doc/examples/ex-serv-psk.c

   1 /* This example code is placed in the public domain. */
   2
   3 #ifdef HAVE_CONFIG_H
   4 #include <config.h>
   5 #endif
   6
   7 #include <stdio.h>
   8 #include <stdlib.h>
   9 #include <errno.h>
  10 #include <sys/types.h>
  11 #include <sys/socket.h>
  12 #include <arpa/inet.h>
  13 #include <netinet/in.h>
  14 #include <string.h>
  15 #include <unistd.h>
  16 #include <gnutls/gnutls.h>
  17
  18 #define KEYFILE "key.pem"
  19 #define CERTFILE "cert.pem"
  20 #define CAFILE "ca.pem"
  21 #define CRLFILE "crl.pem"
  22
  23 /* This is a sample TLS echo server, supporting X.509 and PSK
  24    authentication.
  25  */
  26
  27
  28 #define SA struct sockaddr
  29 #define SOCKET_ERR(err,s) if(err==-1) {perror(s);return(1);}
  30 #define MAX_BUF 1024
  31 #define PORT 5556               /* listen to 5556 port */
  32 #define DH_BITS 1024
  33
  34 /* These are global */
  35 gnutls_certificate_credentials_t x509_cred;
  36 gnutls_psk_server_credentials_t psk_cred;
  37 gnutls_priority_t priority_cache;
  38
  39 static gnutls_session_t
  40 initialize_tls_session (void)
  41 {
  42   gnutls_session_t session;
  43
  44   gnutls_init (&session, GNUTLS_SERVER);
  45
  46   gnutls_priority_set (session, priority_cache);
  47
  48   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);
  49   gnutls_credentials_set (session, GNUTLS_CRD_PSK, psk_cred);
  50
  51   /* request client certificate if any.
  52    */
  53   gnutls_certificate_server_set_request (session, GNUTLS_CERT_REQUEST);
  54
  55   return session;
  56 }
  57
  58 static gnutls_dh_params_t dh_params;
  59
  60 static int
  61 generate_dh_params (void)
  62 {
  63
  64   /* Generate Diffie-Hellman parameters - for use with DHE
  65    * kx algorithms. When short bit length is used, it might
  66    * be wise to regenerate parameters.
  67    *
  68    * Check the ex-serv-export.c example for using static
  69    * parameters.
  70    */
  71   gnutls_dh_params_init (&dh_params);
  72   gnutls_dh_params_generate2 (dh_params, DH_BITS);
  73
  74   return 0;
  75 }
  76
  77 static int
  78 pskfunc (gnutls_session_t session, const char *username, gnutls_datum_t * key)
  79 {
  80   printf ("psk: username %s\n", username);
  81   key->data = gnutls_malloc (4);
  82   key->data[0] = 0xDE;
  83   key->data[1] = 0xAD;
  84   key->data[2] = 0xBE;
  85   key->data[3] = 0xEF;
  86   key->size = 4;
  87   return 0;
  88 }
  89
  90 int
  91 main (void)
  92 {
  93   int err, listen_sd;
  94   int sd, ret;
  95   struct sockaddr_in sa_serv;
  96   struct sockaddr_in sa_cli;
  97   int client_len;
  98   char topbuf[512];
  99   gnutls_session_t session;
 100   char buffer[MAX_BUF + 1];
 101   int optval = 1;
 102
 103   /* this must be called once in the program
 104    */
 105   gnutls_global_init ();
 106
 107   gnutls_certificate_allocate_credentials (&x509_cred);
 108   gnutls_certificate_set_x509_trust_file (x509_cred, CAFILE,
 109                                           GNUTLS_X509_FMT_PEM);
 110
 111   gnutls_certificate_set_x509_crl_file (x509_cred, CRLFILE,
 112                                         GNUTLS_X509_FMT_PEM);
 113
 114   gnutls_certificate_set_x509_key_file (x509_cred, CERTFILE, KEYFILE,
 115                                         GNUTLS_X509_FMT_PEM);
 116
 117   gnutls_psk_allocate_server_credentials (&psk_cred);
 118   gnutls_psk_set_server_credentials_function (psk_cred, pskfunc);
 119
 120   generate_dh_params ();
 121
 122   gnutls_priority_init (&priority_cache, "NORMAL:PSK", NULL);
 123
 124
 125   gnutls_certificate_set_dh_params (x509_cred, dh_params);
 126
 127   /* Socket operations
 128    */
 129   listen_sd = socket (AF_INET, SOCK_STREAM, 0);
 130   SOCKET_ERR (listen_sd, "socket");
 131
 132   memset (&sa_serv, '\0', sizeof (sa_serv));
 133   sa_serv.sin_family = AF_INET;
 134   sa_serv.sin_addr.s_addr = INADDR_ANY;
 135   sa_serv.sin_port = htons (PORT);      /* Server Port number */
 136
 137   setsockopt (listen_sd, SOL_SOCKET, SO_REUSEADDR, (void *) &optval,
 138               sizeof (int));
 139
 140   err = bind (listen_sd, (SA *) & sa_serv, sizeof (sa_serv));
 141   SOCKET_ERR (err, "bind");
 142   err = listen (listen_sd, 1024);
 143   SOCKET_ERR (err, "listen");
 144
 145   printf ("Server ready. Listening to port '%d'.\n\n", PORT);
 146
 147   client_len = sizeof (sa_cli);
 148   for (;;)
 149     {
 150       session = initialize_tls_session ();
 151
 152       sd = accept (listen_sd, (SA *) & sa_cli, &client_len);
 153
 154       printf ("- connection from %s, port %d\n",
 155               inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
 156                          sizeof (topbuf)), ntohs (sa_cli.sin_port));
 157
 158       gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
 159       ret = gnutls_handshake (session);
 160       if (ret < 0)
 161         {
 162           close (sd);
 163           gnutls_deinit (session);
 164           fprintf (stderr, "*** Handshake has failed (%s)\n\n",
 165                    gnutls_strerror (ret));
 166           continue;
 167         }
 168       printf ("- Handshake was completed\n");
 169
 170       /* see the Getting peer's information example */
 171       /* print_info(session); */
 172
 173       for (;;)
 174         {
 175           memset (buffer, 0, MAX_BUF + 1);
 176           ret = gnutls_record_recv (session, buffer, MAX_BUF);
 177
 178           if (ret == 0)
 179             {
 180               printf ("\n- Peer has closed the GnuTLS connection\n");
 181               break;
 182             }
 183           else if (ret < 0)
 184             {
 185               fprintf (stderr, "\n*** Received corrupted "
 186                        "data(%d). Closing the connection.\n\n", ret);
 187               break;
 188             }
 189           else if (ret > 0)
 190             {
 191               /* echo data back to the client
 192                */
 193               gnutls_record_send (session, buffer, strlen (buffer));
 194             }
 195         }
 196       printf ("\n");
 197       /* do not wait for the peer to close the connection.
 198        */
 199       gnutls_bye (session, GNUTLS_SHUT_WR);
 200
 201       close (sd);
 202       gnutls_deinit (session);
 203
 204     }
 205   close (listen_sd);
 206
 207   gnutls_certificate_free_credentials (x509_cred);
 208   gnutls_psk_free_server_credentials (psk_cred);
 209
 210   gnutls_priority_deinit (priority_cache);
 211
 212   gnutls_global_deinit ();
 213
 214   return 0;
 215
 216 }