2 * Copyright (C) 2004-2012 Free Software Foundation, Inc.
4 * Author: Nikos Mavrogiannopoulos
6 * This file is part of GnuTLS.
8 * GnuTLS is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * GnuTLS is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with GnuTLS; if not, write to the Free Software Foundation,
20 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
23 /* Parts copied from GnuTLS example programs. */
32 #include <sys/types.h>
33 #include <sys/socket.h>
36 #include <netinet/in.h>
37 #include <arpa/inet.h>
40 #include <gnutls/gnutls.h>
55 static void wrap_db_init (void);
56 static void wrap_db_deinit (void);
57 static int wrap_db_store (void *dbf, gnutls_datum_t key, gnutls_datum_t data);
58 static gnutls_datum_t wrap_db_fetch (void *dbf, gnutls_datum_t key);
59 static int wrap_db_delete (void *dbf, gnutls_datum_t key);
61 #define TLS_SESSION_CACHE 50
67 int enable_session_ticket_server;
68 int enable_session_ticket_client;
74 struct params_res resume_tests[] = {
75 {"try to resume from db", 50, 0, 0, 1},
76 {"try to resume from session ticket", 0, 1, 1, 1},
77 {"try to resume from session ticket (server only)", 0, 1, 0, 0},
78 {"try to resume from session ticket (client only)", 0, 0, 1, 0},
82 /* A very basic TLS client, with anonymous authentication.
85 #define MAX_BUF 5*1024
86 #define MSG "Hello TLS"
89 tls_log_func (int level, const char *str)
91 fprintf (stderr, "%s |<%d>| %s", child ? "server" : "client", level, str);
95 client (struct params_res *params)
98 gnutls_session_t session;
99 char buffer[MAX_BUF + 1];
100 gnutls_anon_client_credentials_t anoncred;
101 /* Need to enable anonymous KX specifically. */
103 /* variables used in session resuming
106 gnutls_datum_t session_data;
110 gnutls_global_set_log_function (tls_log_func);
111 gnutls_global_set_log_level (2);
113 gnutls_global_init ();
115 gnutls_anon_allocate_client_credentials (&anoncred);
117 for (t = 0; t < 2; t++)
118 { /* connect 2 times to the server */
119 /* connect to the peer
123 /* Initialize TLS session
125 gnutls_init (&session, GNUTLS_CLIENT|GNUTLS_DATAGRAM);
127 /* Use default priorities */
128 gnutls_priority_set_direct (session, "NONE:+VERS-DTLS1.0:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+ANON-DH", NULL);
130 /* put the anonymous credentials to the current session
132 gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
134 if (params->enable_session_ticket_client)
135 gnutls_session_ticket_enable_client (session);
139 /* if this is not the first time we connect */
140 gnutls_session_set_data (session, session_data.data,
142 gnutls_free (session_data.data);
145 gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
147 /* Perform the TLS handshake
149 ret = gnutls_handshake (session);
153 fail ("client: Handshake failed\n");
160 success ("client: Handshake was completed\n");
164 { /* the first time we connect */
165 /* get the session data size */
166 ret = gnutls_session_get_data2 (session, &session_data);
168 fail ("Getting resume data failed\n");
171 { /* the second time we connect */
173 /* check if we actually resumed the previous session */
174 if (gnutls_session_is_resumed (session) != 0)
176 if (params->expect_resume)
179 success ("- Previous session was resumed\n");
182 fail ("- Previous session was resumed\n");
186 if (params->expect_resume)
188 fail ("*** Previous session was NOT resumed\n");
194 ("*** Previous session was NOT resumed (expected)\n");
199 gnutls_record_send (session, MSG, strlen (MSG));
201 ret = gnutls_record_recv (session, buffer, MAX_BUF);
205 success ("client: Peer has closed the TLS connection\n");
210 fail ("client: Error: %s\n", gnutls_strerror (ret));
216 printf ("- Received %d bytes: ", ret);
217 for (ii = 0; ii < ret; ii++)
219 fputc (buffer[ii], stdout);
221 fputs ("\n", stdout);
224 gnutls_bye (session, GNUTLS_SHUT_RDWR);
229 gnutls_deinit (session);
233 gnutls_anon_free_client_credentials (anoncred);
236 /* This is a sample TLS 1.0 echo server, for anonymous authentication only.
239 #define SA struct sockaddr
240 #define PORT 5556 /* listen to 5556 port */
243 /* These are global */
244 gnutls_anon_server_credentials_t anoncred;
245 static gnutls_datum_t session_ticket_key = { NULL, 0 };
247 static gnutls_session_t
248 initialize_tls_session (struct params_res *params)
250 gnutls_session_t session;
252 gnutls_init (&session, GNUTLS_SERVER|GNUTLS_DATAGRAM);
254 /* avoid calling all the priority functions, since the defaults
257 gnutls_priority_set_direct (session, "NONE:+VERS-DTLS1.0:+CIPHER-ALL:+MAC-ALL:+SIGN-ALL:+COMP-ALL:+ANON-DH", NULL);
259 gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
261 gnutls_dh_set_prime_bits (session, DH_BITS);
263 if (params->enable_db)
265 gnutls_db_set_retrieve_function (session, wrap_db_fetch);
266 gnutls_db_set_remove_function (session, wrap_db_delete);
267 gnutls_db_set_store_function (session, wrap_db_store);
268 gnutls_db_set_ptr (session, NULL);
271 if (params->enable_session_ticket_server)
272 gnutls_session_ticket_enable_server (session, &session_ticket_key);
277 static gnutls_dh_params_t dh_params;
280 generate_dh_params (void)
282 const gnutls_datum_t p3 = { (void *) pkcs3, strlen (pkcs3) };
283 /* Generate Diffie-Hellman parameters - for use with DHE
284 * kx algorithms. These should be discarded and regenerated
285 * once a day, once a week or once a month. Depending on the
286 * security requirements.
288 gnutls_dh_params_init (&dh_params);
289 return gnutls_dh_params_import_pkcs3 (dh_params, &p3, GNUTLS_X509_FMT_PEM);
292 int err, listen_sd, i;
294 struct sockaddr_in sa_serv;
295 struct sockaddr_in sa_cli;
296 socklen_t client_len;
298 gnutls_session_t session;
299 char buffer[MAX_BUF + 1];
307 listen_sd = socket (AF_INET, SOCK_STREAM, 0);
311 fail ("server: socket failed\n");
315 memset (&sa_serv, '\0', sizeof (sa_serv));
316 sa_serv.sin_family = AF_INET;
317 sa_serv.sin_addr.s_addr = INADDR_ANY;
318 sa_serv.sin_port = htons (PORT); /* Server Port number */
320 setsockopt (listen_sd, SOL_SOCKET, SO_REUSEADDR, (void *) &optval,
323 err = bind (listen_sd, (SA *) & sa_serv, sizeof (sa_serv));
327 fail ("server: bind failed\n");
331 err = listen (listen_sd, 1024);
335 fail ("server: listen failed\n");
340 success ("server: ready. Listening to port '%d'.\n", PORT);
347 success ("global stop\n");
349 gnutls_anon_free_server_credentials (anoncred);
351 gnutls_dh_params_deinit (dh_params);
353 gnutls_global_deinit ();
355 shutdown (listen_sd, SHUT_RDWR);
359 server (struct params_res *params)
363 /* this must be called once in the program, it is mostly for the server.
367 gnutls_global_set_log_function (tls_log_func);
368 gnutls_global_set_log_level (2);
371 gnutls_global_init ();
372 gnutls_anon_allocate_server_credentials (&anoncred);
375 success ("Launched, generating DH parameters...\n");
377 generate_dh_params ();
379 gnutls_anon_set_server_dh_params (anoncred, dh_params);
381 if (params->enable_db)
386 if (params->enable_session_ticket_server)
387 gnutls_session_ticket_key_generate (&session_ticket_key);
389 for (t = 0; t < 2; t++)
391 client_len = sizeof (sa_cli);
393 session = initialize_tls_session (params);
395 sd = accept (listen_sd, (SA *) & sa_cli, &client_len);
398 success ("server: connection from %s, port %d\n",
399 inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
400 sizeof (topbuf)), ntohs (sa_cli.sin_port));
402 gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
403 ret = gnutls_handshake (session);
407 gnutls_deinit (session);
408 fail ("server: Handshake has failed (%s)\n\n",
409 gnutls_strerror (ret));
413 success ("server: Handshake was completed\n");
415 /* see the Getting peer's information example */
416 /* print_info(session); */
421 memset (buffer, 0, MAX_BUF + 1);
422 ret = gnutls_record_recv (session, buffer, MAX_BUF);
427 success ("server: Peer has closed the GnuTLS connection\n");
432 fail ("server: Received corrupted data(%d). Closing...\n", ret);
437 /* echo data back to the client
439 gnutls_record_send (session, buffer, strlen (buffer));
442 /* do not wait for the peer to close the connection.
444 gnutls_bye (session, GNUTLS_SHUT_WR);
448 gnutls_deinit (session);
453 if (params->enable_db)
458 gnutls_free (session_ticket_key.data);
459 session_ticket_key.data = NULL;
462 success ("server: finished\n");
470 for (i = 0; resume_tests[i].desc; i++)
472 printf ("%s\n", resume_tests[i].desc);
490 server (&resume_tests[i]);
492 if (WEXITSTATUS(status) > 0)
498 client (&resume_tests[i]);
499 gnutls_global_deinit ();
507 /* Functions and other stuff needed for session resuming.
508 * This is done using a very simple list which holds session ids
512 #define MAX_SESSION_ID_SIZE 32
513 #define MAX_SESSION_DATA_SIZE 1024
517 unsigned char session_id[MAX_SESSION_ID_SIZE];
518 unsigned int session_id_size;
520 char session_data[MAX_SESSION_DATA_SIZE];
521 int session_data_size;
524 static CACHE *cache_db;
525 static int cache_db_ptr = 0;
531 /* allocate cache_db */
532 cache_db = calloc (1, TLS_SESSION_CACHE * sizeof (CACHE));
536 wrap_db_deinit (void)
544 wrap_db_store (void *dbf, gnutls_datum_t key, gnutls_datum_t data)
547 success ("resume db storing... (%d-%d)\n", key.size, data.size);
553 for (i = 0; i < key.size; i++)
555 printf ("%02x ", key.data[i] & 0xFF);
556 if ((i + 1) % 16 == 0)
561 for (i = 0; i < data.size; i++)
563 printf ("%02x ", data.data[i] & 0xFF);
564 if ((i + 1) % 16 == 0)
570 if (cache_db == NULL)
573 if (key.size > MAX_SESSION_ID_SIZE)
576 if (data.size > MAX_SESSION_DATA_SIZE)
579 memcpy (cache_db[cache_db_ptr].session_id, key.data, key.size);
580 cache_db[cache_db_ptr].session_id_size = key.size;
582 memcpy (cache_db[cache_db_ptr].session_data, data.data, data.size);
583 cache_db[cache_db_ptr].session_data_size = data.size;
586 cache_db_ptr %= TLS_SESSION_CACHE;
591 static gnutls_datum_t
592 wrap_db_fetch (void *dbf, gnutls_datum_t key)
594 gnutls_datum_t res = { NULL, 0 };
598 success ("resume db fetch... (%d)\n", key.size);
603 for (i = 0; i < key.size; i++)
605 printf ("%02x ", key.data[i] & 0xFF);
606 if ((i + 1) % 16 == 0)
612 if (cache_db == NULL)
615 for (i = 0; i < TLS_SESSION_CACHE; i++)
617 if (key.size == cache_db[i].session_id_size &&
618 memcmp (key.data, cache_db[i].session_id, key.size) == 0)
621 success ("resume db fetch... return info\n");
623 res.size = cache_db[i].session_data_size;
625 res.data = gnutls_malloc (res.size);
626 if (res.data == NULL)
629 memcpy (res.data, cache_db[i].session_data, res.size);
635 for (i = 0; i < res.size; i++)
637 printf ("%02x ", res.data[i] & 0xFF);
638 if ((i + 1) % 16 == 0)
649 success ("resume db fetch... NOT FOUND\n");
654 wrap_db_delete (void *dbf, gnutls_datum_t key)
658 if (cache_db == NULL)
661 for (i = 0; i < TLS_SESSION_CACHE; i++)
663 if (key.size == cache_db[i].session_id_size &&
664 memcmp (key.data, cache_db[i].session_id, key.size) == 0)
667 cache_db[i].session_id_size = 0;
668 cache_db[i].session_data_size = 0;