tests/resume.c

   1 /*
   2  * Copyright (C) 2004, 2005, 2007, 2008, 2009, 2010 Free Software
   3  * Foundation, Inc.
   4  *
   5  * Author: Simon Josefsson
   6  *
   7  * This file is part of GNUTLS.
   8  *
   9  * GNUTLS is free software; you can redistribute it and/or modify it
  10  * under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 3 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * GNUTLS is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with GNUTLS; if not, write to the Free Software Foundation,
  21  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  22  */
  23
  24 /* Parts copied from GnuTLS example programs. */
  25
  26 #ifdef HAVE_CONFIG_H
  27 # include <config.h>
  28 #endif
  29
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <string.h>
  33 #include <sys/types.h>
  34 #include <sys/socket.h>
  35 #include <sys/wait.h>
  36 #include <netinet/in.h>
  37 #include <arpa/inet.h>
  38 #include <unistd.h>
  39 #include <gnutls/gnutls.h>
  40
  41 #include "tcp.c"
  42
  43 #include "utils.h"
  44
  45 static void wrap_db_init (void);
  46 static void wrap_db_deinit (void);
  47 static int wrap_db_store (void *dbf, gnutls_datum_t key, gnutls_datum_t data);
  48 static gnutls_datum_t wrap_db_fetch (void *dbf, gnutls_datum_t key);
  49 static int wrap_db_delete (void *dbf, gnutls_datum_t key);
  50
  51 #define TLS_SESSION_CACHE 50
  52
  53 struct params_res
  54 {
  55   const char *desc;
  56   int enable_db;
  57   int enable_session_ticket_server;
  58   int enable_session_ticket_client;
  59   int expect_resume;
  60 };
  61
  62 pid_t child;
  63
  64 struct params_res resume_tests[] = {
  65   {"try to resume from db", 50, 0, 0, 1},
  66 #ifdef ENABLE_SESSION_TICKET
  67   {"try to resume from session ticket", 0, 1, 1, 1},
  68   {"try to resume from session ticket (server only)", 0, 1, 0, 0},
  69   {"try to resume from session ticket (client only)", 0, 0, 1, 0},
  70 #endif
  71   {NULL, -1}
  72 };
  73
  74 /* A very basic TLS client, with anonymous authentication.
  75  */
  76
  77 #define MAX_BUF 1024
  78 #define MSG "Hello TLS"
  79
  80 static void
  81 tls_log_func (int level, const char *str)
  82 {
  83   fprintf (stderr, "%s |<%d>| %s", child ? "server" : "client", level, str);
  84 }
  85
  86 static void
  87 client (struct params_res *params)
  88 {
  89   int ret, sd, ii;
  90   gnutls_session_t session;
  91   char buffer[MAX_BUF + 1];
  92   gnutls_anon_client_credentials_t anoncred;
  93   /* Need to enable anonymous KX specifically. */
  94   const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
  95
  96   /* variables used in session resuming
  97    */
  98   int t;
  99   gnutls_datum_t session_data;
 100
 101   if (debug)
 102     {
 103       gnutls_global_set_log_function (tls_log_func);
 104       gnutls_global_set_log_level (2);
 105     }
 106   gnutls_global_init ();
 107
 108   gnutls_anon_allocate_client_credentials (&anoncred);
 109
 110   for (t = 0; t < 2; t++)
 111     {                           /* connect 2 times to the server */
 112
 113       /* connect to the peer
 114        */
 115       sd = tcp_connect ();
 116
 117       /* Initialize TLS session
 118        */
 119       gnutls_init (&session, GNUTLS_CLIENT);
 120
 121       /* Use default priorities */
 122       gnutls_set_default_priority (session);
 123       gnutls_kx_set_priority (session, kx_prio);
 124
 125       /* put the anonymous credentials to the current session
 126        */
 127       gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
 128
 129 #ifdef ENABLE_SESSION_TICKET
 130       if (params->enable_session_ticket_client)
 131         gnutls_session_ticket_enable_client (session);
 132 #endif
 133
 134       if (t > 0)
 135         {
 136           /* if this is not the first time we connect */
 137           gnutls_session_set_data (session, session_data.data,
 138                                    session_data.size);
 139           gnutls_free (session_data.data);
 140         }
 141
 142       gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
 143
 144       /* Perform the TLS handshake
 145        */
 146       ret = gnutls_handshake (session);
 147
 148       if (ret < 0)
 149         {
 150           fail ("client: Handshake failed\n");
 151           gnutls_perror (ret);
 152           goto end;
 153         }
 154       else
 155         {
 156           success ("client: Handshake was completed\n");
 157         }
 158
 159       if (t == 0)
 160         {                       /* the first time we connect */
 161           /* get the session data size */
 162           ret = gnutls_session_get_data2 (session, &session_data);
 163           if (ret < 0)
 164             fail ("Getting resume data failed\n");
 165         }
 166       else
 167         {                       /* the second time we connect */
 168
 169           /* check if we actually resumed the previous session */
 170           if (gnutls_session_is_resumed (session) != 0)
 171             {
 172               if (params->expect_resume)
 173                 success ("- Previous session was resumed\n");
 174               else
 175                 fail ("- Previous session was resumed\n");
 176             }
 177           else
 178             {
 179               if (params->expect_resume)
 180                 fail ("*** Previous session was NOT resumed\n");
 181               else
 182                 success ("*** Previous session was NOT resumed (expected)\n");
 183             }
 184         }
 185
 186       gnutls_record_send (session, MSG, strlen (MSG));
 187
 188       ret = gnutls_record_recv (session, buffer, MAX_BUF);
 189       if (ret == 0)
 190         {
 191           success ("client: Peer has closed the TLS connection\n");
 192           goto end;
 193         }
 194       else if (ret < 0)
 195         {
 196           fail ("client: Error: %s\n", gnutls_strerror (ret));
 197           goto end;
 198         }
 199
 200       if (debug)
 201         {
 202           printf ("- Received %d bytes: ", ret);
 203           for (ii = 0; ii < ret; ii++)
 204             {
 205               fputc (buffer[ii], stdout);
 206             }
 207           fputs ("\n", stdout);
 208         }
 209
 210       gnutls_bye (session, GNUTLS_SHUT_RDWR);
 211
 212     end:
 213
 214       tcp_close (sd);
 215
 216       gnutls_deinit (session);
 217     }
 218
 219   gnutls_anon_free_client_credentials (anoncred);
 220 }
 221
 222 /* This is a sample TLS 1.0 echo server, for anonymous authentication only.
 223  */
 224
 225 #define SA struct sockaddr
 226 #define MAX_BUF 1024
 227 #define PORT 5556               /* listen to 5556 port */
 228 #define DH_BITS 1024
 229
 230 /* These are global */
 231 gnutls_anon_server_credentials_t anoncred;
 232 gnutls_datum_t session_ticket_key = { NULL, 0 };
 233
 234 static gnutls_session_t
 235 initialize_tls_session (struct params_res *params)
 236 {
 237   gnutls_session_t session;
 238   const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
 239
 240   gnutls_init (&session, GNUTLS_SERVER);
 241
 242   /* avoid calling all the priority functions, since the defaults
 243    * are adequate.
 244    */
 245   gnutls_set_default_priority (session);
 246   gnutls_kx_set_priority (session, kx_prio);
 247
 248   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
 249
 250   gnutls_dh_set_prime_bits (session, DH_BITS);
 251
 252   if (params->enable_db)
 253     {
 254       gnutls_db_set_retrieve_function (session, wrap_db_fetch);
 255       gnutls_db_set_remove_function (session, wrap_db_delete);
 256       gnutls_db_set_store_function (session, wrap_db_store);
 257       gnutls_db_set_ptr (session, NULL);
 258     }
 259 #ifdef ENABLE_SESSION_TICKET
 260   if (params->enable_session_ticket_server)
 261     gnutls_session_ticket_enable_server (session, &session_ticket_key);
 262 #endif
 263
 264   return session;
 265 }
 266
 267 static gnutls_dh_params_t dh_params;
 268
 269 static int
 270 generate_dh_params (void)
 271 {
 272   const gnutls_datum_t p3 = { (char *) pkcs3, strlen (pkcs3) };
 273   /* Generate Diffie-Hellman parameters - for use with DHE
 274    * kx algorithms. These should be discarded and regenerated
 275    * once a day, once a week or once a month. Depending on the
 276    * security requirements.
 277    */
 278   gnutls_dh_params_init (&dh_params);
 279   return gnutls_dh_params_import_pkcs3 (dh_params, &p3, GNUTLS_X509_FMT_PEM);
 280 }
 281
 282 int err, listen_sd, i;
 283 int sd, ret;
 284 struct sockaddr_in sa_serv;
 285 struct sockaddr_in sa_cli;
 286 int client_len;
 287 char topbuf[512];
 288 gnutls_session_t session;
 289 char buffer[MAX_BUF + 1];
 290 int optval = 1;
 291
 292 static void
 293 global_start (void)
 294 {
 295   /* Socket operations
 296    */
 297   listen_sd = socket (AF_INET, SOCK_STREAM, 0);
 298   if (err == -1)
 299     {
 300       perror ("socket");
 301       fail ("server: socket failed\n");
 302       return;
 303     }
 304
 305   memset (&sa_serv, '\0', sizeof (sa_serv));
 306   sa_serv.sin_family = AF_INET;
 307   sa_serv.sin_addr.s_addr = INADDR_ANY;
 308   sa_serv.sin_port = htons (PORT);      /* Server Port number */
 309
 310   setsockopt (listen_sd, SOL_SOCKET, SO_REUSEADDR, (void *) &optval,
 311               sizeof (int));
 312
 313   err = bind (listen_sd, (SA *) & sa_serv, sizeof (sa_serv));
 314   if (err == -1)
 315     {
 316       perror ("bind");
 317       fail ("server: bind failed\n");
 318       return;
 319     }
 320
 321   err = listen (listen_sd, 1024);
 322   if (err == -1)
 323     {
 324       perror ("listen");
 325       fail ("server: listen failed\n");
 326       return;
 327     }
 328
 329   success ("server: ready. Listening to port '%d'.\n", PORT);
 330 }
 331
 332 static void
 333 global_stop (void)
 334 {
 335   success ("global stop\n");
 336
 337   gnutls_anon_free_server_credentials (anoncred);
 338
 339   gnutls_dh_params_deinit (dh_params);
 340
 341   gnutls_global_deinit ();
 342
 343   shutdown (listen_sd, SHUT_RDWR);
 344 }
 345
 346 static void
 347 server (struct params_res *params)
 348 {
 349   size_t t;
 350
 351   /* this must be called once in the program, it is mostly for the server.
 352    */
 353   if (debug)
 354     {
 355       gnutls_global_set_log_function (tls_log_func);
 356       gnutls_global_set_log_level (2);
 357     }
 358
 359   gnutls_global_init ();
 360   gnutls_anon_allocate_server_credentials (&anoncred);
 361
 362   success ("Launched, generating DH parameters...\n");
 363
 364   generate_dh_params ();
 365
 366   gnutls_anon_set_server_dh_params (anoncred, dh_params);
 367
 368   if (params->enable_db)
 369     {
 370       wrap_db_init ();
 371     }
 372 #ifdef ENABLE_SESSION_TICKET
 373   if (params->enable_session_ticket_server)
 374     gnutls_session_ticket_key_generate (&session_ticket_key);
 375 #endif
 376
 377   for (t = 0; t < 2; t++)
 378     {
 379       client_len = sizeof (sa_cli);
 380
 381       session = initialize_tls_session (params);
 382
 383       sd = accept (listen_sd, (SA *) & sa_cli, &client_len);
 384
 385       success ("server: connection from %s, port %d\n",
 386                inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
 387                           sizeof (topbuf)), ntohs (sa_cli.sin_port));
 388
 389       gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
 390       ret = gnutls_handshake (session);
 391       if (ret < 0)
 392         {
 393           close (sd);
 394           gnutls_deinit (session);
 395           fail ("server: Handshake has failed (%s)\n\n",
 396                 gnutls_strerror (ret));
 397           return;
 398         }
 399       success ("server: Handshake was completed\n");
 400
 401       /* see the Getting peer's information example */
 402       /* print_info(session); */
 403
 404       i = 0;
 405       for (;;)
 406         {
 407           memset (buffer, 0, MAX_BUF + 1);
 408           ret = gnutls_record_recv (session, buffer, MAX_BUF);
 409
 410           if (ret == 0)
 411             {
 412               success ("server: Peer has closed the GNUTLS connection\n");
 413               break;
 414             }
 415           else if (ret < 0)
 416             {
 417               fail ("server: Received corrupted data(%d). Closing...\n", ret);
 418               break;
 419             }
 420           else if (ret > 0)
 421             {
 422               /* echo data back to the client
 423                */
 424               gnutls_record_send (session, buffer, strlen (buffer));
 425             }
 426         }
 427       /* do not wait for the peer to close the connection.
 428        */
 429       gnutls_bye (session, GNUTLS_SHUT_WR);
 430
 431       close (sd);
 432
 433       gnutls_deinit (session);
 434     }
 435
 436   close (listen_sd);
 437
 438   if (params->enable_db)
 439     {
 440       wrap_db_deinit ();
 441     }
 442
 443   gnutls_free (session_ticket_key.data);
 444   session_ticket_key.data = NULL;
 445
 446   success ("server: finished\n");
 447 }
 448
 449 void
 450 doit (void)
 451 {
 452   int i;
 453
 454   for (i = 0; resume_tests[i].desc; i++)
 455     {
 456       printf ("%s\n", resume_tests[i].desc);
 457
 458       global_start ();
 459       if (error_count)
 460         return;
 461
 462       child = fork ();
 463       if (child < 0)
 464         {
 465           perror ("fork");
 466           fail ("fork");
 467           return;
 468         }
 469
 470       if (child)
 471         {
 472           int status;
 473           /* parent */
 474           server (&resume_tests[i]);
 475           wait (&status);
 476           global_stop ();
 477         }
 478       else
 479         {
 480           client (&resume_tests[i]);
 481           gnutls_global_deinit ();
 482           exit (0);
 483         }
 484     }
 485 }
 486
 487 /* Functions and other stuff needed for session resuming.
 488  * This is done using a very simple list which holds session ids
 489  * and session data.
 490  */
 491
 492 #define MAX_SESSION_ID_SIZE 32
 493 #define MAX_SESSION_DATA_SIZE 512
 494
 495 typedef struct
 496 {
 497   unsigned char session_id[MAX_SESSION_ID_SIZE];
 498   unsigned int session_id_size;
 499
 500   char session_data[MAX_SESSION_DATA_SIZE];
 501   int session_data_size;
 502 } CACHE;
 503
 504 static CACHE *cache_db;
 505 static int cache_db_ptr = 0;
 506
 507 static void
 508 wrap_db_init (void)
 509 {
 510
 511   /* allocate cache_db */
 512   cache_db = calloc (1, TLS_SESSION_CACHE * sizeof (CACHE));
 513 }
 514
 515 static void
 516 wrap_db_deinit (void)
 517 {
 518   free (cache_db);
 519   cache_db = NULL;
 520   return;
 521 }
 522
 523 static int
 524 wrap_db_store (void *dbf, gnutls_datum_t key, gnutls_datum_t data)
 525 {
 526   success ("resume db storing... (%d-%d)\n", key.size, data.size);
 527
 528   if (debug)
 529     {
 530       unsigned int i;
 531       printf ("key:\n");
 532       for (i = 0; i < key.size; i++)
 533         {
 534           printf ("%02x ", key.data[i] & 0xFF);
 535           if ((i + 1) % 16 == 0)
 536             printf ("\n");
 537         }
 538       printf ("\n");
 539       printf ("data:\n");
 540       for (i = 0; i < data.size; i++)
 541         {
 542           printf ("%02x ", data.data[i] & 0xFF);
 543           if ((i + 1) % 16 == 0)
 544             printf ("\n");
 545         }
 546       printf ("\n");
 547     }
 548
 549   if (cache_db == NULL)
 550     return -1;
 551
 552   if (key.size > MAX_SESSION_ID_SIZE)
 553     return -1;
 554   if (data.size > MAX_SESSION_DATA_SIZE)
 555     return -1;
 556
 557   memcpy (cache_db[cache_db_ptr].session_id, key.data, key.size);
 558   cache_db[cache_db_ptr].session_id_size = key.size;
 559
 560   memcpy (cache_db[cache_db_ptr].session_data, data.data, data.size);
 561   cache_db[cache_db_ptr].session_data_size = data.size;
 562
 563   cache_db_ptr++;
 564   cache_db_ptr %= TLS_SESSION_CACHE;
 565
 566   return 0;
 567 }
 568
 569 static gnutls_datum_t
 570 wrap_db_fetch (void *dbf, gnutls_datum_t key)
 571 {
 572   gnutls_datum_t res = { NULL, 0 };
 573   int i;
 574
 575   success ("resume db fetch... (%d)\n", key.size);
 576   if (debug)
 577     {
 578       unsigned int i;
 579       printf ("key:\n");
 580       for (i = 0; i < key.size; i++)
 581         {
 582           printf ("%02x ", key.data[i] & 0xFF);
 583           if ((i + 1) % 16 == 0)
 584             printf ("\n");
 585         }
 586       printf ("\n");
 587     }
 588
 589   if (cache_db == NULL)
 590     return res;
 591
 592   for (i = 0; i < TLS_SESSION_CACHE; i++)
 593     {
 594       if (key.size == cache_db[i].session_id_size &&
 595           memcmp (key.data, cache_db[i].session_id, key.size) == 0)
 596         {
 597           success ("resume db fetch... return info\n");
 598
 599           res.size = cache_db[i].session_data_size;
 600
 601           res.data = gnutls_malloc (res.size);
 602           if (res.data == NULL)
 603             return res;
 604
 605           memcpy (res.data, cache_db[i].session_data, res.size);
 606
 607           if (debug)
 608             {
 609               unsigned int i;
 610               printf ("data:\n");
 611               for (i = 0; i < res.size; i++)
 612                 {
 613                   printf ("%02x ", res.data[i] & 0xFF);
 614                   if ((i + 1) % 16 == 0)
 615                     printf ("\n");
 616                 }
 617               printf ("\n");
 618             }
 619
 620           return res;
 621         }
 622     }
 623   return res;
 624 }
 625
 626 static int
 627 wrap_db_delete (void *dbf, gnutls_datum_t key)
 628 {
 629   int i;
 630
 631   if (cache_db == NULL)
 632     return -1;
 633
 634   for (i = 0; i < TLS_SESSION_CACHE; i++)
 635     {
 636       if (key.size == cache_db[i].session_id_size &&
 637           memcmp (key.data, cache_db[i].session_id, key.size) == 0)
 638         {
 639
 640           cache_db[i].session_id_size = 0;
 641           cache_db[i].session_data_size = 0;
 642
 643           return 0;
 644         }
 645     }
 646
 647   return -1;
 648
 649 }