tests/tlsia.c

   1 /*
   2  * Copyright (C) 2004, 2005, 2007 Free Software Foundation
   3  *
   4  * Author: Simon Josefsson
   5  *
   6  * This file is part of GNUTLS.
   7  *
   8  * GNUTLS is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * GNUTLS is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with GNUTLS; if not, write to the Free Software Foundation,
  20  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  21  */
  22
  23 /* Parts copied from GnuTLS example programs. */
  24
  25 #if HAVE_CONFIG_H
  26 # include <config.h>
  27 #endif
  28
  29 #include <stdio.h>
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <sys/types.h>
  33 #include <sys/socket.h>
  34 #include <sys/wait.h>
  35 #include <netinet/in.h>
  36 #include <arpa/inet.h>
  37 #include <unistd.h>
  38 #include <gnutls/gnutls.h>
  39 #include <gnutls/extra.h>
  40
  41 #include "utils.h"
  42
  43 #include <readline.h>
  44
  45 /* A very basic TLS client, with anonymous authentication.
  46  */
  47
  48 #define MAX_BUF 1024
  49 #define MSG "Hello TLS"
  50
  51 /* Connects to the peer and returns a socket
  52  * descriptor.
  53  */
  54 int
  55 tcp_connect (void)
  56 {
  57   const char *PORT = "5556";
  58   const char *SERVER = "127.0.0.1";
  59   int err, sd;
  60   struct sockaddr_in sa;
  61
  62   /* connects to server
  63    */
  64   sd = socket (AF_INET, SOCK_STREAM, 0);
  65
  66   memset (&sa, '\0', sizeof (sa));
  67   sa.sin_family = AF_INET;
  68   sa.sin_port = htons (atoi (PORT));
  69   inet_pton (AF_INET, SERVER, &sa.sin_addr);
  70
  71   err = connect (sd, (struct sockaddr *) &sa, sizeof (sa));
  72   if (err < 0)
  73     {
  74       fprintf (stderr, "Connect error\n");
  75       exit (1);
  76     }
  77
  78   return sd;
  79 }
  80
  81 /* closes the given socket descriptor.
  82  */
  83 void
  84 tcp_close (int sd)
  85 {
  86   shutdown (sd, SHUT_RDWR);     /* no more receptions */
  87   close (sd);
  88 }
  89
  90 int
  91 client_avp (gnutls_session_t session, void *ptr,
  92             const char *last, size_t lastlen, char **new, size_t * newlen)
  93 {
  94   static int iter = 0;
  95   char *p;
  96
  97   if (last)
  98     printf ("client: received %d bytes AVP: `%.*s'\n",
  99             lastlen, lastlen, last);
 100   else
 101     printf ("client: new application phase\n");
 102
 103   switch (iter)
 104     {
 105     case 0:
 106       p = "client's first AVP, next will be empty";
 107       break;
 108
 109     case 1:
 110       p = "";
 111       break;
 112
 113     case 2:
 114       p = "client avp";
 115       break;
 116
 117     default:
 118       p = "final client AVP, we'll restart next";
 119       iter = -1;
 120       break;
 121     }
 122
 123   iter++;
 124
 125   if (debug)
 126     p = readline ("Client TLS/IA AVP: ");
 127
 128   *new = gnutls_strdup (p);
 129   if (!*new)
 130     return -1;
 131   *newlen = strlen (*new);
 132
 133   printf ("client: sending %d bytes AVP: `%s'\n", *newlen, *new);
 134
 135   gnutls_ia_permute_inner_secret (session, 3, "foo");
 136
 137   return 0;
 138 }
 139
 140 void
 141 client (void)
 142 {
 143   int ret, sd, ii;
 144   gnutls_session_t session;
 145   char buffer[MAX_BUF + 1];
 146   gnutls_anon_client_credentials_t anoncred;
 147   gnutls_ia_client_credentials_t iacred;
 148   /* Need to enable anonymous KX specifically. */
 149   const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
 150
 151   gnutls_global_init ();
 152   gnutls_global_init_extra ();
 153
 154   gnutls_anon_allocate_client_credentials (&anoncred);
 155   gnutls_ia_allocate_client_credentials (&iacred);
 156
 157   /* Initialize TLS session
 158    */
 159   gnutls_init (&session, GNUTLS_CLIENT);
 160
 161   /* Use default priorities */
 162   gnutls_set_default_priority (session);
 163   gnutls_kx_set_priority (session, kx_prio);
 164
 165   /* put the anonymous credentials to the current session
 166    */
 167   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
 168   gnutls_credentials_set (session, GNUTLS_CRD_IA, iacred);
 169
 170   /* connect to the peer
 171    */
 172   sd = tcp_connect ();
 173
 174   gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
 175
 176   /* Enable TLS/IA. */
 177   gnutls_ia_set_client_avp_function (iacred, client_avp);
 178
 179   /* Perform the TLS handshake
 180    */
 181   ret = gnutls_handshake (session);
 182
 183   if (ret < 0)
 184     {
 185       fail ("client: Handshake failed\n");
 186       gnutls_perror (ret);
 187       goto end;
 188     }
 189   else
 190     {
 191       success ("client: Handshake was completed\n");
 192     }
 193
 194   /*
 195      To test TLS/IA alert's (the server will print that a fatal alert
 196      was received):
 197      gnutls_alert_send(session, GNUTLS_AL_FATAL,
 198      GNUTLS_A_INNER_APPLICATION_FAILURE);
 199    */
 200
 201   if (!gnutls_ia_handshake_p (session))
 202     fail ("client: No TLS/IA negotiation\n");
 203   else
 204     {
 205       success ("client: TLS/IA handshake\n");
 206
 207       ret = gnutls_ia_handshake (session);
 208
 209       if (ret < 0)
 210         {
 211           fail ("client: TLS/IA handshake failed\n");
 212           gnutls_perror (ret);
 213           goto end;
 214         }
 215       else
 216         {
 217           success ("client: TLS/IA Handshake was completed\n");
 218         }
 219     }
 220
 221   gnutls_record_send (session, MSG, strlen (MSG));
 222
 223   ret = gnutls_record_recv (session, buffer, MAX_BUF);
 224   if (ret == 0)
 225     {
 226       success ("client: Peer has closed the TLS connection\n");
 227       goto end;
 228     }
 229   else if (ret < 0)
 230     {
 231       fail ("client: Error: %s\n", gnutls_strerror (ret));
 232       goto end;
 233     }
 234
 235   if (debug)
 236     {
 237       printf ("- Received %d bytes: ", ret);
 238       for (ii = 0; ii < ret; ii++)
 239         {
 240           fputc (buffer[ii], stdout);
 241         }
 242       fputs ("\n", stdout);
 243     }
 244
 245   gnutls_bye (session, GNUTLS_SHUT_RDWR);
 246
 247 end:
 248
 249   tcp_close (sd);
 250
 251   gnutls_deinit (session);
 252
 253   gnutls_ia_free_client_credentials (iacred);
 254
 255   gnutls_anon_free_client_credentials (anoncred);
 256
 257   gnutls_global_deinit ();
 258 }
 259
 260 /* This is a sample TLS 1.0 echo server, for anonymous authentication only.
 261  */
 262
 263 #define SA struct sockaddr
 264 #define MAX_BUF 1024
 265 #define PORT 5556               /* listen to 5556 port */
 266 #define DH_BITS 1024
 267
 268 /* These are global */
 269 gnutls_anon_server_credentials_t anoncred;
 270 gnutls_ia_server_credentials_t iacred;
 271
 272 gnutls_session_t
 273 initialize_tls_session (void)
 274 {
 275   gnutls_session_t session;
 276   const int kx_prio[] = { GNUTLS_KX_ANON_DH, 0 };
 277
 278   gnutls_init (&session, GNUTLS_SERVER);
 279
 280   /* avoid calling all the priority functions, since the defaults
 281    * are adequate.
 282    */
 283   gnutls_set_default_priority (session);
 284   gnutls_kx_set_priority (session, kx_prio);
 285
 286   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
 287
 288   gnutls_dh_set_prime_bits (session, DH_BITS);
 289
 290   return session;
 291 }
 292
 293 static gnutls_dh_params_t dh_params;
 294
 295 static int
 296 generate_dh_params (void)
 297 {
 298   const gnutls_datum_t p3 = { pkcs3, strlen (pkcs3) };
 299   /* Generate Diffie Hellman parameters - for use with DHE
 300    * kx algorithms. These should be discarded and regenerated
 301    * once a day, once a week or once a month. Depending on the
 302    * security requirements.
 303    */
 304   gnutls_dh_params_init (&dh_params);
 305   return gnutls_dh_params_import_pkcs3 (dh_params, &p3, GNUTLS_X509_FMT_PEM);
 306 }
 307
 308 int err, listen_sd, i;
 309 int sd, ret;
 310 struct sockaddr_in sa_serv;
 311 struct sockaddr_in sa_cli;
 312 socklen_t client_len;
 313 char topbuf[512];
 314 gnutls_session_t session;
 315 char buffer[MAX_BUF + 1];
 316 int optval = 1;
 317
 318 int
 319 server_avp (gnutls_session_t session, void *ptr,
 320             const char *last, size_t lastlen, char **new, size_t * newlen)
 321 {
 322   static int iter = 0;
 323   char *p;
 324
 325   if (last)
 326     printf ("server: received %d bytes AVP: `%.*s'\n",
 327             lastlen, lastlen, last);
 328
 329   gnutls_ia_permute_inner_secret (session, 3, "foo");
 330
 331   switch (iter)
 332     {
 333     case 0:
 334       p = "first server AVP";
 335       break;
 336
 337     case 1:
 338       p = "second server AVP, next will be empty, then a intermediate finish";
 339       break;
 340
 341     case 2:
 342       p = "";
 343       break;
 344
 345     case 3:
 346       p = "1";
 347       break;
 348
 349     case 4:
 350       p = "server avp, after intermediate finish, next another intermediate";
 351       break;
 352
 353     case 5:
 354       p = "1";
 355       break;
 356
 357     case 6:
 358       p = "server avp, next will be the finish phase";
 359       break;
 360
 361     default:
 362       p = "2";
 363       break;
 364     }
 365
 366   iter++;
 367
 368   if (debug)
 369     p = readline ("Server TLS/IA AVP (type '1' to sync, '2' to finish): ");
 370
 371   if (!p)
 372     return -1;
 373
 374   if (strcmp (p, "1") == 0)
 375     {
 376       success ("server: Sending IntermediatePhaseFinished...\n");
 377       return 1;
 378     }
 379
 380   if (strcmp (p, "2") == 0)
 381     {
 382       success ("server: Sending FinalPhaseFinished...\n");
 383       return 2;
 384     }
 385
 386   *new = gnutls_strdup (p);
 387   if (!*new)
 388     return -1;
 389   *newlen = strlen (*new);
 390
 391   printf ("server: sending %d bytes AVP: `%s'\n", *newlen, *new);
 392
 393   return 0;
 394 }
 395
 396 void
 397 server_start (void)
 398 {
 399   /* this must be called once in the program
 400    */
 401   gnutls_global_init ();
 402
 403   gnutls_anon_allocate_server_credentials (&anoncred);
 404   gnutls_ia_allocate_server_credentials (&iacred);
 405
 406   success ("Launched, generating DH parameters...\n");
 407
 408   generate_dh_params ();
 409
 410   gnutls_anon_set_server_dh_params (anoncred, dh_params);
 411
 412   /* Socket operations
 413    */
 414   listen_sd = socket (AF_INET, SOCK_STREAM, 0);
 415   if (err == -1)
 416     {
 417       perror ("socket");
 418       fail ("server: socket failed\n");
 419       return;
 420     }
 421
 422   memset (&sa_serv, '\0', sizeof (sa_serv));
 423   sa_serv.sin_family = AF_INET;
 424   sa_serv.sin_addr.s_addr = INADDR_ANY;
 425   sa_serv.sin_port = htons (PORT);      /* Server Port number */
 426
 427   setsockopt (listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof (int));
 428
 429   err = bind (listen_sd, (SA *) & sa_serv, sizeof (sa_serv));
 430   if (err == -1)
 431     {
 432       perror ("bind");
 433       fail ("server: bind failed\n");
 434       return;
 435     }
 436
 437   err = listen (listen_sd, 1024);
 438   if (err == -1)
 439     {
 440       perror ("listen");
 441       fail ("server: listen failed\n");
 442       return;
 443     }
 444
 445   success ("server: ready. Listening to port '%d'\n", PORT);
 446 }
 447
 448 void
 449 server (void)
 450 {
 451   client_len = sizeof (sa_cli);
 452
 453   session = initialize_tls_session ();
 454
 455   sd = accept (listen_sd, (SA *) & sa_cli, &client_len);
 456
 457   success ("server: connection from %s, port %d\n",
 458            inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
 459                       sizeof (topbuf)), ntohs (sa_cli.sin_port));
 460
 461   gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
 462
 463   /* Enable TLS/IA. */
 464   gnutls_credentials_set (session, GNUTLS_CRD_IA, iacred);
 465   gnutls_ia_set_server_avp_function (iacred, server_avp);
 466
 467   ret = gnutls_handshake (session);
 468   if (ret < 0)
 469     {
 470       close (sd);
 471       gnutls_deinit (session);
 472       fail ("server: Handshake has failed (%s)\n\n", gnutls_strerror (ret));
 473       return;
 474     }
 475   success ("server: Handshake was completed\n");
 476
 477   if (!gnutls_ia_handshake_p (session))
 478     fail ("server: No TLS/IA negotiation\n");
 479   else
 480     {
 481       success ("server: TLS/IA handshake\n");
 482
 483       ret = gnutls_ia_handshake (session);
 484
 485       if (ret < 0)
 486         {
 487           fail ("server: TLS/IA handshake failed\n");
 488           gnutls_perror (ret);
 489           return;
 490         }
 491       else
 492         {
 493           success ("server: TLS/IA Handshake was completed\n");
 494         }
 495     }
 496
 497   /* see the Getting peer's information example */
 498   /* print_info(session); */
 499
 500   i = 0;
 501   for (;;)
 502     {
 503       bzero (buffer, MAX_BUF + 1);
 504       ret = gnutls_record_recv (session, buffer, MAX_BUF);
 505
 506       if (ret == 0)
 507         {
 508           success ("server: Peer has closed the GNUTLS connection\n");
 509           break;
 510         }
 511       else if (ret < 0)
 512         {
 513           if (ret == GNUTLS_E_FATAL_ALERT_RECEIVED)
 514             {
 515               gnutls_alert_description_t alert;
 516               const char *err;
 517               alert = gnutls_alert_get (session);
 518               err = gnutls_alert_get_name (alert);
 519               if (err)
 520                 printf ("Fatal alert: %s\n", err);
 521             }
 522
 523           fail ("server: Received corrupted data(%d). Closing...\n", ret);
 524           break;
 525         }
 526       else if (ret > 0)
 527         {
 528           /* echo data back to the client
 529            */
 530           gnutls_record_send (session, buffer, strlen (buffer));
 531         }
 532     }
 533   /* do not wait for the peer to close the connection.
 534    */
 535   gnutls_bye (session, GNUTLS_SHUT_WR);
 536
 537   close (sd);
 538   gnutls_deinit (session);
 539
 540   close (listen_sd);
 541
 542   gnutls_ia_free_server_credentials (iacred);
 543
 544   gnutls_anon_free_server_credentials (anoncred);
 545
 546   gnutls_global_deinit ();
 547
 548   success ("server: finished\n");
 549 }
 550
 551 void
 552 doit (void)
 553 {
 554   pid_t child;
 555
 556   server_start ();
 557   if (error_count)
 558     return;
 559
 560   child = fork ();
 561   if (child < 0)
 562     {
 563       perror ("fork");
 564       fail ("fork");
 565       return;
 566     }
 567
 568   if (child)
 569     {
 570       int status;
 571       /* parent */
 572       server ();
 573       wait (&status);
 574     }
 575   else
 576     client ();
 577 }