tests/tlsia.c

   1 /*
   2  * Copyright (C) 2004, 2005, 2007, 2008, 2009, 2010 Free Software
   3  * Foundation, Inc.
   4  *
   5  * Author: Simon Josefsson
   6  *
   7  * This file is part of GNUTLS.
   8  *
   9  * GNUTLS is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 3 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * GNUTLS is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with GNUTLS; if not, write to the Free Software Foundation,
  21  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  22  */
  23
  24 /* Parts copied from GnuTLS example programs. */
  25
  26 #ifdef HAVE_CONFIG_H
  27 # include <config.h>
  28 #endif
  29
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <string.h>
  33 #include <sys/types.h>
  34 #include <sys/socket.h>
  35 #include <sys/wait.h>
  36 #include <netinet/in.h>
  37 #include <arpa/inet.h>
  38 #include <unistd.h>
  39 #include <gnutls/gnutls.h>
  40 #include <gnutls/extra.h>
  41
  42 #include "utils.h"
  43
  44 #include "tcp.c"
  45
  46 #include <readline.h>
  47
  48 /* A very basic TLS client, with anonymous authentication.
  49  */
  50
  51 #define MAX_BUF 1024
  52 #define MSG "Hello TLS"
  53
  54 static int
  55 client_avp (gnutls_session_t session, void *ptr,
  56             const char *last, size_t lastlen, char **new, size_t * newlen)
  57 {
  58   static int iter = 0;
  59   const char *p;
  60
  61   if (last)
  62     printf ("client: received %d bytes AVP: `%.*s'\n",
  63             (int)lastlen, (int) lastlen, last);
  64   else
  65     printf ("client: new application phase\n");
  66
  67   switch (iter)
  68     {
  69     case 0:
  70       p = "client's first AVP, next will be empty";
  71       break;
  72
  73     case 1:
  74       p = "";
  75       break;
  76
  77     case 2:
  78       p = "client avp";
  79       break;
  80
  81     default:
  82       p = "final client AVP, we'll restart next";
  83       iter = -1;
  84       break;
  85     }
  86
  87   iter++;
  88
  89   if (debug)
  90     p = readline ("Client TLS/IA AVP: ");
  91
  92   *new = gnutls_strdup (p);
  93   if (!*new)
  94     return -1;
  95   *newlen = strlen (*new);
  96
  97   printf ("client: sending %d bytes AVP: `%s'\n", (int)*newlen, *new);
  98
  99   gnutls_ia_permute_inner_secret (session, 3, "foo");
 100
 101   return 0;
 102 }
 103
 104 static void
 105 client (void)
 106 {
 107   int ret, sd, ii;
 108   gnutls_session_t session;
 109   char buffer[MAX_BUF + 1];
 110   gnutls_anon_client_credentials_t anoncred;
 111   gnutls_ia_client_credentials_t iacred;
 112   /* Need to enable anonymous KX specifically. */
 113   const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
 114
 115   ret = gnutls_global_init ();
 116   if (ret)
 117     fail ("global_init: %d\n", ret);
 118   ret = gnutls_global_init_extra ();
 119   if (ret)
 120     fail ("global_init_extra: %d\n", ret);
 121
 122   gnutls_anon_allocate_client_credentials (&anoncred);
 123   gnutls_ia_allocate_client_credentials (&iacred);
 124
 125   /* Initialize TLS session
 126    */
 127   gnutls_init (&session, GNUTLS_CLIENT);
 128
 129   /* Use default priorities */
 130   gnutls_set_default_priority (session);
 131   gnutls_kx_set_priority (session, kx_prio);
 132
 133   /* put the anonymous credentials to the current session
 134    */
 135   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
 136   gnutls_credentials_set (session, GNUTLS_CRD_IA, iacred);
 137
 138   /* connect to the peer
 139    */
 140   sd = tcp_connect ();
 141
 142   gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
 143
 144   /* Enable TLS/IA. */
 145   gnutls_ia_set_client_avp_function (iacred, client_avp);
 146
 147   /* Perform the TLS handshake
 148    */
 149   ret = gnutls_handshake (session);
 150
 151   if (ret < 0)
 152     {
 153       fail ("client: Handshake failed\n");
 154       gnutls_perror (ret);
 155       goto end;
 156     }
 157   else
 158     {
 159       success ("client: Handshake was completed\n");
 160     }
 161
 162   /*
 163      To test TLS/IA alert's (the server will print that a fatal alert
 164      was received):
 165      gnutls_alert_send(session, GNUTLS_AL_FATAL,
 166      GNUTLS_A_INNER_APPLICATION_FAILURE);
 167    */
 168
 169   if (!gnutls_ia_handshake_p (session))
 170     fail ("client: No TLS/IA negotiation\n");
 171   else
 172     {
 173       success ("client: TLS/IA handshake\n");
 174
 175       ret = gnutls_ia_handshake (session);
 176
 177       if (ret < 0)
 178         {
 179           fail ("client: TLS/IA handshake failed\n");
 180           gnutls_perror (ret);
 181           goto end;
 182         }
 183       else
 184         {
 185           success ("client: TLS/IA Handshake was completed\n");
 186         }
 187     }
 188
 189   gnutls_record_send (session, MSG, strlen (MSG));
 190
 191   ret = gnutls_record_recv (session, buffer, MAX_BUF);
 192   if (ret == 0)
 193     {
 194       success ("client: Peer has closed the TLS connection\n");
 195       goto end;
 196     }
 197   else if (ret < 0)
 198     {
 199       fail ("client: Error: %s\n", gnutls_strerror (ret));
 200       goto end;
 201     }
 202
 203   if (debug)
 204     {
 205       printf ("- Received %d bytes: ", ret);
 206       for (ii = 0; ii < ret; ii++)
 207         {
 208           fputc (buffer[ii], stdout);
 209         }
 210       fputs ("\n", stdout);
 211     }
 212
 213   gnutls_bye (session, GNUTLS_SHUT_RDWR);
 214
 215 end:
 216
 217   tcp_close (sd);
 218
 219   gnutls_deinit (session);
 220
 221   gnutls_ia_free_client_credentials (iacred);
 222
 223   gnutls_anon_free_client_credentials (anoncred);
 224
 225   gnutls_global_deinit ();
 226 }
 227
 228 /* This is a sample TLS 1.0 echo server, for anonymous authentication only.
 229  */
 230
 231 #define SA struct sockaddr
 232 #define MAX_BUF 1024
 233 #define PORT 5556               /* listen to 5556 port */
 234 #define DH_BITS 1024
 235
 236 /* These are global */
 237 gnutls_anon_server_credentials_t anoncred;
 238 gnutls_ia_server_credentials_t iacred;
 239
 240 static gnutls_session_t
 241 initialize_tls_session (void)
 242 {
 243   gnutls_session_t session;
 244   const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
 245
 246   gnutls_init (&session, GNUTLS_SERVER);
 247
 248   /* avoid calling all the priority functions, since the defaults
 249    * are adequate.
 250    */
 251   gnutls_set_default_priority (session);
 252   gnutls_kx_set_priority (session, kx_prio);
 253
 254   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
 255
 256   gnutls_dh_set_prime_bits (session, DH_BITS);
 257
 258   return session;
 259 }
 260
 261 static gnutls_dh_params_t dh_params;
 262
 263 static int
 264 generate_dh_params (void)
 265 {
 266   const gnutls_datum_t p3 = { (char *) pkcs3, strlen (pkcs3) };
 267   /* Generate Diffie-Hellman parameters - for use with DHE
 268    * kx algorithms. These should be discarded and regenerated
 269    * once a day, once a week or once a month. Depending on the
 270    * security requirements.
 271    */
 272   gnutls_dh_params_init (&dh_params);
 273   return gnutls_dh_params_import_pkcs3 (dh_params, &p3, GNUTLS_X509_FMT_PEM);
 274 }
 275
 276 int err, listen_sd, i;
 277 int sd, ret;
 278 struct sockaddr_in sa_serv;
 279 struct sockaddr_in sa_cli;
 280 socklen_t client_len;
 281 char topbuf[512];
 282 gnutls_session_t session;
 283 char buffer[MAX_BUF + 1];
 284 int optval = 1;
 285
 286 static int
 287 server_avp (gnutls_session_t session, void *ptr,
 288             const char *last, size_t lastlen, char **new, size_t * newlen)
 289 {
 290   static int iter = 0;
 291   const char *p;
 292
 293   if (last)
 294     printf ("server: received %d bytes AVP: `%.*s'\n",
 295             (int)lastlen, (int) lastlen, last);
 296
 297   gnutls_ia_permute_inner_secret (session, 3, "foo");
 298
 299   switch (iter)
 300     {
 301     case 0:
 302       p = "first server AVP";
 303       break;
 304
 305     case 1:
 306       p = "second server AVP, next will be empty, then a intermediate finish";
 307       break;
 308
 309     case 2:
 310       p = "";
 311       break;
 312
 313     case 3:
 314       p = "1";
 315       break;
 316
 317     case 4:
 318       p = "server avp, after intermediate finish, next another intermediate";
 319       break;
 320
 321     case 5:
 322       p = "1";
 323       break;
 324
 325     case 6:
 326       p = "server avp, next will be the finish phase";
 327       break;
 328
 329     default:
 330       p = "2";
 331       break;
 332     }
 333
 334   iter++;
 335
 336   if (debug)
 337     p = readline ("Server TLS/IA AVP (type '1' to sync, '2' to finish): ");
 338
 339   if (!p)
 340     return -1;
 341
 342   if (strcmp (p, "1") == 0)
 343     {
 344       success ("server: Sending IntermediatePhaseFinished...\n");
 345       return 1;
 346     }
 347
 348   if (strcmp (p, "2") == 0)
 349     {
 350       success ("server: Sending FinalPhaseFinished...\n");
 351       return 2;
 352     }
 353
 354   *new = gnutls_strdup (p);
 355   if (!*new)
 356     return -1;
 357   *newlen = strlen (*new);
 358
 359   printf ("server: sending %d bytes AVP: `%s'\n", (int)*newlen, *new);
 360
 361   return 0;
 362 }
 363
 364 static void
 365 server_start (void)
 366 {
 367   /* Socket operations
 368    */
 369   listen_sd = socket (AF_INET, SOCK_STREAM, 0);
 370   if (err == -1)
 371     {
 372       perror ("socket");
 373       fail ("server: socket failed\n");
 374       return;
 375     }
 376
 377   memset (&sa_serv, '\0', sizeof (sa_serv));
 378   sa_serv.sin_family = AF_INET;
 379   sa_serv.sin_addr.s_addr = INADDR_ANY;
 380   sa_serv.sin_port = htons (PORT);      /* Server Port number */
 381
 382   setsockopt (listen_sd, SOL_SOCKET, SO_REUSEADDR, (void *) &optval,
 383               sizeof (int));
 384
 385   err = bind (listen_sd, (SA *) & sa_serv, sizeof (sa_serv));
 386   if (err == -1)
 387     {
 388       perror ("bind");
 389       fail ("server: bind failed\n");
 390       return;
 391     }
 392
 393   err = listen (listen_sd, 1024);
 394   if (err == -1)
 395     {
 396       perror ("listen");
 397       fail ("server: listen failed\n");
 398       return;
 399     }
 400
 401   success ("server: ready. Listening to port '%d'\n", PORT);
 402 }
 403
 404 static void
 405 server (void)
 406 {
 407   /* this must be called once in the program
 408    */
 409   ret = gnutls_global_init ();
 410   if (ret)
 411     fail ("global_init: %d\n", ret);
 412   ret = gnutls_global_init_extra ();
 413   if (ret)
 414     fail ("global_init_extra: %d\n", ret);
 415
 416   gnutls_anon_allocate_server_credentials (&anoncred);
 417   gnutls_ia_allocate_server_credentials (&iacred);
 418
 419   success ("Launched, generating DH parameters...\n");
 420
 421   generate_dh_params ();
 422
 423   gnutls_anon_set_server_dh_params (anoncred, dh_params);
 424
 425   client_len = sizeof (sa_cli);
 426
 427   session = initialize_tls_session ();
 428
 429   sd = accept (listen_sd, (SA *) & sa_cli, &client_len);
 430
 431   success ("server: connection from %s, port %d\n",
 432            inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
 433                       sizeof (topbuf)), ntohs (sa_cli.sin_port));
 434
 435   gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
 436
 437   /* Enable TLS/IA. */
 438   gnutls_credentials_set (session, GNUTLS_CRD_IA, iacred);
 439   gnutls_ia_set_server_avp_function (iacred, server_avp);
 440
 441   ret = gnutls_handshake (session);
 442   if (ret < 0)
 443     {
 444       close (sd);
 445       gnutls_deinit (session);
 446       fail ("server: Handshake has failed (%s)\n\n", gnutls_strerror (ret));
 447       return;
 448     }
 449   success ("server: Handshake was completed\n");
 450
 451   if (!gnutls_ia_handshake_p (session))
 452     fail ("server: No TLS/IA negotiation\n");
 453   else
 454     {
 455       success ("server: TLS/IA handshake\n");
 456
 457       ret = gnutls_ia_handshake (session);
 458
 459       if (ret < 0)
 460         {
 461           fail ("server: TLS/IA handshake failed\n");
 462           gnutls_perror (ret);
 463           return;
 464         }
 465       else
 466         {
 467           success ("server: TLS/IA Handshake was completed\n");
 468         }
 469     }
 470
 471   /* see the Getting peer's information example */
 472   /* print_info(session); */
 473
 474   i = 0;
 475   for (;;)
 476     {
 477       memset (buffer, 0, MAX_BUF + 1);
 478       ret = gnutls_record_recv (session, buffer, MAX_BUF);
 479
 480       if (ret == 0)
 481         {
 482           success ("server: Peer has closed the GNUTLS connection\n");
 483           break;
 484         }
 485       else if (ret < 0)
 486         {
 487           if (ret == GNUTLS_E_FATAL_ALERT_RECEIVED)
 488             {
 489               gnutls_alert_description_t alert;
 490               const char *err;
 491               alert = gnutls_alert_get (session);
 492               err = gnutls_alert_get_name (alert);
 493               if (err)
 494                 printf ("Fatal alert: %s\n", err);
 495             }
 496
 497           fail ("server: Received corrupted data(%d). Closing...\n", ret);
 498           break;
 499         }
 500       else if (ret > 0)
 501         {
 502           /* echo data back to the client
 503            */
 504           gnutls_record_send (session, buffer, strlen (buffer));
 505         }
 506     }
 507   /* do not wait for the peer to close the connection.
 508    */
 509   gnutls_bye (session, GNUTLS_SHUT_WR);
 510
 511   close (sd);
 512   gnutls_deinit (session);
 513
 514   close (listen_sd);
 515
 516   gnutls_ia_free_server_credentials (iacred);
 517
 518   gnutls_anon_free_server_credentials (anoncred);
 519
 520   gnutls_dh_params_deinit (dh_params);
 521
 522   gnutls_global_deinit ();
 523
 524   success ("server: finished\n");
 525 }
 526
 527 void
 528 doit (void)
 529 {
 530   pid_t child;
 531
 532   server_start ();
 533   if (error_count)
 534     return;
 535
 536   child = fork ();
 537   if (child < 0)
 538     {
 539       perror ("fork");
 540       fail ("fork");
 541       return;
 542     }
 543
 544   if (child)
 545     {
 546       int status;
 547       /* parent */
 548       server ();
 549       wait (&status);
 550     }
 551   else
 552     client ();
 553 }