tests/mini-rsa-psk.c

   1 /*
   2  * Copyright (C) 2004-2012 Free Software Foundation, Inc.
   3  * Copyright (C) 2013 Adam Sampson <ats@offog.org>
   4  * Copyright (C) 2013 Nikos Mavrogiannopoulos
   5  *
   6  * Author: Nikos Mavrogiannopoulos
   7  *
   8  * This file is part of GnuTLS.
   9  *
  10  * GnuTLS is free software; you can redistribute it and/or modify it
  11  * under the terms of the GNU General Public License as published by
  12  * the Free Software Foundation; either version 3 of the License, or
  13  * (at your option) any later version.
  14  *
  15  * GnuTLS is distributed in the hope that it will be useful, but
  16  * WITHOUT ANY WARRANTY; without even the implied warranty of
  17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18  * General Public License for more details.
  19  *
  20  * You should have received a copy of the GNU General Public License
  21  * along with GnuTLS; if not, write to the Free Software Foundation,
  22  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  23  */
  24
  25 /* Parts copied from GnuTLS example programs. */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include <config.h>
  29 #endif
  30
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33
  34 #if defined(_WIN32)
  35
  36 /* socketpair isn't supported on Win32. */
  37 int main(int argc, char **argv)
  38 {
  39         exit(77);
  40 }
  41
  42 #else
  43
  44 #include <string.h>
  45 #include <sys/types.h>
  46 #include <sys/socket.h>
  47 #if !defined(_WIN32)
  48 #include <sys/wait.h>
  49 #endif
  50 #include <unistd.h>
  51 #include <gnutls/gnutls.h>
  52
  53 #include "utils.h"
  54
  55 /* A very basic TLS client, with PSK authentication.
  56  */
  57
  58 const char *side = "";
  59
  60 static void tls_log_func(int level, const char *str)
  61 {
  62         fprintf(stderr, "%s|<%d>| %s", side, level, str);
  63 }
  64
  65 #define MAX_BUF 1024
  66 #define MSG "Hello TLS"
  67
  68 static void client(int sd)
  69 {
  70         int ret, ii;
  71         gnutls_session_t session;
  72         gnutls_certificate_credentials_t clientx509cred;
  73         char buffer[MAX_BUF + 1];
  74         gnutls_psk_client_credentials_t pskcred;
  75         /* Need to enable anonymous KX specifically. */
  76         const gnutls_datum_t key = { (void *) "DEADBEEF", 8 };
  77
  78         global_init();
  79         gnutls_global_set_log_function(tls_log_func);
  80         if (debug)
  81                 gnutls_global_set_log_level(4711);
  82
  83         side = "client";
  84
  85         gnutls_certificate_allocate_credentials(&clientx509cred);
  86
  87         gnutls_psk_allocate_client_credentials(&pskcred);
  88         gnutls_psk_set_client_credentials(pskcred, "test", &key,
  89                                           GNUTLS_PSK_KEY_HEX);
  90
  91         /* Initialize TLS session
  92          */
  93         gnutls_init(&session, GNUTLS_CLIENT);
  94
  95         /* Use default priorities */
  96         gnutls_priority_set_direct(session, "NORMAL:-KX-ALL:+RSA-PSK",
  97                                    NULL);
  98
  99         /* put the anonymous credentials to the current session
 100          */
 101         gnutls_credentials_set(session, GNUTLS_CRD_PSK, pskcred);
 102         gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE,
 103                                clientx509cred);
 104
 105         gnutls_transport_set_int(session, sd);
 106
 107         /* Perform the TLS handshake
 108          */
 109         ret = gnutls_handshake(session);
 110
 111         if (ret < 0) {
 112                 fail("client: Handshake failed\n");
 113                 gnutls_perror(ret);
 114                 goto end;
 115         } else {
 116                 if (debug)
 117                         success("client: Handshake was completed\n");
 118         }
 119
 120         gnutls_record_send(session, MSG, strlen(MSG));
 121
 122         ret = gnutls_record_recv(session, buffer, MAX_BUF);
 123         if (ret == 0) {
 124                 if (debug)
 125                         success
 126                             ("client: Peer has closed the TLS connection\n");
 127                 goto end;
 128         } else if (ret < 0) {
 129                 fail("client: Error: %s\n", gnutls_strerror(ret));
 130                 goto end;
 131         }
 132
 133         if (debug) {
 134                 printf("- Received %d bytes: ", ret);
 135                 for (ii = 0; ii < ret; ii++) {
 136                         fputc(buffer[ii], stdout);
 137                 }
 138                 fputs("\n", stdout);
 139         }
 140
 141         gnutls_bye(session, GNUTLS_SHUT_RDWR);
 142
 143       end:
 144
 145         close(sd);
 146
 147         gnutls_deinit(session);
 148
 149         gnutls_psk_free_client_credentials(pskcred);
 150         gnutls_certificate_free_credentials(clientx509cred);
 151
 152         gnutls_global_deinit();
 153 }
 154
 155 /* This is a sample TLS 1.0 echo server, for PSK authentication.
 156  */
 157
 158 #define MAX_BUF 1024
 159
 160 static unsigned char server_cert_pem[] =
 161     "-----BEGIN CERTIFICATE-----\n"
 162     "MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
 163     "VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
 164     "GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
 165     "Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
 166     "dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
 167     "DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
 168     "tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
 169     "MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
 170     "Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
 171     "GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
 172     "bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
 173     "AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
 174     "rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
 175
 176 const gnutls_datum_t server_cert = { server_cert_pem,
 177         sizeof(server_cert_pem)
 178 };
 179
 180 static unsigned char server_key_pem[] =
 181     "-----BEGIN RSA PRIVATE KEY-----\n"
 182     "MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
 183     "TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
 184     "fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
 185     "AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
 186     "8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
 187     "iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
 188     "Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
 189     "oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
 190     "XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
 191     "qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
 192     "tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
 193     "hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
 194     "LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
 195     "-----END RSA PRIVATE KEY-----\n";
 196
 197 const gnutls_datum_t server_key = { server_key_pem,
 198         sizeof(server_key_pem)
 199 };
 200
 201 static int
 202 pskfunc(gnutls_session_t session, const char *username,
 203         gnutls_datum_t * key)
 204 {
 205         if (debug)
 206                 printf("psk: username %s\n", username);
 207         key->data = gnutls_malloc(4);
 208         key->data[0] = 0xDE;
 209         key->data[1] = 0xAD;
 210         key->data[2] = 0xBE;
 211         key->data[3] = 0xEF;
 212         key->size = 4;
 213         return 0;
 214 }
 215
 216 int err, ret;
 217 char topbuf[512];
 218 gnutls_session_t session;
 219 char buffer[MAX_BUF + 1];
 220 int optval = 1;
 221
 222 static void server(int sd)
 223 {
 224         gnutls_certificate_credentials_t serverx509cred;
 225         gnutls_psk_server_credentials_t server_pskcred;
 226
 227         /* this must be called once in the program
 228          */
 229         global_init();
 230         gnutls_global_set_log_function(tls_log_func);
 231         if (debug)
 232                 gnutls_global_set_log_level(4711);
 233
 234         side = "server";
 235
 236         gnutls_psk_allocate_server_credentials(&server_pskcred);
 237         gnutls_psk_set_server_credentials_function(server_pskcred,
 238                                                    pskfunc);
 239         gnutls_psk_set_server_credentials_hint(server_pskcred, "hint");
 240         gnutls_certificate_allocate_credentials(&serverx509cred);
 241         gnutls_certificate_set_x509_key_mem(serverx509cred,
 242                                             &server_cert, &server_key,
 243                                             GNUTLS_X509_FMT_PEM);
 244
 245         gnutls_init(&session, GNUTLS_SERVER);
 246
 247         /* avoid calling all the priority functions, since the defaults
 248          * are adequate.
 249          */
 250         gnutls_priority_set_direct(session, "NORMAL:-KX-ALL:+RSA-PSK",
 251                                    NULL);
 252
 253
 254         gnutls_credentials_set(session, GNUTLS_CRD_PSK, server_pskcred);
 255         gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE,
 256                                serverx509cred);
 257
 258         gnutls_transport_set_int(session, sd);
 259         ret = gnutls_handshake(session);
 260         if (ret < 0) {
 261                 close(sd);
 262                 gnutls_deinit(session);
 263                 fail("server: Handshake has failed (%s)\n\n",
 264                      gnutls_strerror(ret));
 265                 return;
 266         }
 267         if (debug)
 268                 success("server: Handshake was completed\n");
 269
 270         /* see the Getting peer's information example */
 271         /* print_info(session); */
 272
 273         for (;;) {
 274                 memset(buffer, 0, MAX_BUF + 1);
 275                 ret = gnutls_record_recv(session, buffer, MAX_BUF);
 276
 277                 if (ret == 0) {
 278                         if (debug)
 279                                 success
 280                                     ("server: Peer has closed the GnuTLS connection\n");
 281                         break;
 282                 } else if (ret < 0) {
 283                         fail("server: Received corrupted data(%d). Closing...\n", ret);
 284                         break;
 285                 } else if (ret > 0) {
 286                         /* echo data back to the client
 287                          */
 288                         gnutls_record_send(session, buffer,
 289                                            strlen(buffer));
 290                 }
 291         }
 292         /* do not wait for the peer to close the connection.
 293          */
 294         gnutls_bye(session, GNUTLS_SHUT_WR);
 295
 296         close(sd);
 297         gnutls_deinit(session);
 298
 299         gnutls_psk_free_server_credentials(server_pskcred);
 300         gnutls_certificate_free_credentials(serverx509cred);
 301
 302         gnutls_global_deinit();
 303
 304         if (debug)
 305                 success("server: finished\n");
 306 }
 307
 308 void doit(void)
 309 {
 310         pid_t child;
 311         int sockets[2];
 312
 313         err = socketpair(AF_UNIX, SOCK_STREAM, 0, sockets);
 314         if (err == -1) {
 315                 perror("socketpair");
 316                 fail("socketpair failed\n");
 317                 return;
 318         }
 319
 320         child = fork();
 321         if (child < 0) {
 322                 perror("fork");
 323                 fail("fork");
 324                 return;
 325         }
 326
 327         if (child) {
 328                 int status;
 329                 /* parent */
 330                 server(sockets[0]);
 331                 wait(&status);
 332         } else
 333                 client(sockets[1]);
 334 }
 335
 336 #endif                          /* _WIN32 */