     switch (gnutls_certificate_type_get (session))
 752       {
 753       case GNUTLS_CRT_X509:
 754           print_x509_info_compact (session);
 755           break;
 756 #ifdef ENABLE_OPENPGP
 757       case GNUTLS_CRT_OPENPGP:
 758           print_openpgp_info_compact (session);
 759           break;
 760 #endif
 761       default:
 762           printf ("Unknown type\n");
 763           break;
 764       }
 765 }
 766
 767 void
 768 print_list (const char *priorities, int verbose)
 769 {
 770     size_t i;
 771     int ret;
 772     unsigned int idx;
 773     const char *name;
 774     const char *err;
 775     unsigned char id[2];
 776     gnutls_kx_algorithm_t kx;
 777     gnutls_cipher_algorithm_t cipher;
 778     gnutls_mac_algorithm_t mac;
 779     gnutls_protocol_t version;
 780     gnutls_priority_t pcache;
 781     const unsigned int *list;
 782
 783     if (priorities != NULL)
 784       {
 785           printf ("Cipher suites for %s\n", priorities);
 786
 787           ret = gnutls_priority_init (&pcache, priorities, &err);
 788           if (ret < 0)
 789             {
 790                 fprintf (stderr, "Syntax error at: %s\n", err);
 791                 exit (1);
 792             }
 793
 794           for (i = 0;; i++)
 795             {
 796                 ret =
 797                     gnutls_priority_get_cipher_suite_index (pcache, i,
 798                                                             &idx);
 799                 if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
 800                     break;
 801                 if (ret == GNUTLS_E_UNKNOWN_CIPHER_SUITE)
 802                     continue;
 803
 804                 name =
 805                     gnutls_cipher_suite_info (idx, id, NULL, NULL, NULL,
 806                                               &version);
 807
 808                 if (name != NULL)
 809                     printf ("%-50s\t0x%02x, 0x%02x\t%s\n",
 810                             name, (unsigned char) id[0],
 811                             (unsigned char) id[1],
 812                             gnutls_protocol_get_name (version));
 813             }
 814
 815           printf("\n");
 816           {
 817               ret = gnutls_priority_certificate_type_list (pcache, &list);
 818
 819               printf ("Certificate types: ");
 820               if (ret == 0) printf("none\n");
 821               for (i = 0; i < (unsigned)ret; i++)
 822                 {
 823                     printf ("CTYPE-%s",
 824                             gnutls_certificate_type_get_name (list[i]));
 825                     if (i+1!=(unsigned)ret)
 826                         printf (", ");
 827                     else
 828                         printf ("\n");
 829                 }
 830           }
 831
 832           {
 833               ret = gnutls_priority_protocol_list (pcache, &list);
 834
 835               printf ("Protocols: ");
 836               if (ret == 0) printf("none\n");
 837               for (i = 0; i < (unsigned)ret; i++)
 838                 {
 839                     printf ("VERS-%s", gnutls_protocol_get_name (list[i]));
 840                     if (i+1!=(unsigned)ret)
 841                         printf (", ");
 842                     else
 843                         printf ("\n");
 844                 }
 845           }
 846
 847           {
 848               ret = gnutls_priority_compression_list (pcache, &list);
 849
 850               printf ("Compression: ");
 851               if (ret == 0) printf("none\n");
 852               for (i = 0; i < (unsigned)ret; i++)
 853                 {
 854                     printf ("COMP-%s",
 855                             gnutls_compression_get_name (list[i]));
 856                     if (i+1!=(unsigned)ret)
 857                         printf (", ");
 858                     else
 859                         printf ("\n");
 860                 }
 861           }
 862
 863           {
 864               ret = gnutls_priority_ecc_curve_list (pcache, &list);
 865
 866               printf ("Elliptic curves: ");
 867               if (ret == 0) printf("none\n");
 868               for (i = 0; i < (unsigned)ret; i++)
 869                 {
 870                     printf ("CURVE-%s",
 871                             gnutls_ecc_curve_get_name (list[i]));
 872                     if (i+1!=(unsigned)ret)
 873                         printf (", ");
 874                     else
 875                         printf ("\n");
 876                 }
 877           }
 878
 879           {
 880               ret = gnutls_priority_sign_list (pcache, &list);
 881
 882               printf ("PK-signatures: ");
 883               if (ret == 0) printf("none\n");
 884               for (i = 0; i < (unsigned)ret; i++)
 885                 {
 886                     printf ("SIGN-%s",
 887                             gnutls_sign_algorithm_get_name (list[i]));
 888                     if (i+1!=(unsigned)ret)
 889                         printf (", ");
 890                     else
 891                         printf ("\n");
 892                 }
 893           }
 894
 895           return;
 896       }
 897
 898     printf ("Cipher suites:\n");
 899     for (i = 0; (name = gnutls_cipher_suite_info
 900                  (i, id, &kx, &cipher, &mac, &version)); i++)
 901       {
 902           printf ("%-50s\t0x%02x, 0x%02x\t%s\n",
 903                   name,
 904                   (unsigned char) id[0], (unsigned char) id[1],
 905                   gnutls_protocol_get_name (version));
 906           if (verbose)
 907               printf ("\tKey exchange: %s\n\tCipher: %s\n\tMAC: %s\n\n",
 908                       gnutls_kx_get_name (kx),
 909                       gnutls_cipher_get_name (cipher),
 910                       gnutls_mac_get_name (mac));
 911       }
 912
 913     printf("\n");
 914     {
 915         const gnutls_certificate_type_t *p =
 916             gnutls_certificate_type_list ();
 917
 918         printf ("Certificate types: ");
 919         for (; *p; p++)
 920           {
 921               printf ("CTYPE-%s", gnutls_certificate_type_get_name (*p));
 922               if (*(p + 1))
 923                   printf (", ");
 924               else
 925                   printf ("\n");
 926           }
 927     }
 928
 929     {
 930         const gnutls_protocol_t *p = gnutls_protocol_list ();
 931
 932         printf ("Protocols: ");
 933         for (; *p; p++)
 934           {
 935               printf ("VERS-%s", gnutls_protocol_get_name (*p));
 936               if (*(p + 1))
 937                   printf (", ");
 938               else
 939                   printf ("\n");
 940           }
 941     }
 942
 943     {
 944         const gnutls_cipher_algorithm_t *p = gnutls_cipher_list ();
 945
 946         printf ("Ciphers: ");
 947         for (; *p; p++)
 948           {
 949               printf ("%s", gnutls_cipher_get_name (*p));
 950               if (*(p + 1))
 951                   printf (", ");
 952               else
 953                   printf ("\n");
 954           }
 955     }
 956
 957     {
 958         const gnutls_mac_algorithm_t *p = gnutls_mac_list ();
 959
 960         printf ("MACs: ");
 961         for (; *p; p++)
 962           {
 963               printf ("%s", gnutls_mac_get_name (*p));
 964               if (*(p + 1))
 965                   printf (", ");
 966               else
 967                   printf ("\n");
 968           }
 969     }
 970
 971     {
 972         const gnutls_kx_algorithm_t *p = gnutls_kx_list ();
 973
 974         printf ("Key exchange algorithms: ");
 975         for (; *p; p++)
 976           {
 977               printf ("%s", gnutls_kx_get_name (*p));
 978               if (*(p + 1))
 979                   printf (", ");
 980               else
 981                   printf ("\n");
 982           }
 983     }
 984
 985     {
 986         const gnutls_compression_method_t *p = gnutls_compression_list ();
 987
 988         printf ("Compression: ");
 989         for (; *p; p++)
 990           {
 991               printf ("COMP-%s", gnutls_compression_get_name (*p));
 992               if (*(p + 1))
 993                   printf (", ");
 994               else
 995                   printf ("\n");
 996           }
 997     }
 998
 999     {
1000         const gnutls_ecc_curve_t *p = gnutls_ecc_curve_list ();
1001
1002         printf ("Elliptic curves: ");
1003         for (; *p; p++)
1004           {
1005               printf ("CURVE-%s", gnutls_ecc_curve_get_name (*p));
1006               if (*(p + 1))
1007                   printf (", ");
1008               else
1009                   printf ("\n");
1010           }
1011     }
1012
1013     {
1014         const gnutls_pk_algorithm_t *p = gnutls_pk_list ();
1015
1016         printf ("Public Key Systems: ");
1017         for (; *p; p++)
1018           {
1019               printf ("%s", gnutls_pk_algorithm_get_name (*p));
1020               if (*(p + 1))
1021                   printf (", ");
1022               else
1023                   printf ("\n");
1024           }
1025     }
1026
1027     {
1028         const gnutls_sign_algorithm_t *p = gnutls_sign_list ();
1029
1030         printf ("PK-signatures: ");
1031         for (; *p; p++)
1032           {
1033               printf ("SIGN-%s", gnutls_sign_algorithm_get_name (*p));
1034               if (*(p + 1))
1035                   printf (", ");
1036               else
1037                   printf ("\n");
1038           }
1039     }
1040 }
1041
1042 int check_command(gnutls_session_t session, const char* str)
1043 {
1044   size_t len = strnlen(str, 128);
1045   int ret;
1046
1047   fprintf (stderr, "*** Processing %zu bytes command: %s\n", len, str);
1048   if (len > 2 && str[0] == str[1] && str[0] == '*')
1049   {
1050       if (strncmp(str, "**REHANDSHAKE**", sizeof ("**REHANDSHAKE**") - 1) == 0)
1051       {
1052           fprintf (stderr, "*** Sending rehandshake request\n");
1053           gnutls_rehandshake (session);
1054           return 1;
1055       } else if (strncmp(str, "**HEARTBEAT**", sizeof ("**HEARTBEAT**") - 1) == 0) {
1056           ret = gnutls_heartbeat_ping (session, 300, 5, GNUTLS_HEARTBEAT_WAIT);
1057           if (ret < 0)
1058             {
1059               if (ret == GNUTLS_E_INVALID_REQUEST)
1060                 {
1061                   fprintf(stderr, "No heartbeat in this session\n");
1062                 }
1063               else
1064                 {
1065                   fprintf(stderr, "ping: %s\n", gnutls_strerror(ret));
1066                   exit(1);
1067                 }
1068             }
1069           return 2;
1070       }
1071   }
1072   return 0;
1073 }
1074
1075 #define MIN(x,y) ((x)<(y))?(x):(y)
1076 #define MAX_CACHE_TRIES 5
1077 int
1078 pin_callback (void *user, int attempt, const char *token_url,
1079               const char *token_label, unsigned int flags, char *pin,
1080               size_t pin_max)
1081 {
1082   const char *password;
1083   const char * desc;
1084   int len, cache = MAX_CACHE_TRIES;
1085 /* allow caching of PIN */
1086   static char *cached_url = NULL;
1087   static char cached_pin[32] = "";
1088
1089   if (flags & GNUTLS_PIN_SO)
1090     desc = "security officer";
1091   else
1092     desc = "user";
1093
1094   if (flags & GNUTLS_PIN_FINAL_TRY)
1095     {
1096       cache = 0;
1097       printf ("*** This is the final try before locking!\n");
1098     }
1099   if (flags & GNUTLS_PIN_COUNT_LOW)
1100     {
1101       cache = 0;
1102       printf ("*** Only few tries left before locking!\n");
1103     }
1104
1105   if (flags & GNUTLS_PIN_WRONG)
1106     {
1107       cache = 0;
1108       printf ("*** Wrong PIN has been provided!\n");
1109     }
1110
1111   if (cache > 0 && cached_url != NULL)
1112     {
1113       if (strcmp (cached_url, token_url) == 0)
1114         {
1115           if (strlen(pin) >= sizeof(cached_pin))
1116             {
1117               fprintf (stderr, "Too long PIN given\n");
1118               exit (1);
1119             }
1120
1121           fprintf(stderr, "Re-using cached PIN for token '%s'\n", token_label);
1122           strcpy (pin, cached_pin);
1123           cache--;
1124           return 0;
1125         }
1126     }
1127
1128   printf ("Token '%s' with URL '%s' ", token_label, token_url);
1129   printf ("requires %s PIN\n", desc);
1130
1131   password = getpass ("Enter PIN: ");
1132   if (password == NULL || password[0] == 0)
1133     {
1134       fprintf (stderr, "No password given\n");
1135       exit (1);
1136     }
1137
1138   len = MIN (pin_max, strlen (password));
1139   memcpy (pin, password, len);
1140   pin[len] = 0;
1141
1142   /* cache */
1143   strcpy (cached_pin, pin);
1144   free (cached_url);
1145   cached_url = strdup (token_url);
1146   cache = MAX_CACHE_TRIES;
1147
1148   return 0;
1149 }
1150
1151 #ifdef ENABLE_PKCS11
1152
1153 static int
1154 token_callback (void *user, const char *label, const unsigned retry)
1155 {
1156   char buf[32];
1157
1158   if (retry > 0)
1159     {
1160       fprintf (stderr, "Could not find token %s\n", label);
1161       return -1;
1162     }
1163   printf ("Please insert token '%s' in slot and press enter\n", label);
1164   fgets (buf, sizeof (buf), stdin);
1165
1166   return 0;
1167 }
1168
1169 void
1170 pkcs11_common (void)
1171 {
1172
1173   gnutls_pkcs11_set_pin_function (pin_callback, NULL);
1174   gnutls_pkcs11_set_token_function (token_callback, NULL);
1175
1176 }
1177
1178 #endif