lib/gnutls_psk.c

   1 /*
   2  * Copyright (C) 2005, 2007 Free Software Foundation
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GNUTLS.
   7  *
   8  * The GNUTLS library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 2.1 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  21  * USA
  22  *
  23  */
  24
  25 /* Functions for manipulating the PSK credentials. */
  26
  27 #include <gnutls_int.h>
  28 #include <gnutls_errors.h>
  29 #include <auth_psk.h>
  30 #include <gnutls_state.h>
  31
  32 #ifdef ENABLE_PSK
  33
  34 #include <auth_psk_passwd.h>
  35 #include <gnutls_num.h>
  36 #include <gnutls_helper.h>
  37 #include <gnutls_datum.h>
  38 #include "debug.h"
  39
  40 /**
  41   * gnutls_psk_free_client_credentials - Used to free an allocated gnutls_psk_client_credentials_t structure
  42   * @sc: is an #gnutls_psk_client_credentials_t structure.
  43   *
  44   * This structure is complex enough to manipulate directly thus this
  45   * helper function is provided in order to free (deallocate) it.
  46   **/
  47 void
  48 gnutls_psk_free_client_credentials (gnutls_psk_client_credentials_t sc)
  49 {
  50   _gnutls_free_datum (&sc->username);
  51   _gnutls_free_datum (&sc->key);
  52   gnutls_free (sc);
  53 }
  54
  55 /**
  56   * gnutls_psk_allocate_client_credentials - Used to allocate an gnutls_psk_server_credentials_t structure
  57   * @sc: is a pointer to an #gnutls_psk_server_credentials_t structure.
  58   *
  59   * This structure is complex enough to manipulate directly thus this
  60   * helper function is provided in order to allocate it.
  61   *
  62   * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
  63   **/
  64 int
  65 gnutls_psk_allocate_client_credentials (gnutls_psk_client_credentials_t * sc)
  66 {
  67   *sc = gnutls_calloc (1, sizeof (psk_client_credentials_st));
  68
  69   if (*sc == NULL)
  70     return GNUTLS_E_MEMORY_ERROR;
  71
  72   return 0;
  73 }
  74
  75 /**
  76   * gnutls_psk_set_client_credentials - Used to set the username/password, in a gnutls_psk_client_credentials_t structure
  77   * @res: is an #gnutls_psk_client_credentials_t structure.
  78   * @username: is the user's zero-terminated userid
  79   * @key: is the user's key
  80   * @format: indicate the format of the key, either
  81   * %GNUTLS_PSK_KEY_RAW or %GNUTLS_PSK_KEY_HEX.
  82   *
  83   * This function sets the username and password, in a
  84   * gnutls_psk_client_credentials_t structure.  Those will be used in
  85   * PSK authentication. @username should be an ASCII string or UTF-8
  86   * strings prepared using the "SASLprep" profile of "stringprep".
  87   * The key can be either in raw byte format or in Hex (not with the
  88   * '0x' prefix).
  89   *
  90   * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
  91   **/
  92 int
  93 gnutls_psk_set_client_credentials (gnutls_psk_client_credentials_t res,
  94                                    const char *username,
  95                                    const gnutls_datum_t * key,
  96                                    gnutls_psk_key_flags flags)
  97 {
  98   int ret;
  99
 100   if (username == NULL || key == NULL || key->data == NULL)
 101     {
 102       gnutls_assert ();
 103       return GNUTLS_E_INVALID_REQUEST;
 104     }
 105
 106   ret = _gnutls_set_datum (&res->username, username, strlen (username));
 107   if (ret < 0)
 108     return ret;
 109
 110   if (flags == GNUTLS_PSK_KEY_RAW)
 111     {
 112       if (_gnutls_set_datum (&res->key, key->data, key->size) < 0)
 113         {
 114           gnutls_assert ();
 115           ret = GNUTLS_E_MEMORY_ERROR;
 116           goto error;
 117         }
 118     }
 119   else
 120     {                           /* HEX key */
 121       size_t size;
 122       size = res->key.size = key->size / 2;
 123       res->key.data = gnutls_malloc (size);
 124       if (res->key.data == NULL)
 125         {
 126           gnutls_assert ();
 127           ret = GNUTLS_E_MEMORY_ERROR;
 128           goto error;
 129         }
 130
 131       ret = gnutls_hex_decode (key, (char *) res->key.data, &size);
 132       res->key.size = (unsigned int)size;
 133       if (ret < 0)
 134         {
 135           gnutls_assert ();
 136           goto error;
 137         }
 138
 139     }
 140
 141   return 0;
 142
 143 error:
 144   _gnutls_free_datum (&res->username);
 145
 146   return ret;
 147 }
 148
 149 /**
 150   * gnutls_psk_free_server_credentials - Used to free an allocated gnutls_psk_server_credentials_t structure
 151   * @sc: is an #gnutls_psk_server_credentials_t structure.
 152   *
 153   * This structure is complex enough to manipulate directly thus this
 154   * helper function is provided in order to free (deallocate) it.
 155   **/
 156 void
 157 gnutls_psk_free_server_credentials (gnutls_psk_server_credentials_t sc)
 158 {
 159   gnutls_free (sc->password_file);
 160   gnutls_free (sc);
 161 }
 162
 163 /**
 164   * gnutls_psk_allocate_server_credentials - Used to allocate an gnutls_psk_server_credentials_t structure
 165   * @sc: is a pointer to an #gnutls_psk_server_credentials_t structure.
 166   *
 167   * This structure is complex enough to manipulate directly thus this
 168   * helper function is provided in order to allocate it.
 169   *
 170   * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
 171   **/
 172 int
 173 gnutls_psk_allocate_server_credentials (gnutls_psk_server_credentials_t * sc)
 174 {
 175   *sc = gnutls_calloc (1, sizeof (psk_server_cred_st));
 176
 177   if (*sc == NULL)
 178     return GNUTLS_E_MEMORY_ERROR;
 179
 180   return 0;
 181 }
 182
 183
 184 /**
 185   * gnutls_psk_set_server_credentials_file - Used to set the password files, in a gnutls_psk_server_credentials_t structure
 186   * @res: is an #gnutls_psk_server_credentials_t structure.
 187   * @password_file: is the PSK password file (passwd.psk)
 188   *
 189   * This function sets the password file, in a
 190   * %gnutls_psk_server_credentials_t structure.  This password file
 191   * holds usernames and keys and will be used for PSK authentication.
 192   *
 193   * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
 194   **/
 195 int
 196 gnutls_psk_set_server_credentials_file (gnutls_psk_server_credentials_t
 197                                         res, const char *password_file)
 198 {
 199
 200   if (password_file == NULL)
 201     {
 202       gnutls_assert ();
 203       return GNUTLS_E_INVALID_REQUEST;
 204     }
 205
 206   /* Check if the files can be opened */
 207   if (_gnutls_file_exists (password_file) != 0)
 208     {
 209       gnutls_assert ();
 210       return GNUTLS_E_FILE_ERROR;
 211     }
 212
 213   res->password_file = gnutls_strdup (password_file);
 214   if (res->password_file == NULL)
 215     {
 216       gnutls_assert ();
 217       return GNUTLS_E_MEMORY_ERROR;
 218     }
 219
 220   return 0;
 221 }
 222
 223
 224 /**
 225   * gnutls_psk_set_server_credentials_function - Used to set a callback to retrieve the user's PSK credentials
 226   * @cred: is a #gnutls_psk_server_credentials_t structure.
 227   * @func: is the callback function
 228   *
 229   * This function can be used to set a callback to retrieve the user's PSK credentials.
 230   * The callback's function form is:
 231   * int (*callback)(gnutls_session_t, const char* username,
 232   *  gnutls_datum_t* key);
 233   *
 234   * @username contains the actual username.
 235   * The @key must be filled in using the gnutls_malloc().
 236   *
 237   * In case the callback returned a negative number then gnutls will
 238   * assume that the username does not exist.
 239   *
 240   * The callback function will only be called once per handshake.  The
 241   * callback function should return 0 on success, while -1 indicates
 242   * an error.
 243   **/
 244 void
 245 gnutls_psk_set_server_credentials_function (gnutls_psk_server_credentials_t
 246                                             cred,
 247                                             gnutls_psk_server_credentials_function
 248                                             * func)
 249 {
 250   cred->pwd_callback = func;
 251 }
 252
 253 /**
 254   * gnutls_psk_set_client_credentials_function - Used to set a callback to retrieve the username and key
 255   * @cred: is a #gnutls_psk_server_credentials_t structure.
 256   * @func: is the callback function
 257   *
 258   * This function can be used to set a callback to retrieve the username and
 259   * password for client PSK authentication.
 260   * The callback's function form is:
 261   * int (*callback)(gnutls_session_t, char** username,
 262   *  gnutls_datum_t* key);
 263   *
 264   * The @username and @key must be allocated using gnutls_malloc().
 265   * @username should be ASCII strings or UTF-8 strings prepared using
 266   * the "SASLprep" profile of "stringprep".
 267   *
 268   * The callback function will be called once per handshake.
 269   *
 270   * The callback function should return 0 on success.
 271   * -1 indicates an error.
 272   **/
 273 void
 274 gnutls_psk_set_client_credentials_function (gnutls_psk_client_credentials_t
 275                                             cred,
 276                                             gnutls_psk_client_credentials_function
 277                                             * func)
 278 {
 279   cred->get_function = func;
 280 }
 281
 282
 283 /**
 284   * gnutls_psk_server_get_username - return the username of the peer
 285   * @session: is a gnutls session
 286   *
 287   * This should only be called in case of PSK authentication and in
 288   * case of a server.
 289   *
 290   * Returns: the username of the peer, or %NULL in case of an error.
 291   **/
 292 const char *
 293 gnutls_psk_server_get_username (gnutls_session_t session)
 294 {
 295   psk_auth_info_t info;
 296
 297   CHECK_AUTH (GNUTLS_CRD_PSK, NULL);
 298
 299   info = _gnutls_get_auth_info (session);
 300   if (info == NULL)
 301     return NULL;
 302
 303   if (info->username[0] != 0)
 304     return info->username;
 305
 306   return NULL;
 307 }
 308
 309 /**
 310   * gnutls_hex_decode - decode hex encoded data
 311   * @hex_data: contain the encoded data
 312   * @result: the place where decoded data will be copied
 313   * @result_size: holds the size of the result
 314   *
 315   * This function will decode the given encoded data, using the hex encoding
 316   * used by PSK password files.
 317   *
 318   * Note that hex_data should be null terminated.
 319   *
 320   * Returns: %GNUTLS_E_SHORT_MEMORY_BUFFER if the buffer given is not
 321   *   long enough, or 0 on success.
 322   **/
 323 int
 324 gnutls_hex_decode (const gnutls_datum_t * hex_data, char *result,
 325                    size_t * result_size)
 326 {
 327   int ret;
 328
 329   ret =
 330     _gnutls_hex2bin (hex_data->data, hex_data->size, (opaque *) result,
 331                      result_size);
 332   if (ret < 0)
 333     return ret;
 334
 335   return 0;
 336 }
 337
 338 /**
 339   * gnutls_hex_encode - convert raw data to hex encoded
 340   * @data: contain the raw data
 341   * @result: the place where hex data will be copied
 342   * @result_size: holds the size of the result
 343   *
 344   * This function will convert the given data to printable data, using
 345   * the hex encoding, as used in the PSK password files.
 346   *
 347   * Returns: %GNUTLS_E_SHORT_MEMORY_BUFFER if the buffer given is not
 348   * long enough, or 0 on success.
 349   **/
 350 int
 351 gnutls_hex_encode (const gnutls_datum_t * data, char *result,
 352                    size_t * result_size)
 353 {
 354   if (*result_size < data->size + data->size + 1)
 355     {
 356       gnutls_assert ();
 357       return GNUTLS_E_SHORT_MEMORY_BUFFER;
 358     }
 359
 360   _gnutls_bin2hex (data->data, data->size, result, *result_size);
 361
 362   return 0;
 363 }
 364
 365 /**
 366   * gnutls_psk_set_server_dh_params - set the DH parameters for a server to use
 367   * @res: is a gnutls_psk_server_credentials_t structure
 368   * @dh_params: is a structure that holds diffie hellman parameters.
 369   *
 370   * This function will set the diffie hellman parameters for an
 371   * anonymous server to use. These parameters will be used in Diffie
 372   * Hellman with PSK cipher suites.
 373   **/
 374 void
 375 gnutls_psk_set_server_dh_params (gnutls_psk_server_credentials_t res,
 376                                  gnutls_dh_params_t dh_params)
 377 {
 378   res->dh_params = dh_params;
 379 }
 380
 381 /**
 382   * gnutls_psk_set_server_params_function - set the DH parameters callback
 383   * @res: is a gnutls_certificate_credentials_t structure
 384   * @func: is the function to be called
 385   *
 386   * This function will set a callback in order for the server to get
 387   * the diffie hellman parameters for PSK authentication. The callback
 388   * should return zero on success.
 389   **/
 390 void
 391 gnutls_psk_set_server_params_function (gnutls_psk_server_credentials_t res,
 392                                        gnutls_params_function * func)
 393 {
 394   res->params_func = func;
 395 }
 396
 397 #endif /* ENABLE_PSK */