2 * Copyright (C) 2004, 2005, 2007, 2008, 2009, 2010 Free Software
5 * Author: Simon Josefsson
7 * This file is part of GnuTLS.
9 * GnuTLS is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * GnuTLS is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with GnuTLS; if not, write to the Free Software Foundation,
21 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
24 /* Parts copied from GnuTLS example programs. */
33 #include <sys/types.h>
34 #include <sys/socket.h>
36 #include <netinet/in.h>
37 #include <arpa/inet.h>
39 #include <gnutls/gnutls.h>
45 static void wrap_db_init (void);
46 static void wrap_db_deinit (void);
47 static int wrap_db_store (void *dbf
, gnutls_datum_t key
, gnutls_datum_t data
);
48 static gnutls_datum_t
wrap_db_fetch (void *dbf
, gnutls_datum_t key
);
49 static int wrap_db_delete (void *dbf
, gnutls_datum_t key
);
51 #define TLS_SESSION_CACHE 50
57 int enable_session_ticket_server
;
58 int enable_session_ticket_client
;
64 struct params_res resume_tests
[] = {
65 {"try to resume from db", 50, 0, 0, 1},
66 #ifdef ENABLE_SESSION_TICKET
67 {"try to resume from session ticket", 0, 1, 1, 1},
68 {"try to resume from session ticket (server only)", 0, 1, 0, 0},
69 {"try to resume from session ticket (client only)", 0, 0, 1, 0},
74 /* A very basic TLS client, with anonymous authentication.
78 #define MSG "Hello TLS"
81 tls_log_func (int level
, const char *str
)
83 fprintf (stderr
, "%s |<%d>| %s", child
? "server" : "client", level
, str
);
87 client (struct params_res
*params
)
90 gnutls_session_t session
;
91 char buffer
[MAX_BUF
+ 1];
92 gnutls_anon_client_credentials_t anoncred
;
93 /* Need to enable anonymous KX specifically. */
95 /* variables used in session resuming
98 gnutls_datum_t session_data
;
102 gnutls_global_set_log_function (tls_log_func
);
103 gnutls_global_set_log_level (2);
105 gnutls_global_init ();
107 gnutls_anon_allocate_client_credentials (&anoncred
);
109 for (t
= 0; t
< 2; t
++)
110 { /* connect 2 times to the server */
111 /* connect to the peer
115 /* Initialize TLS session
117 gnutls_init (&session
, GNUTLS_CLIENT
);
119 /* Use default priorities */
120 gnutls_priority_set_direct (session
, "NONE:+VERS-TLS-ALL:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+ANON-DH", NULL
);
122 /* put the anonymous credentials to the current session
124 gnutls_credentials_set (session
, GNUTLS_CRD_ANON
, anoncred
);
126 #ifdef ENABLE_SESSION_TICKET
127 if (params
->enable_session_ticket_client
)
128 gnutls_session_ticket_enable_client (session
);
133 /* if this is not the first time we connect */
134 gnutls_session_set_data (session
, session_data
.data
,
136 gnutls_free (session_data
.data
);
139 gnutls_transport_set_ptr (session
, (gnutls_transport_ptr_t
) sd
);
141 /* Perform the TLS handshake
143 ret
= gnutls_handshake (session
);
147 fail ("client: Handshake failed\n");
154 success ("client: Handshake was completed\n");
158 { /* the first time we connect */
159 /* get the session data size */
160 ret
= gnutls_session_get_data2 (session
, &session_data
);
162 fail ("Getting resume data failed\n");
165 { /* the second time we connect */
167 /* check if we actually resumed the previous session */
168 if (gnutls_session_is_resumed (session
) != 0)
170 if (params
->expect_resume
)
173 success ("- Previous session was resumed\n");
176 fail ("- Previous session was resumed\n");
180 if (params
->expect_resume
)
181 fail ("*** Previous session was NOT resumed\n");
186 ("*** Previous session was NOT resumed (expected)\n");
191 gnutls_record_send (session
, MSG
, strlen (MSG
));
193 ret
= gnutls_record_recv (session
, buffer
, MAX_BUF
);
197 success ("client: Peer has closed the TLS connection\n");
202 fail ("client: Error: %s\n", gnutls_strerror (ret
));
208 printf ("- Received %d bytes: ", ret
);
209 for (ii
= 0; ii
< ret
; ii
++)
211 fputc (buffer
[ii
], stdout
);
213 fputs ("\n", stdout
);
216 gnutls_bye (session
, GNUTLS_SHUT_RDWR
);
221 gnutls_deinit (session
);
225 gnutls_anon_free_client_credentials (anoncred
);
228 /* This is a sample TLS 1.0 echo server, for anonymous authentication only.
231 #define SA struct sockaddr
233 #define PORT 5556 /* listen to 5556 port */
236 /* These are global */
237 gnutls_anon_server_credentials_t anoncred
;
238 gnutls_datum_t session_ticket_key
= { NULL
, 0 };
240 static gnutls_session_t
241 initialize_tls_session (struct params_res
*params
)
243 gnutls_session_t session
;
245 gnutls_init (&session
, GNUTLS_SERVER
);
247 /* avoid calling all the priority functions, since the defaults
250 gnutls_priority_set_direct (session
, "NONE:+VERS-TLS-ALL:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+ANON-DH", NULL
);
252 gnutls_credentials_set (session
, GNUTLS_CRD_ANON
, anoncred
);
254 gnutls_dh_set_prime_bits (session
, DH_BITS
);
256 if (params
->enable_db
)
258 gnutls_db_set_retrieve_function (session
, wrap_db_fetch
);
259 gnutls_db_set_remove_function (session
, wrap_db_delete
);
260 gnutls_db_set_store_function (session
, wrap_db_store
);
261 gnutls_db_set_ptr (session
, NULL
);
263 #ifdef ENABLE_SESSION_TICKET
264 if (params
->enable_session_ticket_server
)
265 gnutls_session_ticket_enable_server (session
, &session_ticket_key
);
271 static gnutls_dh_params_t dh_params
;
274 generate_dh_params (void)
276 const gnutls_datum_t p3
= { (char *) pkcs3
, strlen (pkcs3
) };
277 /* Generate Diffie-Hellman parameters - for use with DHE
278 * kx algorithms. These should be discarded and regenerated
279 * once a day, once a week or once a month. Depending on the
280 * security requirements.
282 gnutls_dh_params_init (&dh_params
);
283 return gnutls_dh_params_import_pkcs3 (dh_params
, &p3
, GNUTLS_X509_FMT_PEM
);
286 int err
, listen_sd
, i
;
288 struct sockaddr_in sa_serv
;
289 struct sockaddr_in sa_cli
;
292 gnutls_session_t session
;
293 char buffer
[MAX_BUF
+ 1];
301 listen_sd
= socket (AF_INET
, SOCK_STREAM
, 0);
305 fail ("server: socket failed\n");
309 memset (&sa_serv
, '\0', sizeof (sa_serv
));
310 sa_serv
.sin_family
= AF_INET
;
311 sa_serv
.sin_addr
.s_addr
= INADDR_ANY
;
312 sa_serv
.sin_port
= htons (PORT
); /* Server Port number */
314 setsockopt (listen_sd
, SOL_SOCKET
, SO_REUSEADDR
, (void *) &optval
,
317 err
= bind (listen_sd
, (SA
*) & sa_serv
, sizeof (sa_serv
));
321 fail ("server: bind failed\n");
325 err
= listen (listen_sd
, 1024);
329 fail ("server: listen failed\n");
334 success ("server: ready. Listening to port '%d'.\n", PORT
);
341 success ("global stop\n");
343 gnutls_anon_free_server_credentials (anoncred
);
345 gnutls_dh_params_deinit (dh_params
);
347 gnutls_global_deinit ();
349 shutdown (listen_sd
, SHUT_RDWR
);
353 server (struct params_res
*params
)
357 /* this must be called once in the program, it is mostly for the server.
361 gnutls_global_set_log_function (tls_log_func
);
362 gnutls_global_set_log_level (2);
365 gnutls_global_init ();
366 gnutls_anon_allocate_server_credentials (&anoncred
);
369 success ("Launched, generating DH parameters...\n");
371 generate_dh_params ();
373 gnutls_anon_set_server_dh_params (anoncred
, dh_params
);
375 if (params
->enable_db
)
379 #ifdef ENABLE_SESSION_TICKET
380 if (params
->enable_session_ticket_server
)
381 gnutls_session_ticket_key_generate (&session_ticket_key
);
384 for (t
= 0; t
< 2; t
++)
386 client_len
= sizeof (sa_cli
);
388 session
= initialize_tls_session (params
);
390 sd
= accept (listen_sd
, (SA
*) & sa_cli
, &client_len
);
393 success ("server: connection from %s, port %d\n",
394 inet_ntop (AF_INET
, &sa_cli
.sin_addr
, topbuf
,
395 sizeof (topbuf
)), ntohs (sa_cli
.sin_port
));
397 gnutls_transport_set_ptr (session
, (gnutls_transport_ptr_t
) sd
);
398 ret
= gnutls_handshake (session
);
402 gnutls_deinit (session
);
403 fail ("server: Handshake has failed (%s)\n\n",
404 gnutls_strerror (ret
));
408 success ("server: Handshake was completed\n");
410 /* see the Getting peer's information example */
411 /* print_info(session); */
416 memset (buffer
, 0, MAX_BUF
+ 1);
417 ret
= gnutls_record_recv (session
, buffer
, MAX_BUF
);
422 success ("server: Peer has closed the GnuTLS connection\n");
427 fail ("server: Received corrupted data(%d). Closing...\n", ret
);
432 /* echo data back to the client
434 gnutls_record_send (session
, buffer
, strlen (buffer
));
437 /* do not wait for the peer to close the connection.
439 gnutls_bye (session
, GNUTLS_SHUT_WR
);
443 gnutls_deinit (session
);
448 if (params
->enable_db
)
453 gnutls_free (session_ticket_key
.data
);
454 session_ticket_key
.data
= NULL
;
457 success ("server: finished\n");
465 for (i
= 0; resume_tests
[i
].desc
; i
++)
468 printf ("%s\n", resume_tests
[i
].desc
);
486 server (&resume_tests
[i
]);
492 client (&resume_tests
[i
]);
493 gnutls_global_deinit ();
499 /* Functions and other stuff needed for session resuming.
500 * This is done using a very simple list which holds session ids
504 #define MAX_SESSION_ID_SIZE 32
505 #define MAX_SESSION_DATA_SIZE 512
509 unsigned char session_id
[MAX_SESSION_ID_SIZE
];
510 unsigned int session_id_size
;
512 char session_data
[MAX_SESSION_DATA_SIZE
];
513 int session_data_size
;
516 static CACHE
*cache_db
;
517 static int cache_db_ptr
= 0;
523 /* allocate cache_db */
524 cache_db
= calloc (1, TLS_SESSION_CACHE
* sizeof (CACHE
));
528 wrap_db_deinit (void)
536 wrap_db_store (void *dbf
, gnutls_datum_t key
, gnutls_datum_t data
)
539 success ("resume db storing... (%d-%d)\n", key
.size
, data
.size
);
545 for (i
= 0; i
< key
.size
; i
++)
547 printf ("%02x ", key
.data
[i
] & 0xFF);
548 if ((i
+ 1) % 16 == 0)
553 for (i
= 0; i
< data
.size
; i
++)
555 printf ("%02x ", data
.data
[i
] & 0xFF);
556 if ((i
+ 1) % 16 == 0)
562 if (cache_db
== NULL
)
565 if (key
.size
> MAX_SESSION_ID_SIZE
)
567 if (data
.size
> MAX_SESSION_DATA_SIZE
)
570 memcpy (cache_db
[cache_db_ptr
].session_id
, key
.data
, key
.size
);
571 cache_db
[cache_db_ptr
].session_id_size
= key
.size
;
573 memcpy (cache_db
[cache_db_ptr
].session_data
, data
.data
, data
.size
);
574 cache_db
[cache_db_ptr
].session_data_size
= data
.size
;
577 cache_db_ptr
%= TLS_SESSION_CACHE
;
582 static gnutls_datum_t
583 wrap_db_fetch (void *dbf
, gnutls_datum_t key
)
585 gnutls_datum_t res
= { NULL
, 0 };
589 success ("resume db fetch... (%d)\n", key
.size
);
594 for (i
= 0; i
< key
.size
; i
++)
596 printf ("%02x ", key
.data
[i
] & 0xFF);
597 if ((i
+ 1) % 16 == 0)
603 if (cache_db
== NULL
)
606 for (i
= 0; i
< TLS_SESSION_CACHE
; i
++)
608 if (key
.size
== cache_db
[i
].session_id_size
&&
609 memcmp (key
.data
, cache_db
[i
].session_id
, key
.size
) == 0)
612 success ("resume db fetch... return info\n");
614 res
.size
= cache_db
[i
].session_data_size
;
616 res
.data
= gnutls_malloc (res
.size
);
617 if (res
.data
== NULL
)
620 memcpy (res
.data
, cache_db
[i
].session_data
, res
.size
);
626 for (i
= 0; i
< res
.size
; i
++)
628 printf ("%02x ", res
.data
[i
] & 0xFF);
629 if ((i
+ 1) % 16 == 0)
642 wrap_db_delete (void *dbf
, gnutls_datum_t key
)
646 if (cache_db
== NULL
)
649 for (i
= 0; i
< TLS_SESSION_CACHE
; i
++)
651 if (key
.size
== cache_db
[i
].session_id_size
&&
652 memcmp (key
.data
, cache_db
[i
].session_id
, key
.size
) == 0)
655 cache_db
[i
].session_id_size
= 0;
656 cache_db
[i
].session_data_size
= 0;