tests/openpgp-auth.c

   1 /*
   2  * Copyright (C) 2010-2012 Free Software Foundation, Inc.
   3  * Author: Ludovic Courtès
   4  *
   5  * This file is part of GNUTLS.
   6  *
   7  * GNUTLS is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * GNUTLS is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with GNUTLS; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include <config.h>
  24 #endif
  25
  26 #include <gnutls/gnutls.h>
  27 #include <gnutls/openpgp.h>
  28
  29 #include "utils.h"
  30 #include <read-file.h>
  31
  32 #include <unistd.h>
  33 #include <stdlib.h>
  34 #include <sys/types.h>
  35 #include <sys/socket.h>
  36 #if !defined(_WIN32)
  37 #include <sys/wait.h>
  38 #endif
  39 #include <string.h>
  40 #include <errno.h>
  41 #include <stdio.h>
  42 #if !defined(_WIN32)
  43 static const char message[] = "Hello, brave GNU world!";
  44
  45 /* The OpenPGP key pair for use and the key ID in those keys.  */
  46 static const char pub_key_file[] = "../guile/tests/openpgp-pub.asc";
  47 static const char priv_key_file[] = "../guile/tests/openpgp-sec.asc";
  48 static const char *key_id = NULL;
  49 static gnutls_datum_t stored_cli_cert = { NULL, 0 };
  50
  51 static void log_message(int level, const char *message)
  52 {
  53         fprintf(stderr, "[%5d|%2d] %s", getpid(), level, message);
  54 }
  55
  56 static
  57 int key_recv_func(gnutls_session_t session, const unsigned char *keyfpr,
  58                   unsigned int keyfpr_length, gnutls_datum_t * key)
  59 {
  60         key->data = gnutls_malloc(stored_cli_cert.size);
  61         memcpy(key->data, stored_cli_cert.data, stored_cli_cert.size);
  62         key->size = stored_cli_cert.size;
  63
  64         return 0;
  65 }
  66
  67 void doit()
  68 {
  69         int err, i;
  70         int sockets[2];
  71         const char *srcdir;
  72         pid_t child;
  73         char pub_key_path[512], priv_key_path[512];
  74
  75         global_init();
  76
  77         srcdir = getenv("srcdir") ? getenv("srcdir") : ".";
  78
  79         for (i = 0; i < 5; i++) {
  80                 if (i <= 1)
  81                         key_id = NULL;  /* try using the master key */
  82                 else if (i == 2)
  83                         key_id = "auto";        /* test auto */
  84                 else if (i >= 3)
  85                         key_id = "f30fd423c143e7ba";
  86
  87                 if (debug) {
  88                         gnutls_global_set_log_level(5);
  89                         gnutls_global_set_log_function(log_message);
  90                 }
  91
  92                 err = socketpair(AF_UNIX, SOCK_STREAM, 0, sockets);
  93                 if (err != 0)
  94                         fail("socketpair %s\n", strerror(errno));
  95
  96                 if (sizeof(pub_key_path) <
  97                     strlen(srcdir) + strlen(pub_key_file) + 2)
  98                         abort();
  99
 100                 strcpy(pub_key_path, srcdir);
 101                 strcat(pub_key_path, "/");
 102                 strcat(pub_key_path, pub_key_file);
 103
 104                 if (sizeof(priv_key_path) <
 105                     strlen(srcdir) + strlen(priv_key_file) + 2)
 106                         abort();
 107
 108                 strcpy(priv_key_path, srcdir);
 109                 strcat(priv_key_path, "/");
 110                 strcat(priv_key_path, priv_key_file);
 111
 112                 child = fork();
 113                 if (child == -1)
 114                         fail("fork %s\n", strerror(errno));
 115
 116                 if (child == 0) {
 117                         /* Child process (client).  */
 118                         gnutls_session_t session;
 119                         gnutls_certificate_credentials_t cred;
 120                         ssize_t sent;
 121
 122                         if (debug)
 123                                 printf("client process %i\n", getpid());
 124
 125                         err = gnutls_init(&session, GNUTLS_CLIENT);
 126                         if (err != 0)
 127                                 fail("client session %d\n", err);
 128
 129                         if (i == 0)     /* we use the primary key which is RSA. Test the RSA ciphersuite */
 130                                 gnutls_priority_set_direct(session,
 131                                                            "NONE:+VERS-TLS1.0:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+RSA:+CTYPE-OPENPGP",
 132                                                            NULL);
 133                         else
 134                                 gnutls_priority_set_direct(session,
 135                                                            "NONE:+VERS-TLS1.0:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+DHE-DSS:+DHE-RSA:+CTYPE-OPENPGP",
 136                                                            NULL);
 137                         gnutls_transport_set_int(session, sockets[0]);
 138
 139                         err =
 140                             gnutls_certificate_allocate_credentials(&cred);
 141                         if (err != 0)
 142                                 fail("client credentials %d\n", err);
 143
 144                         err =
 145                             gnutls_certificate_set_openpgp_key_file2(cred,
 146                                                                      pub_key_path,
 147                                                                      priv_key_path,
 148                                                                      key_id,
 149                                                                      GNUTLS_OPENPGP_FMT_BASE64);
 150                         if (err != 0)
 151                                 fail("client openpgp keys %s\n",
 152                                      gnutls_strerror(err));
 153
 154                         err =
 155                             gnutls_credentials_set(session,
 156                                                    GNUTLS_CRD_CERTIFICATE,
 157                                                    cred);
 158                         if (err != 0)
 159                                 fail("client credential_set %d\n", err);
 160
 161                         gnutls_dh_set_prime_bits(session, 1024);
 162
 163                         if (i == 4)
 164                                 gnutls_openpgp_send_cert(session,
 165                                                          GNUTLS_OPENPGP_CERT_FINGERPRINT);
 166
 167                         err = gnutls_handshake(session);
 168                         if (err != 0)
 169                                 fail("client handshake %s (%d) \n",
 170                                      gnutls_strerror(err), err);
 171                         else if (debug)
 172                                 printf("client handshake successful\n");
 173
 174                         sent =
 175                             gnutls_record_send(session, message,
 176                                                sizeof(message));
 177                         if (sent != sizeof(message))
 178                                 fail("client sent %li vs. %li\n",
 179                                      (long) sent, (long) sizeof(message));
 180
 181                         err = gnutls_bye(session, GNUTLS_SHUT_RDWR);
 182                         if (err != 0)
 183                                 fail("client bye %d\n", err);
 184
 185                         if (debug)
 186                                 printf("client done\n");
 187
 188                         gnutls_deinit(session);
 189                         gnutls_certificate_free_credentials(cred);
 190                         gnutls_free(stored_cli_cert.data);
 191                         gnutls_global_deinit();
 192                         return;
 193                 } else {
 194                         /* Parent process (server).  */
 195                         gnutls_session_t session;
 196                         gnutls_dh_params_t dh_params;
 197                         gnutls_certificate_credentials_t cred;
 198                         char greetings[sizeof(message) * 2];
 199                         ssize_t received;
 200                         pid_t done;
 201                         int status;
 202                         const gnutls_datum_t p3 =
 203                             { (void *) pkcs3, strlen(pkcs3) };
 204
 205                         if (debug)
 206                                 printf("server process %i (child %i)\n",
 207                                        getpid(), child);
 208
 209                         err = gnutls_init(&session, GNUTLS_SERVER);
 210                         if (err != 0)
 211                                 fail("server session %d\n", err);
 212
 213                         gnutls_priority_set_direct(session,
 214                                                    "NONE:+VERS-TLS1.0:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+DHE-DSS:+DHE-RSA:+RSA:+CTYPE-OPENPGP",
 215                                                    NULL);
 216                         gnutls_transport_set_int(session, sockets[1]);
 217
 218                         err =
 219                             gnutls_certificate_allocate_credentials(&cred);
 220                         if (err != 0)
 221                                 fail("server credentials %d\n", err);
 222
 223                         err =
 224                             gnutls_certificate_set_openpgp_key_file2(cred,
 225                                                                      pub_key_path,
 226                                                                      priv_key_path,
 227                                                                      key_id,
 228                                                                      GNUTLS_OPENPGP_FMT_BASE64);
 229                         if (err != 0)
 230                                 fail("server openpgp keys %s\n",
 231                                      gnutls_strerror(err));
 232
 233                         err = gnutls_dh_params_init(&dh_params);
 234                         if (err)
 235                                 fail("server DH params init %d\n", err);
 236
 237                         err =
 238                             gnutls_dh_params_import_pkcs3(dh_params, &p3,
 239                                                           GNUTLS_X509_FMT_PEM);
 240                         if (err)
 241                                 fail("server DH params generate %d\n",
 242                                      err);
 243
 244                         gnutls_certificate_set_dh_params(cred, dh_params);
 245
 246                         err =
 247                             gnutls_credentials_set(session,
 248                                                    GNUTLS_CRD_CERTIFICATE,
 249                                                    cred);
 250                         if (err != 0)
 251                                 fail("server credential_set %d\n", err);
 252
 253                         gnutls_certificate_server_set_request(session,
 254                                                               GNUTLS_CERT_REQUIRE);
 255
 256                         if (i == 4)
 257                                 gnutls_openpgp_set_recv_key_function
 258                                     (session, key_recv_func);
 259
 260                         err = gnutls_handshake(session);
 261                         if (err != 0)
 262                                 fail("server handshake %s (%d) \n",
 263                                      gnutls_strerror(err), err);
 264
 265                         if (stored_cli_cert.data == NULL) {
 266                                 const gnutls_datum_t *d;
 267                                 unsigned int d_size;
 268                                 d = gnutls_certificate_get_peers(session,
 269                                                                  &d_size);
 270                                 if (d != NULL) {
 271                                         stored_cli_cert.data =
 272                                             gnutls_malloc(d[0].size);
 273                                         memcpy(stored_cli_cert.data,
 274                                                d[0].data, d[0].size);
 275                                         stored_cli_cert.size = d[0].size;
 276                                 }
 277                         }
 278
 279                         received =
 280                             gnutls_record_recv(session, greetings,
 281                                                sizeof(greetings));
 282                         if (received != sizeof(message)
 283                             || memcmp(greetings, message, sizeof(message)))
 284                                 fail("server received %li vs. %li\n",
 285                                      (long) received,
 286                                      (long) sizeof(message));
 287
 288                         err = gnutls_bye(session, GNUTLS_SHUT_RDWR);
 289                         if (err != 0)
 290                                 fail("server bye %s (%d) \n",
 291                                      gnutls_strerror(err), err);
 292
 293                         if (debug)
 294                                 printf("server done\n");
 295
 296                         gnutls_deinit(session);
 297                         gnutls_certificate_free_credentials(cred);
 298                         gnutls_dh_params_deinit(dh_params);
 299
 300                         done = wait(&status);
 301                         if (done < 0)
 302                                 fail("wait %s\n", strerror(errno));
 303
 304                         if (done != child)
 305                                 fail("who's that?! %d\n", done);
 306
 307                         if (WIFEXITED(status)) {
 308                                 if (WEXITSTATUS(status) != 0)
 309                                         fail("child exited with status %d\n", WEXITSTATUS(status));
 310                         } else if (WIFSIGNALED(status))
 311                                 fail("child stopped by signal %d\n",
 312                                      WTERMSIG(status));
 313                         else
 314                                 fail("child failed: %d\n", status);
 315                 }
 316         }
 317
 318         gnutls_free(stored_cli_cert.data);
 319         gnutls_global_deinit();
 320 }
 321 #else
 322 void doit()
 323 {
 324         exit(77);
 325 }
 326 #endif