2 * Copyright (C) 2004, 2005, 2007, 2008, 2009, 2010 Free Software
5 * Author: Simon Josefsson
7 * This file is part of GNUTLS.
9 * GNUTLS is free software; you can redistribute it and/or modify it
10 * under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * GNUTLS is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with GNUTLS; if not, write to the Free Software Foundation,
21 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
24 /* Parts copied from GnuTLS example programs. */
33 #include <sys/types.h>
34 #include <sys/socket.h>
36 #include <netinet/in.h>
37 #include <arpa/inet.h>
39 #include <gnutls/gnutls.h>
45 static void wrap_db_init (void);
46 static void wrap_db_deinit (void);
47 static int wrap_db_store (void *dbf
, gnutls_datum_t key
, gnutls_datum_t data
);
48 static gnutls_datum_t
wrap_db_fetch (void *dbf
, gnutls_datum_t key
);
49 static int wrap_db_delete (void *dbf
, gnutls_datum_t key
);
51 #define TLS_SESSION_CACHE 50
57 int enable_session_ticket_server
;
58 int enable_session_ticket_client
;
64 struct params_res resume_tests
[] = {
65 {"try to resume from db", 50, 0, 0, 1},
66 #ifdef ENABLE_SESSION_TICKET
67 {"try to resume from session ticket", 0, 1, 1, 1},
68 {"try to resume from session ticket (server only)", 0, 1, 0, 0},
69 {"try to resume from session ticket (client only)", 0, 0, 1, 0},
74 /* A very basic TLS client, with anonymous authentication.
78 #define MSG "Hello TLS"
81 tls_log_func (int level
, const char *str
)
83 fprintf (stderr
, "%s |<%d>| %s", child
? "server" : "client", level
, str
);
87 client (struct params_res
*params
)
90 gnutls_session_t session
;
91 char buffer
[MAX_BUF
+ 1];
92 gnutls_anon_client_credentials_t anoncred
;
93 /* Need to enable anonymous KX specifically. */
94 const int kx_prio
[] = { GNUTLS_KX_ANON_DH
, 0 };
96 /* variables used in session resuming
99 gnutls_datum_t session_data
;
103 gnutls_global_set_log_function (tls_log_func
);
104 gnutls_global_set_log_level (2);
106 gnutls_global_init ();
108 gnutls_anon_allocate_client_credentials (&anoncred
);
110 for (t
= 0; t
< 2; t
++)
111 { /* connect 2 times to the server */
113 /* connect to the peer
117 /* Initialize TLS session
119 gnutls_init (&session
, GNUTLS_CLIENT
);
121 /* Use default priorities */
122 gnutls_set_default_priority (session
);
123 gnutls_kx_set_priority (session
, kx_prio
);
125 /* put the anonymous credentials to the current session
127 gnutls_credentials_set (session
, GNUTLS_CRD_ANON
, anoncred
);
129 #ifdef ENABLE_SESSION_TICKET
130 if (params
->enable_session_ticket_client
)
131 gnutls_session_ticket_enable_client (session
);
136 /* if this is not the first time we connect */
137 gnutls_session_set_data (session
, session_data
.data
,
139 gnutls_free (session_data
.data
);
142 gnutls_transport_set_ptr (session
, (gnutls_transport_ptr_t
) sd
);
144 /* Perform the TLS handshake
146 ret
= gnutls_handshake (session
);
150 fail ("client: Handshake failed\n");
156 success ("client: Handshake was completed\n");
160 { /* the first time we connect */
161 /* get the session data size */
162 ret
= gnutls_session_get_data2 (session
, &session_data
);
164 fail ("Getting resume data failed\n");
167 { /* the second time we connect */
169 /* check if we actually resumed the previous session */
170 if (gnutls_session_is_resumed (session
) != 0)
172 if (params
->expect_resume
)
173 success ("- Previous session was resumed\n");
175 fail ("- Previous session was resumed\n");
179 if (params
->expect_resume
)
180 fail ("*** Previous session was NOT resumed\n");
182 success ("*** Previous session was NOT resumed (expected)\n");
186 gnutls_record_send (session
, MSG
, strlen (MSG
));
188 ret
= gnutls_record_recv (session
, buffer
, MAX_BUF
);
191 success ("client: Peer has closed the TLS connection\n");
196 fail ("client: Error: %s\n", gnutls_strerror (ret
));
202 printf ("- Received %d bytes: ", ret
);
203 for (ii
= 0; ii
< ret
; ii
++)
205 fputc (buffer
[ii
], stdout
);
207 fputs ("\n", stdout
);
210 gnutls_bye (session
, GNUTLS_SHUT_RDWR
);
216 gnutls_deinit (session
);
219 gnutls_anon_free_client_credentials (anoncred
);
222 /* This is a sample TLS 1.0 echo server, for anonymous authentication only.
225 #define SA struct sockaddr
227 #define PORT 5556 /* listen to 5556 port */
230 /* These are global */
231 gnutls_anon_server_credentials_t anoncred
;
232 gnutls_datum_t session_ticket_key
= { NULL
, 0 };
234 static gnutls_session_t
235 initialize_tls_session (struct params_res
*params
)
237 gnutls_session_t session
;
238 const int kx_prio
[] = { GNUTLS_KX_ANON_DH
, 0 };
240 gnutls_init (&session
, GNUTLS_SERVER
);
242 /* avoid calling all the priority functions, since the defaults
245 gnutls_set_default_priority (session
);
246 gnutls_kx_set_priority (session
, kx_prio
);
248 gnutls_credentials_set (session
, GNUTLS_CRD_ANON
, anoncred
);
250 gnutls_dh_set_prime_bits (session
, DH_BITS
);
252 if (params
->enable_db
)
254 gnutls_db_set_retrieve_function (session
, wrap_db_fetch
);
255 gnutls_db_set_remove_function (session
, wrap_db_delete
);
256 gnutls_db_set_store_function (session
, wrap_db_store
);
257 gnutls_db_set_ptr (session
, NULL
);
259 #ifdef ENABLE_SESSION_TICKET
260 if (params
->enable_session_ticket_server
)
261 gnutls_session_ticket_enable_server (session
, &session_ticket_key
);
267 static gnutls_dh_params_t dh_params
;
270 generate_dh_params (void)
272 const gnutls_datum_t p3
= { (char *) pkcs3
, strlen (pkcs3
) };
273 /* Generate Diffie-Hellman parameters - for use with DHE
274 * kx algorithms. These should be discarded and regenerated
275 * once a day, once a week or once a month. Depending on the
276 * security requirements.
278 gnutls_dh_params_init (&dh_params
);
279 return gnutls_dh_params_import_pkcs3 (dh_params
, &p3
, GNUTLS_X509_FMT_PEM
);
282 int err
, listen_sd
, i
;
284 struct sockaddr_in sa_serv
;
285 struct sockaddr_in sa_cli
;
288 gnutls_session_t session
;
289 char buffer
[MAX_BUF
+ 1];
297 listen_sd
= socket (AF_INET
, SOCK_STREAM
, 0);
301 fail ("server: socket failed\n");
305 memset (&sa_serv
, '\0', sizeof (sa_serv
));
306 sa_serv
.sin_family
= AF_INET
;
307 sa_serv
.sin_addr
.s_addr
= INADDR_ANY
;
308 sa_serv
.sin_port
= htons (PORT
); /* Server Port number */
310 setsockopt (listen_sd
, SOL_SOCKET
, SO_REUSEADDR
, (void *) &optval
,
313 err
= bind (listen_sd
, (SA
*) & sa_serv
, sizeof (sa_serv
));
317 fail ("server: bind failed\n");
321 err
= listen (listen_sd
, 1024);
325 fail ("server: listen failed\n");
329 success ("server: ready. Listening to port '%d'.\n", PORT
);
335 success ("global stop\n");
337 gnutls_anon_free_server_credentials (anoncred
);
339 gnutls_dh_params_deinit (dh_params
);
341 gnutls_global_deinit ();
343 shutdown (listen_sd
, SHUT_RDWR
);
347 server (struct params_res
*params
)
351 /* this must be called once in the program, it is mostly for the server.
355 gnutls_global_set_log_function (tls_log_func
);
356 gnutls_global_set_log_level (2);
359 gnutls_global_init ();
360 gnutls_anon_allocate_server_credentials (&anoncred
);
362 success ("Launched, generating DH parameters...\n");
364 generate_dh_params ();
366 gnutls_anon_set_server_dh_params (anoncred
, dh_params
);
368 if (params
->enable_db
)
372 #ifdef ENABLE_SESSION_TICKET
373 if (params
->enable_session_ticket_server
)
374 gnutls_session_ticket_key_generate (&session_ticket_key
);
377 for (t
= 0; t
< 2; t
++)
379 client_len
= sizeof (sa_cli
);
381 session
= initialize_tls_session (params
);
383 sd
= accept (listen_sd
, (SA
*) & sa_cli
, &client_len
);
385 success ("server: connection from %s, port %d\n",
386 inet_ntop (AF_INET
, &sa_cli
.sin_addr
, topbuf
,
387 sizeof (topbuf
)), ntohs (sa_cli
.sin_port
));
389 gnutls_transport_set_ptr (session
, (gnutls_transport_ptr_t
) sd
);
390 ret
= gnutls_handshake (session
);
394 gnutls_deinit (session
);
395 fail ("server: Handshake has failed (%s)\n\n",
396 gnutls_strerror (ret
));
399 success ("server: Handshake was completed\n");
401 /* see the Getting peer's information example */
402 /* print_info(session); */
407 memset (buffer
, 0, MAX_BUF
+ 1);
408 ret
= gnutls_record_recv (session
, buffer
, MAX_BUF
);
412 success ("server: Peer has closed the GNUTLS connection\n");
417 fail ("server: Received corrupted data(%d). Closing...\n", ret
);
422 /* echo data back to the client
424 gnutls_record_send (session
, buffer
, strlen (buffer
));
427 /* do not wait for the peer to close the connection.
429 gnutls_bye (session
, GNUTLS_SHUT_WR
);
433 gnutls_deinit (session
);
438 if (params
->enable_db
)
443 gnutls_free (session_ticket_key
.data
);
444 session_ticket_key
.data
= NULL
;
446 success ("server: finished\n");
454 for (i
= 0; resume_tests
[i
].desc
; i
++)
456 printf ("%s\n", resume_tests
[i
].desc
);
474 server (&resume_tests
[i
]);
480 client (&resume_tests
[i
]);
481 gnutls_global_deinit ();
487 /* Functions and other stuff needed for session resuming.
488 * This is done using a very simple list which holds session ids
492 #define MAX_SESSION_ID_SIZE 32
493 #define MAX_SESSION_DATA_SIZE 512
497 unsigned char session_id
[MAX_SESSION_ID_SIZE
];
498 unsigned int session_id_size
;
500 char session_data
[MAX_SESSION_DATA_SIZE
];
501 int session_data_size
;
504 static CACHE
*cache_db
;
505 static int cache_db_ptr
= 0;
511 /* allocate cache_db */
512 cache_db
= calloc (1, TLS_SESSION_CACHE
* sizeof (CACHE
));
516 wrap_db_deinit (void)
524 wrap_db_store (void *dbf
, gnutls_datum_t key
, gnutls_datum_t data
)
526 success ("resume db storing... (%d-%d)\n", key
.size
, data
.size
);
532 for (i
= 0; i
< key
.size
; i
++)
534 printf ("%02x ", key
.data
[i
] & 0xFF);
535 if ((i
+ 1) % 16 == 0)
540 for (i
= 0; i
< data
.size
; i
++)
542 printf ("%02x ", data
.data
[i
] & 0xFF);
543 if ((i
+ 1) % 16 == 0)
549 if (cache_db
== NULL
)
552 if (key
.size
> MAX_SESSION_ID_SIZE
)
554 if (data
.size
> MAX_SESSION_DATA_SIZE
)
557 memcpy (cache_db
[cache_db_ptr
].session_id
, key
.data
, key
.size
);
558 cache_db
[cache_db_ptr
].session_id_size
= key
.size
;
560 memcpy (cache_db
[cache_db_ptr
].session_data
, data
.data
, data
.size
);
561 cache_db
[cache_db_ptr
].session_data_size
= data
.size
;
564 cache_db_ptr
%= TLS_SESSION_CACHE
;
569 static gnutls_datum_t
570 wrap_db_fetch (void *dbf
, gnutls_datum_t key
)
572 gnutls_datum_t res
= { NULL
, 0 };
575 success ("resume db fetch... (%d)\n", key
.size
);
580 for (i
= 0; i
< key
.size
; i
++)
582 printf ("%02x ", key
.data
[i
] & 0xFF);
583 if ((i
+ 1) % 16 == 0)
589 if (cache_db
== NULL
)
592 for (i
= 0; i
< TLS_SESSION_CACHE
; i
++)
594 if (key
.size
== cache_db
[i
].session_id_size
&&
595 memcmp (key
.data
, cache_db
[i
].session_id
, key
.size
) == 0)
597 success ("resume db fetch... return info\n");
599 res
.size
= cache_db
[i
].session_data_size
;
601 res
.data
= gnutls_malloc (res
.size
);
602 if (res
.data
== NULL
)
605 memcpy (res
.data
, cache_db
[i
].session_data
, res
.size
);
611 for (i
= 0; i
< res
.size
; i
++)
613 printf ("%02x ", res
.data
[i
] & 0xFF);
614 if ((i
+ 1) % 16 == 0)
627 wrap_db_delete (void *dbf
, gnutls_datum_t key
)
631 if (cache_db
== NULL
)
634 for (i
= 0; i
< TLS_SESSION_CACHE
; i
++)
636 if (key
.size
== cache_db
[i
].session_id_size
&&
637 memcmp (key
.data
, cache_db
[i
].session_id
, key
.size
) == 0)
640 cache_db
[i
].session_id_size
= 0;
641 cache_db
[i
].session_data_size
= 0;