doc/examples/ex-cert-select-pkcs11.c

   1 /* This example code is placed in the public domain. */
   2
   3 #ifdef HAVE_CONFIG_H
   4 #include <config.h>
   5 #endif
   6
   7 #include <stdio.h>
   8 #include <stdlib.h>
   9 #include <string.h>
  10 #include <sys/types.h>
  11 #include <sys/socket.h>
  12 #include <arpa/inet.h>
  13 #include <unistd.h>
  14 #include <gnutls/gnutls.h>
  15 #include <gnutls/x509.h>
  16 #include <gnutls/pkcs11.h>
  17 #include <sys/types.h>
  18 #include <sys/stat.h>
  19 #include <fcntl.h>
  20 #include <getpass.h> /* for getpass() */
  21
  22 /* A TLS client that loads the certificate and key.
  23  */
  24
  25 #define MAX_BUF 1024
  26 #define MSG "GET / HTTP/1.0\r\n\r\n"
  27 #define MIN(x,y) (((x)<(y))?(x):(y))
  28
  29 #define CAFILE "/etc/ssl/certs/ca-certificates.crt"
  30
  31 /* The URLs of the objects can be obtained
  32  * using p11tool --list-all --login
  33  */
  34 #define KEY_URL "pkcs11:manufacturer=SomeManufacturer;object=Private%20Key" \
  35   ";objecttype=private;id=%db%5b%3e%b5%72%33"
  36 #define CERT_URL "pkcs11:manufacturer=SomeManufacturer;object=Certificate;" \
  37   "objecttype=cert;id=db%5b%3e%b5%72%33"
  38
  39 extern int tcp_connect (void);
  40 extern void tcp_close (int sd);
  41
  42 static int
  43 pin_callback (void *user, int attempt, const char *token_url,
  44               const char *token_label, unsigned int flags, char *pin,
  45               size_t pin_max)
  46 {
  47   const char *password;
  48   int len;
  49
  50   /* Note that a PIN callback may be called multiple times during a
  51    * session. It is expected to cache and return the same PIN for
  52    * the same token_url, unless flags is set to GNUTLS_PKCS11_PIN_WRONG.
  53    */
  54
  55   printf ("PIN required for token '%s' with URL '%s'\n", token_label,
  56           token_url);
  57   if (flags & GNUTLS_PKCS11_PIN_FINAL_TRY)
  58     printf ("*** This is the final try before locking!\n");
  59   if (flags & GNUTLS_PKCS11_PIN_COUNT_LOW)
  60     printf ("*** Only few tries left before locking!\n");
  61   if (flags & GNUTLS_PKCS11_PIN_WRONG)
  62     printf ("*** Wrong PIN\n");
  63
  64   password = getpass ("Enter pin: ");
  65   if (password == NULL || password[0] == 0)
  66     {
  67       fprintf (stderr, "No password given\n");
  68       exit (1);
  69     }
  70
  71   len = MIN (pin_max, strlen (password));
  72   memcpy (pin, password, len);
  73   pin[len] = 0;
  74
  75   return 0;
  76 }
  77
  78 int
  79 main (void)
  80 {
  81   int ret, sd, ii;
  82   gnutls_session_t session;
  83   gnutls_priority_t priorities_cache;
  84   char buffer[MAX_BUF + 1];
  85   gnutls_certificate_credentials_t xcred;
  86   /* Allow connections to servers that have OpenPGP keys as well.
  87    */
  88
  89   gnutls_global_init ();
  90   /* PKCS11 private key operations might require PIN.
  91    * Register a callback.
  92    */
  93   gnutls_pkcs11_set_pin_function (pin_callback, NULL);
  94
  95   /* X509 stuff */
  96   gnutls_certificate_allocate_credentials (&xcred);
  97
  98   /* priorities */
  99   gnutls_priority_init (&priorities_cache, "NORMAL", NULL);
 100
 101   /* sets the trusted cas file
 102    */
 103   gnutls_certificate_set_x509_trust_file (xcred, CAFILE, GNUTLS_X509_FMT_PEM);
 104
 105   gnutls_certificate_set_x509_key_file (xcred, CERT_URL, KEY_URL, GNUTLS_X509_FMT_DER);
 106
 107   /* Initialize TLS session
 108    */
 109   gnutls_init (&session, GNUTLS_CLIENT);
 110
 111   /* Use default priorities */
 112   gnutls_priority_set (session, priorities_cache);
 113
 114   /* put the x509 credentials to the current session
 115    */
 116   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 117
 118   /* connect to the peer
 119    */
 120   sd = tcp_connect ();
 121
 122   gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
 123
 124   /* Perform the TLS handshake
 125    */
 126   ret = gnutls_handshake (session);
 127
 128   if (ret < 0)
 129     {
 130       fprintf (stderr, "*** Handshake failed\n");
 131       gnutls_perror (ret);
 132       goto end;
 133     }
 134   else
 135     {
 136       printf ("- Handshake was completed\n");
 137     }
 138
 139   gnutls_record_send (session, MSG, strlen (MSG));
 140
 141   ret = gnutls_record_recv (session, buffer, MAX_BUF);
 142   if (ret == 0)
 143     {
 144       printf ("- Peer has closed the TLS connection\n");
 145       goto end;
 146     }
 147   else if (ret < 0)
 148     {
 149       fprintf (stderr, "*** Error: %s\n", gnutls_strerror (ret));
 150       goto end;
 151     }
 152
 153   printf ("- Received %d bytes: ", ret);
 154   for (ii = 0; ii < ret; ii++)
 155     {
 156       fputc (buffer[ii], stdout);
 157     }
 158   fputs ("\n", stdout);
 159
 160   gnutls_bye (session, GNUTLS_SHUT_RDWR);
 161
 162 end:
 163
 164   tcp_close (sd);
 165
 166   gnutls_deinit (session);
 167
 168   gnutls_certificate_free_credentials (xcred);
 169   gnutls_priority_deinit (priorities_cache);
 170
 171   gnutls_global_deinit ();
 172
 173   return 0;
 174 }