*/
void check_alert(gnutls_session_t session, int ret)
{
- int last_alert;
+ int last_alert;
- if (ret == GNUTLS_E_WARNING_ALERT_RECEIVED
- || ret == GNUTLS_E_FATAL_ALERT_RECEIVED) {
- last_alert = gnutls_alert_get(session);
+ if (ret == GNUTLS_E_WARNING_ALERT_RECEIVED
+ || ret == GNUTLS_E_FATAL_ALERT_RECEIVED) {
+ last_alert = gnutls_alert_get(session);
- /* The check for renegotiation is only useful if we are
- * a server, and we had requested a rehandshake.
- */
- if (last_alert == GNUTLS_A_NO_RENEGOTIATION &&
- ret == GNUTLS_E_WARNING_ALERT_RECEIVED)
- printf("* Received NO_RENEGOTIATION alert. "
- "Client Does not support renegotiation.\n");
- else
- printf("* Received alert '%d': %s.\n", last_alert,
- gnutls_alert_get_name(last_alert));
- }
+ /* The check for renegotiation is only useful if we are
+ * a server, and we had requested a rehandshake.
+ */
+ if (last_alert == GNUTLS_A_NO_RENEGOTIATION &&
+ ret == GNUTLS_E_WARNING_ALERT_RECEIVED)
+ printf("* Received NO_RENEGOTIATION alert. "
+ "Client Does not support renegotiation.\n");
+ else
+ printf("* Received alert '%d': %s.\n", last_alert,
+ gnutls_alert_get_name(last_alert));
+ }
}
-
#define CAFILE "ca.pem"
static int cert_callback(gnutls_session_t session,
- const gnutls_datum_t* req_ca_rdn, int nreqs,
- const gnutls_pk_algorithm_t* sign_algos, int sign_algos_length,
- gnutls_retr_st * st);
+ const gnutls_datum_t * req_ca_rdn, int nreqs,
+ const gnutls_pk_algorithm_t * sign_algos,
+ int sign_algos_length, gnutls_retr_st * st);
gnutls_x509_crt_t crt;
gnutls_x509_privkey_t key;
/* Helper functions to load a certificate and key
* files into memory. They use mmap for simplicity.
*/
-static gnutls_datum_t mmap_file( const char* file)
+static gnutls_datum_t mmap_file(const char *file)
{
-int fd;
-gnutls_datum_t mmaped_file = { NULL, 0 };
-struct stat stat_st;
-void* ptr;
-
- fd = open( file, 0);
- if (fd==-1) return mmaped_file;
-
- fstat( fd, &stat_st);
-
- if ((ptr=mmap( NULL, stat_st.st_size, PROT_READ, MAP_SHARED, fd, 0)) == MAP_FAILED)
- return mmaped_file;
-
- mmaped_file.data = ptr;
- mmaped_file.size = stat_st.st_size;
-
- return mmaped_file;
+ int fd;
+ gnutls_datum_t mmaped_file = { NULL, 0 };
+ struct stat stat_st;
+ void *ptr;
+
+ fd = open(file, 0);
+ if (fd == -1)
+ return mmaped_file;
+
+ fstat(fd, &stat_st);
+
+ if ((ptr =
+ mmap(NULL, stat_st.st_size, PROT_READ, MAP_SHARED, fd,
+ 0)) == MAP_FAILED)
+ return mmaped_file;
+
+ mmaped_file.data = ptr;
+ mmaped_file.size = stat_st.st_size;
+
+ return mmaped_file;
}
-static void munmap_file( gnutls_datum_t data)
+static void munmap_file(gnutls_datum_t data)
{
- munmap( data.data, data.size);
+ munmap(data.data, data.size);
}
/* Load the certificate and the private key.
*/
-static void load_keys( void)
+static void load_keys(void)
{
-int ret;
-gnutls_datum_t data;
-
- data = mmap_file( CERT_FILE);
- if (data.data == NULL) {
- fprintf(stderr, "*** Error loading cert file.\n");
- exit(1);
- }
- gnutls_x509_crt_init( &crt);
-
- ret = gnutls_x509_crt_import( crt, &data, GNUTLS_X509_FMT_PEM);
- if (ret < 0) {
- fprintf(stderr, "*** Error loading key file: %s\n", gnutls_strerror(ret));
- exit(1);
- }
-
- munmap_file( data);
-
- data = mmap_file( KEY_FILE);
- if (data.data == NULL) {
- fprintf(stderr, "*** Error loading key file.\n");
- exit(1);
- }
-
- gnutls_x509_privkey_init( &key);
-
- ret = gnutls_x509_privkey_import( key, &data, GNUTLS_X509_FMT_PEM);
- if (ret < 0) {
- fprintf(stderr, "*** Error loading key file: %s\n", gnutls_strerror(ret));
- exit(1);
- }
-
- munmap_file( data);
-
+ int ret;
+ gnutls_datum_t data;
+
+ data = mmap_file(CERT_FILE);
+ if (data.data == NULL) {
+ fprintf(stderr, "*** Error loading cert file.\n");
+ exit(1);
+ }
+ gnutls_x509_crt_init(&crt);
+
+ ret = gnutls_x509_crt_import(crt, &data, GNUTLS_X509_FMT_PEM);
+ if (ret < 0) {
+ fprintf(stderr, "*** Error loading key file: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ munmap_file(data);
+
+ data = mmap_file(KEY_FILE);
+ if (data.data == NULL) {
+ fprintf(stderr, "*** Error loading key file.\n");
+ exit(1);
+ }
+
+ gnutls_x509_privkey_init(&key);
+
+ ret = gnutls_x509_privkey_import(key, &data, GNUTLS_X509_FMT_PEM);
+ if (ret < 0) {
+ fprintf(stderr, "*** Error loading key file: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ munmap_file(data);
+
}
int main()
{
- int ret, sd, ii;
- gnutls_session_t session;
- char buffer[MAX_BUF + 1];
- gnutls_certificate_credentials_t xcred;
- /* Allow connections to servers that have OpenPGP keys as well.
- */
+ int ret, sd, ii;
+ gnutls_session_t session;
+ char buffer[MAX_BUF + 1];
+ gnutls_certificate_credentials_t xcred;
+ /* Allow connections to servers that have OpenPGP keys as well.
+ */
- gnutls_global_init();
+ gnutls_global_init();
- load_keys();
+ load_keys();
- /* X509 stuff */
- gnutls_certificate_allocate_credentials(&xcred);
+ /* X509 stuff */
+ gnutls_certificate_allocate_credentials(&xcred);
- /* sets the trusted cas file
- */
- gnutls_certificate_set_x509_trust_file(xcred, CAFILE, GNUTLS_X509_FMT_PEM);
+ /* sets the trusted cas file
+ */
+ gnutls_certificate_set_x509_trust_file(xcred, CAFILE,
+ GNUTLS_X509_FMT_PEM);
- gnutls_certificate_client_set_retrieve_function( xcred, cert_callback);
-
- /* Initialize TLS session
- */
- gnutls_init(&session, GNUTLS_CLIENT);
+ gnutls_certificate_client_set_retrieve_function(xcred, cert_callback);
- /* Use default priorities */
- gnutls_set_default_priority(session);
+ /* Initialize TLS session
+ */
+ gnutls_init(&session, GNUTLS_CLIENT);
- /* put the x509 credentials to the current session
- */
- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+ /* Use default priorities */
+ gnutls_set_default_priority(session);
- /* connect to the peer
- */
- sd = tcp_connect();
+ /* put the x509 credentials to the current session
+ */
+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
- gnutls_transport_set_ptr( session, (gnutls_transport_ptr_t)sd);
+ /* connect to the peer
+ */
+ sd = tcp_connect();
- /* Perform the TLS handshake
- */
- ret = gnutls_handshake( session);
+ gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) sd);
- if (ret < 0) {
- fprintf(stderr, "*** Handshake failed\n");
- gnutls_perror(ret);
- goto end;
- } else {
- printf("- Handshake was completed\n");
- }
+ /* Perform the TLS handshake
+ */
+ ret = gnutls_handshake(session);
- gnutls_record_send( session, MSG, strlen(MSG));
+ if (ret < 0) {
+ fprintf(stderr, "*** Handshake failed\n");
+ gnutls_perror(ret);
+ goto end;
+ } else {
+ printf("- Handshake was completed\n");
+ }
- ret = gnutls_record_recv( session, buffer, MAX_BUF);
- if (ret == 0) {
- printf("- Peer has closed the TLS connection\n");
- goto end;
- } else if (ret < 0) {
- fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
- goto end;
- }
+ gnutls_record_send(session, MSG, strlen(MSG));
- printf("- Received %d bytes: ", ret);
- for (ii = 0; ii < ret; ii++) {
- fputc(buffer[ii], stdout);
- }
- fputs("\n", stdout);
+ ret = gnutls_record_recv(session, buffer, MAX_BUF);
+ if (ret == 0) {
+ printf("- Peer has closed the TLS connection\n");
+ goto end;
+ } else if (ret < 0) {
+ fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
+ goto end;
+ }
- gnutls_bye( session, GNUTLS_SHUT_RDWR);
+ printf("- Received %d bytes: ", ret);
+ for (ii = 0; ii < ret; ii++) {
+ fputc(buffer[ii], stdout);
+ }
+ fputs("\n", stdout);
- end:
+ gnutls_bye(session, GNUTLS_SHUT_RDWR);
- tcp_close( sd);
+ end:
- gnutls_deinit(session);
+ tcp_close(sd);
- gnutls_certificate_free_credentials(xcred);
+ gnutls_deinit(session);
- gnutls_global_deinit();
+ gnutls_certificate_free_credentials(xcred);
- return 0;
+ gnutls_global_deinit();
+
+ return 0;
}
*/
static int cert_callback(gnutls_session_t session,
- const gnutls_datum_t* req_ca_rdn, int nreqs,
- const gnutls_pk_algorithm_t* sign_algos, int sign_algos_length,
- gnutls_retr_st * st)
+ const gnutls_datum_t * req_ca_rdn, int nreqs,
+ const gnutls_pk_algorithm_t * sign_algos,
+ int sign_algos_length, gnutls_retr_st * st)
{
- char issuer_dn[256];
- int i, ret;
- size_t len;
- gnutls_certificate_type_t type;
-
- /* Print the server's trusted CAs
- */
- if (nreqs > 0)
- printf("- Server's trusted authorities:\n");
- else
- printf("- Server did not send us any trusted authorities names.\n");
-
- /* print the names (if any) */
- for (i = 0; i < nreqs; i++) {
- len = sizeof(issuer_dn);
- ret = gnutls_x509_rdn_get(&req_ca_rdn[i], issuer_dn, &len);
- if (ret >= 0) {
- printf(" [%d]: ", i);
- printf("%s\n", issuer_dn);
- }
- }
-
- /* Select a certificate and return it.
- * The certificate must be of any of the "sign algorithms"
- * supported by the server.
- */
-
- type = gnutls_certificate_type_get( session);
- if (type == GNUTLS_CRT_X509) {
- st->type = type;
- st->ncerts = 1;
-
- st->cert.x509 = &crt;
- st->key.x509 = key;
-
- st->deinit_all = 0;
- } else {
- return -1;
- }
-
- return 0;
+ char issuer_dn[256];
+ int i, ret;
+ size_t len;
+ gnutls_certificate_type_t type;
+
+ /* Print the server's trusted CAs
+ */
+ if (nreqs > 0)
+ printf("- Server's trusted authorities:\n");
+ else
+ printf
+ ("- Server did not send us any trusted authorities names.\n");
+
+ /* print the names (if any) */
+ for (i = 0; i < nreqs; i++) {
+ len = sizeof(issuer_dn);
+ ret = gnutls_x509_rdn_get(&req_ca_rdn[i], issuer_dn, &len);
+ if (ret >= 0) {
+ printf(" [%d]: ", i);
+ printf("%s\n", issuer_dn);
+ }
+ }
+
+ /* Select a certificate and return it.
+ * The certificate must be of any of the "sign algorithms"
+ * supported by the server.
+ */
+
+ type = gnutls_certificate_type_get(session);
+ if (type == GNUTLS_CRT_X509) {
+ st->type = type;
+ st->ncerts = 1;
+
+ st->cert.x509 = &crt;
+ st->key.x509 = key;
+
+ st->deinit_all = 0;
+ } else {
+ return -1;
+ }
+
+ return 0;
}
-
/* Those functions are defined in other examples.
*/
extern void check_alert(gnutls_session_t session, int ret);
-extern int tcp_connect( void);
-extern void tcp_close( int sd);
+extern int tcp_connect(void);
+extern void tcp_close(int sd);
#define MAX_BUF 1024
#define CRLFILE "crl.pem"
int main()
{
- int ret;
- int sd, ii, alert;
- gnutls_session_t session;
- char buffer[MAX_BUF + 1];
- gnutls_certificate_credentials_t xcred;
+ int ret;
+ int sd, ii, alert;
+ gnutls_session_t session;
+ char buffer[MAX_BUF + 1];
+ gnutls_certificate_credentials_t xcred;
- /* variables used in session resuming
- */
- int t;
- char *session_data;
- size_t session_data_size;
+ /* variables used in session resuming
+ */
+ int t;
+ char *session_data;
+ size_t session_data_size;
- gnutls_global_init();
+ gnutls_global_init();
- /* X509 stuff */
- gnutls_certificate_allocate_credentials(&xcred);
+ /* X509 stuff */
+ gnutls_certificate_allocate_credentials(&xcred);
- gnutls_certificate_set_x509_trust_file(xcred, CAFILE, GNUTLS_X509_FMT_PEM);
+ gnutls_certificate_set_x509_trust_file(xcred, CAFILE,
+ GNUTLS_X509_FMT_PEM);
- for (t = 0; t < 2; t++) { /* connect 2 times to the server */
+ for (t = 0; t < 2; t++) { /* connect 2 times to the server */
- sd = tcp_connect();
+ sd = tcp_connect();
- gnutls_init(&session, GNUTLS_CLIENT);
+ gnutls_init(&session, GNUTLS_CLIENT);
- gnutls_set_default_priority(session);
+ gnutls_set_default_priority(session);
- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
- if (t > 0) { /* if this is not the first time we connect */
- gnutls_session_set_data(session, session_data, session_data_size);
- free(session_data);
- }
-
- gnutls_transport_set_ptr( session, (gnutls_transport_ptr_t)sd);
+ if (t > 0) {
+ /* if this is not the first time we connect */
+ gnutls_session_set_data(session, session_data,
+ session_data_size);
+ free(session_data);
+ }
- /* Perform the TLS handshake
- */
- ret = gnutls_handshake( session);
+ gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) sd);
- if (ret < 0) {
- fprintf(stderr, "*** Handshake failed\n");
- gnutls_perror(ret);
- goto end;
- } else {
- printf("- Handshake was completed\n");
- }
+ /* Perform the TLS handshake
+ */
+ ret = gnutls_handshake(session);
- if (t == 0) { /* the first time we connect */
- /* get the session data size */
- gnutls_session_get_data(session, NULL, &session_data_size);
- session_data = malloc(session_data_size);
+ if (ret < 0) {
+ fprintf(stderr, "*** Handshake failed\n");
+ gnutls_perror(ret);
+ goto end;
+ } else {
+ printf("- Handshake was completed\n");
+ }
- /* put session data to the session variable */
- gnutls_session_get_data(session, session_data, &session_data_size);
+ if (t == 0) { /* the first time we connect */
+ /* get the session data size */
+ gnutls_session_get_data(session, NULL, &session_data_size);
+ session_data = malloc(session_data_size);
- } else { /* the second time we connect */
+ /* put session data to the session variable */
+ gnutls_session_get_data(session, session_data,
+ &session_data_size);
- /* check if we actually resumed the previous session */
- if (gnutls_session_is_resumed( session) != 0) {
- printf("- Previous session was resumed\n");
- } else {
- fprintf(stderr, "*** Previous session was NOT resumed\n");
- }
- }
+ } else { /* the second time we connect */
- /* This function was defined in a previous example
- */
- /* print_info(session); */
+ /* check if we actually resumed the previous session */
+ if (gnutls_session_is_resumed(session) != 0) {
+ printf("- Previous session was resumed\n");
+ } else {
+ fprintf(stderr, "*** Previous session was NOT resumed\n");
+ }
+ }
- gnutls_record_send( session, MSG, strlen(MSG));
+ /* This function was defined in a previous example
+ */
+ /* print_info(session); */
- ret = gnutls_record_recv( session, buffer, MAX_BUF);
- if (ret == 0) {
- printf("- Peer has closed the TLS connection\n");
- goto end;
- } else if (ret < 0) {
- fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
- goto end;
- }
+ gnutls_record_send(session, MSG, strlen(MSG));
- printf("- Received %d bytes: ", ret);
- for (ii = 0; ii < ret; ii++) {
- fputc(buffer[ii], stdout);
- }
- fputs("\n", stdout);
+ ret = gnutls_record_recv(session, buffer, MAX_BUF);
+ if (ret == 0) {
+ printf("- Peer has closed the TLS connection\n");
+ goto end;
+ } else if (ret < 0) {
+ fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
+ goto end;
+ }
- gnutls_bye( session, GNUTLS_SHUT_RDWR);
+ printf("- Received %d bytes: ", ret);
+ for (ii = 0; ii < ret; ii++) {
+ fputc(buffer[ii], stdout);
+ }
+ fputs("\n", stdout);
- end:
+ gnutls_bye(session, GNUTLS_SHUT_RDWR);
- tcp_close(sd);
+ end:
- gnutls_deinit(session);
+ tcp_close(sd);
- } /* for() */
+ gnutls_deinit(session);
- gnutls_certificate_free_credentials(xcred);
+ } /* for() */
- gnutls_global_deinit();
+ gnutls_certificate_free_credentials(xcred);
- return 0;
-}
+ gnutls_global_deinit();
+ return 0;
+}
/* Those functions are defined in other examples.
*/
extern void check_alert(gnutls_session_t session, int ret);
-extern int tcp_connect( void);
-extern void tcp_close( int sd);
+extern int tcp_connect(void);
+extern void tcp_close(int sd);
#define MAX_BUF 1024
#define USERNAME "user"
#define SA struct sockaddr
#define MSG "GET / HTTP/1.0\r\n\r\n"
-const int kx_priority[] = { GNUTLS_KX_SRP, GNUTLS_KX_SRP_DSS,
- GNUTLS_KX_SRP_RSA, 0 };
+const int kx_priority[] = { GNUTLS_KX_SRP, GNUTLS_KX_SRP_DSS,
+ GNUTLS_KX_SRP_RSA, 0
+};
int main()
{
- int ret;
- int sd, ii;
- gnutls_session_t session;
- char buffer[MAX_BUF + 1];
- gnutls_srp_client_credentials_t srp_cred;
- gnutls_certificate_client_credentials_t cert_cred;
-
- gnutls_global_init();
-
- /* now enable the gnutls-extra library which contains the
- * SRP stuff.
- */
- gnutls_global_init_extra();
-
- gnutls_srp_allocate_client_credentials(&srp_cred);
- gnutls_certificate_allocate_client_credentials(&cert_cred);
-
- gnutls_certificate_set_x509_trust_file(cert_cred, CAFILE, GNUTLS_X509_FMT_PEM);
- gnutls_srp_set_client_credentials(srp_cred, USERNAME, PASSWORD);
-
- /* connects to server
- */
- sd = tcp_connect();
-
- /* Initialize TLS session
- */
- gnutls_init(&session, GNUTLS_CLIENT);
-
-
- /* Set the priorities.
- */
- gnutls_set_default_priority(session);
- gnutls_kx_set_priority(session, kx_priority);
-
-
- /* put the SRP credentials to the current session
- */
- gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);
- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred);
-
- gnutls_transport_set_ptr( session, (gnutls_transport_ptr_t)sd);
-
- /* Perform the TLS handshake
- */
- ret = gnutls_handshake( session);
-
- if (ret < 0) {
- fprintf(stderr, "*** Handshake failed\n");
- gnutls_perror(ret);
- goto end;
- } else {
- printf("- Handshake was completed\n");
- }
-
- gnutls_record_send( session, MSG, strlen(MSG));
-
- ret = gnutls_record_recv( session, buffer, MAX_BUF);
- if (gnutls_error_is_fatal(ret) == 1 || ret == 0) {
- if (ret == 0) {
- printf("- Peer has closed the GNUTLS connection\n");
- goto end;
- } else {
- fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
- goto end;
- }
- } else
- check_alert( session, ret);
-
- if (ret > 0) {
- printf("- Received %d bytes: ", ret);
- for (ii = 0; ii < ret; ii++) {
- fputc(buffer[ii], stdout);
- }
- fputs("\n", stdout);
- }
- gnutls_bye( session, 0);
-
- end:
-
- tcp_close( sd);
-
- gnutls_deinit(session);
-
- gnutls_srp_free_client_credentials(srp_cred);
- gnutls_certificate_free_credentials(cert_cred);
-
- gnutls_global_deinit();
-
- return 0;
-}
+ int ret;
+ int sd, ii;
+ gnutls_session_t session;
+ char buffer[MAX_BUF + 1];
+ gnutls_srp_client_credentials_t srp_cred;
+ gnutls_certificate_client_credentials_t cert_cred;
+
+ gnutls_global_init();
+
+ /* now enable the gnutls-extra library which contains the
+ * SRP stuff.
+ */
+ gnutls_global_init_extra();
+
+ gnutls_srp_allocate_client_credentials(&srp_cred);
+ gnutls_certificate_allocate_client_credentials(&cert_cred);
+
+ gnutls_certificate_set_x509_trust_file(cert_cred, CAFILE,
+ GNUTLS_X509_FMT_PEM);
+ gnutls_srp_set_client_credentials(srp_cred, USERNAME, PASSWORD);
+
+ /* connects to server
+ */
+ sd = tcp_connect();
+
+ /* Initialize TLS session
+ */
+ gnutls_init(&session, GNUTLS_CLIENT);
+
+
+ /* Set the priorities.
+ */
+ gnutls_set_default_priority(session);
+ gnutls_kx_set_priority(session, kx_priority);
+
+
+ /* put the SRP credentials to the current session
+ */
+ gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);
+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred);
+
+ gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) sd);
+ /* Perform the TLS handshake
+ */
+ ret = gnutls_handshake(session);
+
+ if (ret < 0) {
+ fprintf(stderr, "*** Handshake failed\n");
+ gnutls_perror(ret);
+ goto end;
+ } else {
+ printf("- Handshake was completed\n");
+ }
+
+ gnutls_record_send(session, MSG, strlen(MSG));
+
+ ret = gnutls_record_recv(session, buffer, MAX_BUF);
+ if (gnutls_error_is_fatal(ret) == 1 || ret == 0) {
+ if (ret == 0) {
+ printf("- Peer has closed the GNUTLS connection\n");
+ goto end;
+ } else {
+ fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
+ goto end;
+ }
+ } else
+ check_alert(session, ret);
+
+ if (ret > 0) {
+ printf("- Received %d bytes: ", ret);
+ for (ii = 0; ii < ret; ii++) {
+ fputc(buffer[ii], stdout);
+ }
+ fputs("\n", stdout);
+ }
+ gnutls_bye(session, 0);
+
+ end:
+
+ tcp_close(sd);
+
+ gnutls_deinit(session);
+
+ gnutls_srp_free_client_credentials(srp_cred);
+ gnutls_certificate_free_credentials(cert_cred);
+
+ gnutls_global_deinit();
+
+ return 0;
+}
/* Connects to the peer and returns a socket
* descriptor.
*/
-int tcp_connect( void)
+int tcp_connect(void)
{
- const char *PORT = "443";
- const char *SERVER = "127.0.0.1";
- int err, sd;
- struct sockaddr_in sa;
-
- /* connects to server
- */
- sd = socket(AF_INET, SOCK_STREAM, 0);
-
- memset(&sa, '\0', sizeof(sa));
- sa.sin_family = AF_INET;
- sa.sin_port = htons(atoi(PORT));
- inet_pton(AF_INET, SERVER, &sa.sin_addr);
-
- err = connect(sd, (SA *) & sa, sizeof(sa));
- if (err < 0) {
- fprintf(stderr, "Connect error\n");
- exit(1);
- }
-
- return sd;
+ const char *PORT = "443";
+ const char *SERVER = "127.0.0.1";
+ int err, sd;
+ struct sockaddr_in sa;
+
+ /* connects to server
+ */
+ sd = socket(AF_INET, SOCK_STREAM, 0);
+
+ memset(&sa, '\0', sizeof(sa));
+ sa.sin_family = AF_INET;
+ sa.sin_port = htons(atoi(PORT));
+ inet_pton(AF_INET, SERVER, &sa.sin_addr);
+
+ err = connect(sd, (SA *) & sa, sizeof(sa));
+ if (err < 0) {
+ fprintf(stderr, "Connect error\n");
+ exit(1);
+ }
+
+ return sd;
}
/* closes the given socket descriptor.
*/
-void tcp_close( int sd)
+void tcp_close(int sd)
{
- shutdown(sd, SHUT_RDWR); /* no more receptions */
- close(sd);
+ shutdown(sd, SHUT_RDWR); /* no more receptions */
+ close(sd);
}
int main()
{
- int ret, sd, ii;
- gnutls_session_t session;
- char buffer[MAX_BUF + 1];
- gnutls_certificate_credentials_t xcred;
- /* Allow connections to servers that have OpenPGP keys as well.
- */
- const int cert_type_priority[3] = { GNUTLS_CRT_X509,
- GNUTLS_CRT_OPENPGP, 0 };
+ int ret, sd, ii;
+ gnutls_session_t session;
+ char buffer[MAX_BUF + 1];
+ gnutls_certificate_credentials_t xcred;
+ /* Allow connections to servers that have OpenPGP keys as well.
+ */
+ const int cert_type_priority[3] = { GNUTLS_CRT_X509,
+ GNUTLS_CRT_OPENPGP, 0
+ };
- gnutls_global_init();
+ gnutls_global_init();
- /* X509 stuff */
- gnutls_certificate_allocate_credentials(&xcred);
+ /* X509 stuff */
+ gnutls_certificate_allocate_credentials(&xcred);
- /* sets the trusted cas file
- */
- gnutls_certificate_set_x509_trust_file(xcred, CAFILE, GNUTLS_X509_FMT_PEM);
+ /* sets the trusted cas file
+ */
+ gnutls_certificate_set_x509_trust_file(xcred, CAFILE,
+ GNUTLS_X509_FMT_PEM);
- /* Initialize TLS session
- */
- gnutls_init(&session, GNUTLS_CLIENT);
+ /* Initialize TLS session
+ */
+ gnutls_init(&session, GNUTLS_CLIENT);
- /* Use default priorities */
- gnutls_set_default_priority(session);
- gnutls_certificate_type_set_priority(session, cert_type_priority);
+ /* Use default priorities */
+ gnutls_set_default_priority(session);
+ gnutls_certificate_type_set_priority(session, cert_type_priority);
- /* put the x509 credentials to the current session
- */
- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+ /* put the x509 credentials to the current session
+ */
+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
- /* connect to the peer
- */
- sd = tcp_connect();
+ /* connect to the peer
+ */
+ sd = tcp_connect();
- gnutls_transport_set_ptr( session, (gnutls_transport_ptr_t)sd);
+ gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) sd);
- /* Perform the TLS handshake
- */
- ret = gnutls_handshake( session);
+ /* Perform the TLS handshake
+ */
+ ret = gnutls_handshake(session);
- if (ret < 0) {
- fprintf(stderr, "*** Handshake failed\n");
- gnutls_perror(ret);
- goto end;
- } else {
- printf("- Handshake was completed\n");
- }
+ if (ret < 0) {
+ fprintf(stderr, "*** Handshake failed\n");
+ gnutls_perror(ret);
+ goto end;
+ } else {
+ printf("- Handshake was completed\n");
+ }
- gnutls_record_send( session, MSG, strlen(MSG));
+ gnutls_record_send(session, MSG, strlen(MSG));
- ret = gnutls_record_recv( session, buffer, MAX_BUF);
- if (ret == 0) {
- printf("- Peer has closed the TLS connection\n");
- goto end;
- } else if (ret < 0) {
- fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
- goto end;
- }
+ ret = gnutls_record_recv(session, buffer, MAX_BUF);
+ if (ret == 0) {
+ printf("- Peer has closed the TLS connection\n");
+ goto end;
+ } else if (ret < 0) {
+ fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
+ goto end;
+ }
- printf("- Received %d bytes: ", ret);
- for (ii = 0; ii < ret; ii++) {
- fputc(buffer[ii], stdout);
- }
- fputs("\n", stdout);
+ printf("- Received %d bytes: ", ret);
+ for (ii = 0; ii < ret; ii++) {
+ fputc(buffer[ii], stdout);
+ }
+ fputs("\n", stdout);
- gnutls_bye( session, GNUTLS_SHUT_RDWR);
+ gnutls_bye(session, GNUTLS_SHUT_RDWR);
- end:
+ end:
- tcp_close( sd);
+ tcp_close(sd);
- gnutls_deinit(session);
+ gnutls_deinit(session);
- gnutls_certificate_free_credentials(xcred);
+ gnutls_certificate_free_credentials(xcred);
- gnutls_global_deinit();
+ gnutls_global_deinit();
- return 0;
+ return 0;
}
-
int main()
{
- gnutls_x509_crq_t crq;
- gnutls_x509_privkey_t key;
- unsigned char buffer[10*1024];
- int buffer_size = sizeof(buffer);
- int ret;
+ gnutls_x509_crq_t crq;
+ gnutls_x509_privkey_t key;
+ unsigned char buffer[10 * 1024];
+ int buffer_size = sizeof(buffer);
+ int ret;
- gnutls_global_init();
+ gnutls_global_init();
- /* Initialize an empty certificate request, and
- * an empty private key.
- */
- gnutls_x509_crq_init(&crq);
+ /* Initialize an empty certificate request, and
+ * an empty private key.
+ */
+ gnutls_x509_crq_init(&crq);
- gnutls_x509_privkey_init(&key);
+ gnutls_x509_privkey_init(&key);
- /* Generate a 1024 bit RSA private key.
- */
- gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 1024, 0);
+ /* Generate a 1024 bit RSA private key.
+ */
+ gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 1024, 0);
- /* Add stuff to the distinguished name
- */
- gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COUNTRY_NAME,
- 0, "GR", 2);
+ /* Add stuff to the distinguished name
+ */
+ gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COUNTRY_NAME,
+ 0, "GR", 2);
- gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COMMON_NAME,
- 0, "Nikos", strlen("Nikos"));
+ gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COMMON_NAME,
+ 0, "Nikos", strlen("Nikos"));
- /* Set the request version.
- */
- gnutls_x509_crq_set_version(crq, 1);
+ /* Set the request version.
+ */
+ gnutls_x509_crq_set_version(crq, 1);
- /* Set a challenge password.
- */
- gnutls_x509_crq_set_challenge_password(crq, "something to remember here");
+ /* Set a challenge password.
+ */
+ gnutls_x509_crq_set_challenge_password(crq,
+ "something to remember here");
- /* Associate the request with the private key
- */
- gnutls_x509_crq_set_key(crq, key);
+ /* Associate the request with the private key
+ */
+ gnutls_x509_crq_set_key(crq, key);
- /* Self sign the certificate request.
- */
- gnutls_x509_crq_sign(crq, key);
+ /* Self sign the certificate request.
+ */
+ gnutls_x509_crq_sign(crq, key);
- /* Export the PEM encoded certificate request, and
- * display it.
- */
- gnutls_x509_crq_export(crq, GNUTLS_X509_FMT_PEM, buffer,
- &buffer_size);
+ /* Export the PEM encoded certificate request, and
+ * display it.
+ */
+ gnutls_x509_crq_export(crq, GNUTLS_X509_FMT_PEM, buffer, &buffer_size);
- printf("Certificate Request: \n%s", buffer);
+ printf("Certificate Request: \n%s", buffer);
- /* Export the PEM encoded private key, and
- * display it.
- */
- buffer_size = sizeof(buffer);
- gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer,
- &buffer_size);
+ /* Export the PEM encoded private key, and
+ * display it.
+ */
+ buffer_size = sizeof(buffer);
+ gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer,
+ &buffer_size);
- printf("\n\nPrivate key: \n%s", buffer);
+ printf("\n\nPrivate key: \n%s", buffer);
- gnutls_x509_crq_deinit(crq);
- gnutls_x509_privkey_deinit(key);
+ gnutls_x509_crq_deinit(crq);
+ gnutls_x509_privkey_deinit(key);
- return 0;
+ return 0;
}
-
* encrypted using a PKCS #12 cipher, or some browsers will crash)
* password: is the password used to encrypt the PKCS #12 packet.
*/
-int write_pkcs12(const gnutls_datum_t * cert, const gnutls_datum_t * pkcs8_key,
- const char *password)
+int write_pkcs12(const gnutls_datum_t * cert,
+ const gnutls_datum_t * pkcs8_key, const char *password)
{
- gnutls_pkcs12_t pkcs12;
- int ret, bag_index;
- gnutls_pkcs12_bag_t bag, key_bag;
- char pkcs12_struct[10 * 1024];
- int pkcs12_struct_size;
- FILE *fd;
-
- /* A good idea might be to use gnutls_x509_privkey_get_key_id()
- * to obtain a unique ID.
- */
- gnutls_datum_t key_id = { "\x00\x00\x07", 3 };
-
- gnutls_global_init();
-
- /* Firstly we create two helper bags, which hold the certificate,
- * and the (encrypted) key.
- */
-
- gnutls_pkcs12_bag_init(&bag);
- gnutls_pkcs12_bag_init(&key_bag);
-
- ret = gnutls_pkcs12_bag_set_data(bag, GNUTLS_BAG_CERTIFICATE, cert);
- if (ret < 0) {
- fprintf(stderr, "ret: %s\n", gnutls_strerror(ret));
- exit(1);
- }
-
- /* ret now holds the bag's index.
- */
- bag_index = ret;
-
- /* Associate a friendly name with the given certificate. Used
- * by browsers.
- */
- gnutls_pkcs12_bag_set_friendly_name(bag, bag_index, "My name");
-
- /* Associate the certificate with the key using a unique key
- * ID.
- */
- gnutls_pkcs12_bag_set_key_id(bag, bag_index, &key_id);
-
- /* use weak encryption for the certificate.
- */
- gnutls_pkcs12_bag_encrypt(bag, password, GNUTLS_PKCS_USE_PKCS12_RC2_40);
-
- /* Now the key.
- */
-
- ret = gnutls_pkcs12_bag_set_data(key_bag,
- GNUTLS_BAG_PKCS8_ENCRYPTED_KEY,
- pkcs8_key);
- if (ret < 0) {
- fprintf(stderr, "ret: %s\n", gnutls_strerror(ret));
- exit(1);
- }
-
- /* Note that since the PKCS #8 key is already encrypted we don't
- * bother encrypting that bag.
- */
- bag_index = ret;
-
- gnutls_pkcs12_bag_set_friendly_name(key_bag, bag_index, "My name");
-
- gnutls_pkcs12_bag_set_key_id(key_bag, bag_index, &key_id);
-
-
- /* The bags were filled. Now create the PKCS #12 structure.
- */
- gnutls_pkcs12_init(&pkcs12);
-
- /* Insert the two bags in the PKCS #12 structure.
- */
-
- gnutls_pkcs12_set_bag(pkcs12, bag);
- gnutls_pkcs12_set_bag(pkcs12, key_bag);
-
-
- /* Generate a message authentication code for the PKCS #12
- * structure.
- */
- gnutls_pkcs12_generate_mac(pkcs12, password);
-
- pkcs12_struct_size = sizeof(pkcs12_struct);
- ret =
- gnutls_pkcs12_export(pkcs12, GNUTLS_X509_FMT_DER, pkcs12_struct,
- &pkcs12_struct_size);
- if (ret < 0) {
- fprintf(stderr, "ret: %s\n", gnutls_strerror(ret));
- exit(1);
- }
-
- fd = fopen(OUTFILE, "w");
- if (fd == NULL) {
- fprintf(stderr, "cannot open file\n");
- exit(1);
- }
- fwrite(pkcs12_struct, 1, pkcs12_struct_size, fd);
- fclose(fd);
-
- gnutls_pkcs12_bag_deinit(bag);
- gnutls_pkcs12_bag_deinit(key_bag);
- gnutls_pkcs12_deinit(pkcs12);
+ gnutls_pkcs12_t pkcs12;
+ int ret, bag_index;
+ gnutls_pkcs12_bag_t bag, key_bag;
+ char pkcs12_struct[10 * 1024];
+ int pkcs12_struct_size;
+ FILE *fd;
+
+ /* A good idea might be to use gnutls_x509_privkey_get_key_id()
+ * to obtain a unique ID.
+ */
+ gnutls_datum_t key_id = { "\x00\x00\x07", 3 };
+
+ gnutls_global_init();
+
+ /* Firstly we create two helper bags, which hold the certificate,
+ * and the (encrypted) key.
+ */
+
+ gnutls_pkcs12_bag_init(&bag);
+ gnutls_pkcs12_bag_init(&key_bag);
+
+ ret = gnutls_pkcs12_bag_set_data(bag, GNUTLS_BAG_CERTIFICATE, cert);
+ if (ret < 0) {
+ fprintf(stderr, "ret: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ /* ret now holds the bag's index.
+ */
+ bag_index = ret;
+
+ /* Associate a friendly name with the given certificate. Used
+ * by browsers.
+ */
+ gnutls_pkcs12_bag_set_friendly_name(bag, bag_index, "My name");
+
+ /* Associate the certificate with the key using a unique key
+ * ID.
+ */
+ gnutls_pkcs12_bag_set_key_id(bag, bag_index, &key_id);
+
+ /* use weak encryption for the certificate.
+ */
+ gnutls_pkcs12_bag_encrypt(bag, password,
+ GNUTLS_PKCS_USE_PKCS12_RC2_40);
+
+ /* Now the key.
+ */
+
+ ret = gnutls_pkcs12_bag_set_data(key_bag,
+ GNUTLS_BAG_PKCS8_ENCRYPTED_KEY,
+ pkcs8_key);
+ if (ret < 0) {
+ fprintf(stderr, "ret: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ /* Note that since the PKCS #8 key is already encrypted we don't
+ * bother encrypting that bag.
+ */
+ bag_index = ret;
+
+ gnutls_pkcs12_bag_set_friendly_name(key_bag, bag_index, "My name");
+
+ gnutls_pkcs12_bag_set_key_id(key_bag, bag_index, &key_id);
+
+
+ /* The bags were filled. Now create the PKCS #12 structure.
+ */
+ gnutls_pkcs12_init(&pkcs12);
+
+ /* Insert the two bags in the PKCS #12 structure.
+ */
+
+ gnutls_pkcs12_set_bag(pkcs12, bag);
+ gnutls_pkcs12_set_bag(pkcs12, key_bag);
+
+
+ /* Generate a message authentication code for the PKCS #12
+ * structure.
+ */
+ gnutls_pkcs12_generate_mac(pkcs12, password);
+
+ pkcs12_struct_size = sizeof(pkcs12_struct);
+ ret =
+ gnutls_pkcs12_export(pkcs12, GNUTLS_X509_FMT_DER, pkcs12_struct,
+ &pkcs12_struct_size);
+ if (ret < 0) {
+ fprintf(stderr, "ret: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ fd = fopen(OUTFILE, "w");
+ if (fd == NULL) {
+ fprintf(stderr, "cannot open file\n");
+ exit(1);
+ }
+ fwrite(pkcs12_struct, 1, pkcs12_struct_size, fd);
+ fclose(fd);
+
+ gnutls_pkcs12_bag_deinit(bag);
+ gnutls_pkcs12_bag_deinit(key_bag);
+ gnutls_pkcs12_deinit(pkcs12);
}
-
#define SA struct sockaddr
#define SOCKET_ERR(err,s) if(err==-1) {perror(s);return(1);}
#define MAX_BUF 1024
-#define PORT 5556 /* listen to 5556 port */
+#define PORT 5556 /* listen to 5556 port */
#define DH_BITS 1024
/* These are global */
static void wrap_db_init(void);
static void wrap_db_deinit(void);
-static int wrap_db_store(void *dbf, gnutls_datum_t key, gnutls_datum_t data);
+static int wrap_db_store(void *dbf, gnutls_datum_t key,
+ gnutls_datum_t data);
static gnutls_datum_t wrap_db_fetch(void *dbf, gnutls_datum_t key);
static int wrap_db_delete(void *dbf, gnutls_datum_t key);
gnutls_session_t initialize_tls_session()
{
- gnutls_session_t session;
+ gnutls_session_t session;
- gnutls_init(&session, GNUTLS_SERVER);
+ gnutls_init(&session, GNUTLS_SERVER);
- /* Use the default priorities, plus, export cipher suites.
- */
- gnutls_set_default_export_priority(session);
+ /* Use the default priorities, plus, export cipher suites.
+ */
+ gnutls_set_default_export_priority(session);
- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred);
+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred);
- /* request client certificate if any.
- */
- gnutls_certificate_server_set_request(session, GNUTLS_CERT_REQUEST);
+ /* request client certificate if any.
+ */
+ gnutls_certificate_server_set_request(session, GNUTLS_CERT_REQUEST);
- gnutls_dh_set_prime_bits(session, DH_BITS);
+ gnutls_dh_set_prime_bits(session, DH_BITS);
- if (TLS_SESSION_CACHE != 0) {
- gnutls_db_set_retrieve_function(session, wrap_db_fetch);
- gnutls_db_set_remove_function(session, wrap_db_delete);
- gnutls_db_set_store_function(session, wrap_db_store);
- gnutls_db_set_ptr(session, NULL);
- }
+ if (TLS_SESSION_CACHE != 0) {
+ gnutls_db_set_retrieve_function(session, wrap_db_fetch);
+ gnutls_db_set_remove_function(session, wrap_db_delete);
+ gnutls_db_set_store_function(session, wrap_db_store);
+ gnutls_db_set_ptr(session, NULL);
+ }
- return session;
+ return session;
}
gnutls_dh_params_t dh_params;
int generate_dh_params(void)
{
- /* Generate Diffie Hellman parameters - for use with DHE
- * kx algorithms. These should be discarded and regenerated
- * once a day, once a week or once a month. Depends on the
- * security requirements.
- */
- gnutls_dh_params_init(&dh_params);
- gnutls_dh_params_generate2( dh_params, DH_BITS);
-
- return 0;
+ /* Generate Diffie Hellman parameters - for use with DHE
+ * kx algorithms. These should be discarded and regenerated
+ * once a day, once a week or once a month. Depends on the
+ * security requirements.
+ */
+ gnutls_dh_params_init(&dh_params);
+ gnutls_dh_params_generate2(dh_params, DH_BITS);
+
+ return 0;
}
static int generate_rsa_params(void)
{
- gnutls_rsa_params_init(&rsa_params);
+ gnutls_rsa_params_init(&rsa_params);
- /* Generate RSA parameters - for use with RSA-export
- * cipher suites. These should be discarded and regenerated
- * once a day, once every 500 transactions etc. Depends on the
- * security requirements.
- */
+ /* Generate RSA parameters - for use with RSA-export
+ * cipher suites. These should be discarded and regenerated
+ * once a day, once every 500 transactions etc. Depends on the
+ * security requirements.
+ */
- gnutls_rsa_params_generate2( rsa_params, 512);
+ gnutls_rsa_params_generate2(rsa_params, 512);
- return 0;
+ return 0;
}
int main()
{
- int err, listen_sd, i;
- int sd, ret;
- struct sockaddr_in sa_serv;
- struct sockaddr_in sa_cli;
- int client_len;
- char topbuf[512];
- gnutls_session_t session;
- char buffer[MAX_BUF + 1];
- int optval = 1;
- char name[256];
-
- strcpy(name, "Echo Server");
-
- /* this must be called once in the program
- */
- gnutls_global_init();
-
- gnutls_certificate_allocate_credentials(&cert_cred);
-
- gnutls_certificate_set_x509_trust_file(cert_cred, CAFILE,
- GNUTLS_X509_FMT_PEM);
-
- gnutls_certificate_set_x509_crl_file(cert_cred, CRLFILE,
- GNUTLS_X509_FMT_PEM);
-
- gnutls_certificate_set_x509_key_file(cert_cred, CERTFILE, KEYFILE,
- GNUTLS_X509_FMT_PEM);
-
- generate_dh_params();
- generate_rsa_params();
-
- if (TLS_SESSION_CACHE != 0) {
- wrap_db_init();
- }
-
- gnutls_certificate_set_dh_params(cert_cred, dh_params);
- gnutls_certificate_set_rsa_export_params(cert_cred, rsa_params);
-
- /* Socket operations
- */
- listen_sd = socket(AF_INET, SOCK_STREAM, 0);
- SOCKET_ERR(listen_sd, "socket");
-
- memset(&sa_serv, '\0', sizeof(sa_serv));
- sa_serv.sin_family = AF_INET;
- sa_serv.sin_addr.s_addr = INADDR_ANY;
- sa_serv.sin_port = htons(PORT); /* Server Port number */
-
- setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(int));
-
- err = bind(listen_sd, (SA *) & sa_serv, sizeof(sa_serv));
- SOCKET_ERR(err, "bind");
- err = listen(listen_sd, 1024);
- SOCKET_ERR(err, "listen");
-
- printf("%s ready. Listening to port '%d'.\n\n", name, PORT);
-
- client_len = sizeof(sa_cli);
- for (;;) {
- session = initialize_tls_session();
-
- sd = accept(listen_sd, (SA *) & sa_cli, &client_len);
-
- printf("- connection from %s, port %d\n",
- inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
- sizeof(topbuf)), ntohs(sa_cli.sin_port));
-
- gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t)sd);
- ret = gnutls_handshake(session);
- if (ret < 0) {
- close(sd);
- gnutls_deinit(session);
- fprintf(stderr, "*** Handshake has failed (%s)\n\n",
- gnutls_strerror(ret));
- continue;
- }
- printf("- Handshake was completed\n");
-
- /* print_info(session); */
-
- i = 0;
- for (;;) {
- bzero(buffer, MAX_BUF + 1);
- ret = gnutls_record_recv(session, buffer, MAX_BUF);
-
- if (ret == 0) {
- printf("\n- Peer has closed the TLS connection\n");
- break;
- } else if (ret < 0) {
- fprintf(stderr,
- "\n*** Received corrupted data(%d). Closing the connection.\n\n",
- ret);
- break;
- } else if (ret > 0) {
- /* echo data back to the client
- */
- gnutls_record_send(session, buffer, strlen(buffer));
- }
- }
- printf("\n");
- gnutls_bye(session, GNUTLS_SHUT_WR); /* do not wait for
- * the peer to close the connection.
- */
-
- close(sd);
- gnutls_deinit(session);
+ int err, listen_sd, i;
+ int sd, ret;
+ struct sockaddr_in sa_serv;
+ struct sockaddr_in sa_cli;
+ int client_len;
+ char topbuf[512];
+ gnutls_session_t session;
+ char buffer[MAX_BUF + 1];
+ int optval = 1;
+ char name[256];
+
+ strcpy(name, "Echo Server");
+
+ /* this must be called once in the program
+ */
+ gnutls_global_init();
+
+ gnutls_certificate_allocate_credentials(&cert_cred);
+
+ gnutls_certificate_set_x509_trust_file(cert_cred, CAFILE,
+ GNUTLS_X509_FMT_PEM);
+
+ gnutls_certificate_set_x509_crl_file(cert_cred, CRLFILE,
+ GNUTLS_X509_FMT_PEM);
+
+ gnutls_certificate_set_x509_key_file(cert_cred, CERTFILE, KEYFILE,
+ GNUTLS_X509_FMT_PEM);
+
+ generate_dh_params();
+ generate_rsa_params();
+
+ if (TLS_SESSION_CACHE != 0) {
+ wrap_db_init();
+ }
+
+ gnutls_certificate_set_dh_params(cert_cred, dh_params);
+ gnutls_certificate_set_rsa_export_params(cert_cred, rsa_params);
+
+ /* Socket operations
+ */
+ listen_sd = socket(AF_INET, SOCK_STREAM, 0);
+ SOCKET_ERR(listen_sd, "socket");
+
+ memset(&sa_serv, '\0', sizeof(sa_serv));
+ sa_serv.sin_family = AF_INET;
+ sa_serv.sin_addr.s_addr = INADDR_ANY;
+ sa_serv.sin_port = htons(PORT); /* Server Port number */
+
+ setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(int));
+
+ err = bind(listen_sd, (SA *) & sa_serv, sizeof(sa_serv));
+ SOCKET_ERR(err, "bind");
+ err = listen(listen_sd, 1024);
+ SOCKET_ERR(err, "listen");
+
+ printf("%s ready. Listening to port '%d'.\n\n", name, PORT);
+
+ client_len = sizeof(sa_cli);
+ for (;;) {
+ session = initialize_tls_session();
+
+ sd = accept(listen_sd, (SA *) & sa_cli, &client_len);
+
+ printf("- connection from %s, port %d\n",
+ inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
+ sizeof(topbuf)), ntohs(sa_cli.sin_port));
+
+ gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) sd);
+ ret = gnutls_handshake(session);
+ if (ret < 0) {
+ close(sd);
+ gnutls_deinit(session);
+ fprintf(stderr, "*** Handshake has failed (%s)\n\n",
+ gnutls_strerror(ret));
+ continue;
+ }
+ printf("- Handshake was completed\n");
+
+ /* print_info(session); */
+
+ i = 0;
+ for (;;) {
+ bzero(buffer, MAX_BUF + 1);
+ ret = gnutls_record_recv(session, buffer, MAX_BUF);
+
+ if (ret == 0) {
+ printf("\n- Peer has closed the TLS connection\n");
+ break;
+ } else if (ret < 0) {
+ fprintf(stderr, "\n*** Received corrupted "
+ "data(%d). Closing the connection.\n\n", ret);
+ break;
+ } else if (ret > 0) {
+ /* echo data back to the client
+ */
+ gnutls_record_send(session, buffer, strlen(buffer));
+ }
+ }
+ printf("\n");
+ /* do not wait for the peer to close the connection.
+ */
+ gnutls_bye(session, GNUTLS_SHUT_WR);
+
+ close(sd);
+ gnutls_deinit(session);
- }
- close(listen_sd);
+ }
+ close(listen_sd);
- gnutls_certificate_free_credentials(cert_cred);
+ gnutls_certificate_free_credentials(cert_cred);
- gnutls_global_deinit();
+ gnutls_global_deinit();
- return 0;
+ return 0;
}
#define MAX_SESSION_DATA_SIZE 512
typedef struct {
- char session_id[MAX_SESSION_ID_SIZE];
- int session_id_size;
+ char session_id[MAX_SESSION_ID_SIZE];
+ int session_id_size;
- char session_data[MAX_SESSION_DATA_SIZE];
- int session_data_size;
+ char session_data[MAX_SESSION_DATA_SIZE];
+ int session_data_size;
} CACHE;
static CACHE *cache_db;
static void wrap_db_init(void)
{
- /* allocate cache_db */
- cache_db = calloc(1, TLS_SESSION_CACHE * sizeof(CACHE));
+ /* allocate cache_db */
+ cache_db = calloc(1, TLS_SESSION_CACHE * sizeof(CACHE));
}
static void wrap_db_deinit(void)
{
- return;
+ return;
}
-static int wrap_db_store(void *dbf, gnutls_datum_t key, gnutls_datum_t data)
+static int wrap_db_store(void *dbf, gnutls_datum_t key,
+ gnutls_datum_t data)
{
- if (cache_db == NULL)
- return -1;
+ if (cache_db == NULL)
+ return -1;
- if (key.size > MAX_SESSION_ID_SIZE)
- return -1;
- if (data.size > MAX_SESSION_DATA_SIZE)
- return -1;
+ if (key.size > MAX_SESSION_ID_SIZE)
+ return -1;
+ if (data.size > MAX_SESSION_DATA_SIZE)
+ return -1;
- memcpy(cache_db[cache_db_ptr].session_id, key.data, key.size);
- cache_db[cache_db_ptr].session_id_size = key.size;
+ memcpy(cache_db[cache_db_ptr].session_id, key.data, key.size);
+ cache_db[cache_db_ptr].session_id_size = key.size;
- memcpy(cache_db[cache_db_ptr].session_data, data.data, data.size);
- cache_db[cache_db_ptr].session_data_size = data.size;
+ memcpy(cache_db[cache_db_ptr].session_data, data.data, data.size);
+ cache_db[cache_db_ptr].session_data_size = data.size;
- cache_db_ptr++;
- cache_db_ptr %= TLS_SESSION_CACHE;
+ cache_db_ptr++;
+ cache_db_ptr %= TLS_SESSION_CACHE;
- return 0;
+ return 0;
}
static gnutls_datum_t wrap_db_fetch(void *dbf, gnutls_datum_t key)
{
- gnutls_datum_t res = { NULL, 0 };
- int i;
+ gnutls_datum_t res = { NULL, 0 };
+ int i;
- if (cache_db == NULL)
- return res;
+ if (cache_db == NULL)
+ return res;
- for (i = 0; i < TLS_SESSION_CACHE; i++) {
- if (key.size == cache_db[i].session_id_size &&
- memcmp(key.data, cache_db[i].session_id, key.size) == 0) {
+ for (i = 0; i < TLS_SESSION_CACHE; i++) {
+ if (key.size == cache_db[i].session_id_size &&
+ memcmp(key.data, cache_db[i].session_id, key.size) == 0) {
- res.size = cache_db[i].session_data_size;
+ res.size = cache_db[i].session_data_size;
- res.data = gnutls_malloc(res.size);
- if (res.data == NULL)
- return res;
+ res.data = gnutls_malloc(res.size);
+ if (res.data == NULL)
+ return res;
- memcpy(res.data, cache_db[i].session_data, res.size);
+ memcpy(res.data, cache_db[i].session_data, res.size);
- return res;
- }
- }
- return res;
+ return res;
+ }
+ }
+ return res;
}
static int wrap_db_delete(void *dbf, gnutls_datum_t key)
{
- int i;
+ int i;
- if (cache_db == NULL)
- return -1;
+ if (cache_db == NULL)
+ return -1;
- for (i = 0; i < TLS_SESSION_CACHE; i++) {
- if (key.size == cache_db[i].session_id_size &&
- memcmp(key.data, cache_db[i].session_id, key.size) == 0) {
+ for (i = 0; i < TLS_SESSION_CACHE; i++) {
+ if (key.size == cache_db[i].session_id_size &&
+ memcmp(key.data, cache_db[i].session_id, key.size) == 0) {
- cache_db[i].session_id_size = 0;
- cache_db[i].session_data_size = 0;
+ cache_db[i].session_id_size = 0;
+ cache_db[i].session_data_size = 0;
- return 0;
- }
- }
+ return 0;
+ }
+ }
- return -1;
+ return -1;
}
-
#define SA struct sockaddr
#define SOCKET_ERR(err,s) if(err==-1) {perror(s);return(1);}
#define MAX_BUF 1024
-#define PORT 5556 /* listen to 5556 port */
+#define PORT 5556 /* listen to 5556 port */
#define DH_BITS 1024
/* These are global */
gnutls_dh_params_t dh_params;
/* Defined in a previous example */
-extern int generate_dh_params( void);
-extern gnutls_session_t initialize_tls_session( void);
+extern int generate_dh_params(void);
+extern gnutls_session_t initialize_tls_session(void);
int main()
{
- int err, listen_sd, i;
- int sd, ret;
- struct sockaddr_in sa_serv;
- struct sockaddr_in sa_cli;
- int client_len;
- char topbuf[512];
- gnutls_session_t session;
- char buffer[MAX_BUF + 1];
- int optval = 1;
- char name[256];
-
- strcpy(name, "Echo Server");
-
- /* this must be called once in the program
- */
- gnutls_global_init();
-
- gnutls_certificate_allocate_credentials( &cred);
- gnutls_certificate_set_openpgp_keyring_file( cred, RINGFILE);
-
- gnutls_certificate_set_openpgp_key_file( cred, CERTFILE, KEYFILE);
-
- generate_dh_params();
-
- gnutls_certificate_set_dh_params( cred, dh_params);
-
- /* Socket operations
- */
- listen_sd = socket(AF_INET, SOCK_STREAM, 0);
- SOCKET_ERR(listen_sd, "socket");
-
- memset(&sa_serv, '\0', sizeof(sa_serv));
- sa_serv.sin_family = AF_INET;
- sa_serv.sin_addr.s_addr = INADDR_ANY;
- sa_serv.sin_port = htons(PORT); /* Server Port number */
-
- setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(int));
-
- err = bind(listen_sd, (SA *) & sa_serv, sizeof(sa_serv));
- SOCKET_ERR(err, "bind");
- err = listen(listen_sd, 1024);
- SOCKET_ERR(err, "listen");
-
- printf("%s ready. Listening to port '%d'.\n\n", name, PORT);
-
- client_len = sizeof(sa_cli);
- for (;;) {
- session = initialize_tls_session();
- gnutls_certificate_type_set_priority(session, cert_type_priority);
-
- sd = accept(listen_sd, (SA *) & sa_cli, &client_len);
-
- printf("- connection from %s, port %d\n",
- inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
- sizeof(topbuf)), ntohs(sa_cli.sin_port));
-
- gnutls_transport_set_ptr( session, (gnutls_transport_ptr_t)sd);
- ret = gnutls_handshake( session);
- if (ret < 0) {
- close(sd);
- gnutls_deinit(session);
- fprintf(stderr, "*** Handshake has failed (%s)\n\n",
- gnutls_strerror(ret));
- continue;
- }
- printf("- Handshake was completed\n");
-
- /* see the Getting peer's information example */
- /* print_info(session); */
-
- i = 0;
- for (;;) {
- bzero(buffer, MAX_BUF + 1);
- ret = gnutls_record_recv( session, buffer, MAX_BUF);
-
- if (ret == 0) {
- printf
- ("\n- Peer has closed the GNUTLS connection\n");
- break;
- } else if (ret < 0) {
- fprintf(stderr,
- "\n*** Received corrupted data(%d). Closing the connection.\n\n",
- ret);
- break;
- } else if (ret > 0) {
- /* echo data back to the client
- */
- gnutls_record_send( session, buffer,
- strlen(buffer));
- }
- }
- printf("\n");
- gnutls_bye( session, GNUTLS_SHUT_WR); /* do not wait for
- * the peer to close the connection.
- */
-
- close(sd);
- gnutls_deinit(session);
-
- }
- close(listen_sd);
-
- gnutls_certificate_free_credentials( cred);
-
- gnutls_global_deinit();
-
- return 0;
+ int err, listen_sd, i;
+ int sd, ret;
+ struct sockaddr_in sa_serv;
+ struct sockaddr_in sa_cli;
+ int client_len;
+ char topbuf[512];
+ gnutls_session_t session;
+ char buffer[MAX_BUF + 1];
+ int optval = 1;
+ char name[256];
+
+ strcpy(name, "Echo Server");
+
+ /* this must be called once in the program
+ */
+ gnutls_global_init();
+
+ gnutls_certificate_allocate_credentials(&cred);
+ gnutls_certificate_set_openpgp_keyring_file(cred, RINGFILE);
+
+ gnutls_certificate_set_openpgp_key_file(cred, CERTFILE, KEYFILE);
+
+ generate_dh_params();
+
+ gnutls_certificate_set_dh_params(cred, dh_params);
+
+ /* Socket operations
+ */
+ listen_sd = socket(AF_INET, SOCK_STREAM, 0);
+ SOCKET_ERR(listen_sd, "socket");
+
+ memset(&sa_serv, '\0', sizeof(sa_serv));
+ sa_serv.sin_family = AF_INET;
+ sa_serv.sin_addr.s_addr = INADDR_ANY;
+ sa_serv.sin_port = htons(PORT); /* Server Port number */
+
+ setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(int));
+
+ err = bind(listen_sd, (SA *) & sa_serv, sizeof(sa_serv));
+ SOCKET_ERR(err, "bind");
+ err = listen(listen_sd, 1024);
+ SOCKET_ERR(err, "listen");
+
+ printf("%s ready. Listening to port '%d'.\n\n", name, PORT);
+
+ client_len = sizeof(sa_cli);
+ for (;;) {
+ session = initialize_tls_session();
+ gnutls_certificate_type_set_priority(session, cert_type_priority);
+
+ sd = accept(listen_sd, (SA *) & sa_cli, &client_len);
+
+ printf("- connection from %s, port %d\n",
+ inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
+ sizeof(topbuf)), ntohs(sa_cli.sin_port));
+
+ gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) sd);
+ ret = gnutls_handshake(session);
+ if (ret < 0) {
+ close(sd);
+ gnutls_deinit(session);
+ fprintf(stderr, "*** Handshake has failed (%s)\n\n",
+ gnutls_strerror(ret));
+ continue;
+ }
+ printf("- Handshake was completed\n");
+
+ /* see the Getting peer's information example */
+ /* print_info(session); */
+
+ i = 0;
+ for (;;) {
+ bzero(buffer, MAX_BUF + 1);
+ ret = gnutls_record_recv(session, buffer, MAX_BUF);
+
+ if (ret == 0) {
+ printf("\n- Peer has closed the GNUTLS connection\n");
+ break;
+ } else if (ret < 0) {
+ fprintf(stderr, "\n*** Received corrupted "
+ "data(%d). Closing the connection.\n\n", ret);
+ break;
+ } else if (ret > 0) {
+ /* echo data back to the client
+ */
+ gnutls_record_send(session, buffer, strlen(buffer));
+ }
+ }
+ printf("\n");
+ /* do not wait for the peer to close the connection.
+ */
+ gnutls_bye(session, GNUTLS_SHUT_WR);
+
+ close(sd);
+ gnutls_deinit(session);
+
+ }
+ close(listen_sd);
+
+ gnutls_certificate_free_credentials(cred);
+
+ gnutls_global_deinit();
+
+ return 0;
}
-
#define SA struct sockaddr
#define SOCKET_ERR(err,s) if(err==-1) {perror(s);return(1);}
#define MAX_BUF 1024
-#define PORT 5556 /* listen to 5556 port */
+#define PORT 5556 /* listen to 5556 port */
/* These are global */
gnutls_srp_server_credentials_t srp_cred;
gnutls_session_t initialize_tls_session()
{
- gnutls_session_t session;
- const int kx_priority[] = { GNUTLS_KX_SRP, GNUTLS_KX_SRP_DSS,
- GNUTLS_KX_SRP_RSA, 0 };
+ gnutls_session_t session;
+ const int kx_priority[] = { GNUTLS_KX_SRP, GNUTLS_KX_SRP_DSS,
+ GNUTLS_KX_SRP_RSA, 0
+ };
- gnutls_init(&session, GNUTLS_SERVER);
+ gnutls_init(&session, GNUTLS_SERVER);
- gnutls_set_default_priority(session);
- gnutls_kx_set_priority(session, kx_priority);
+ gnutls_set_default_priority(session);
+ gnutls_kx_set_priority(session, kx_priority);
- gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);
- /* for the certificate authenticated ciphersuites.
- */
- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred);
+ gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);
+ /* for the certificate authenticated ciphersuites.
+ */
+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred);
- /* request client certificate if any.
- */
- gnutls_certificate_server_set_request( session, GNUTLS_CERT_IGNORE);
+ /* request client certificate if any.
+ */
+ gnutls_certificate_server_set_request(session, GNUTLS_CERT_IGNORE);
- return session;
+ return session;
}
int main()
{
- int err, listen_sd, i;
- int sd, ret;
- struct sockaddr_in sa_serv;
- struct sockaddr_in sa_cli;
- int client_len;
- char topbuf[512];
- gnutls_session_t session;
- char buffer[MAX_BUF + 1];
- int optval = 1;
- char name[256];
-
- strcpy(name, "Echo Server");
-
- /* these must be called once in the program
- */
- gnutls_global_init();
- gnutls_global_init_extra(); /* for SRP */
-
- /* SRP_PASSWD a password file (created with the included srptool utility)
- */
- gnutls_srp_allocate_server_credentials(&srp_cred);
- gnutls_srp_set_server_credentials_file(srp_cred, SRP_PASSWD, SRP_PASSWD_CONF);
-
- gnutls_certificate_allocate_credentials(&cert_cred);
- gnutls_certificate_set_x509_trust_file(cert_cred, CAFILE, GNUTLS_X509_FMT_PEM);
- gnutls_certificate_set_x509_key_file(cert_cred, CERTFILE, KEYFILE,
- GNUTLS_X509_FMT_PEM);
-
- /* TCP socket operations
- */
- listen_sd = socket(AF_INET, SOCK_STREAM, 0);
- SOCKET_ERR(listen_sd, "socket");
-
- memset(&sa_serv, '\0', sizeof(sa_serv));
- sa_serv.sin_family = AF_INET;
- sa_serv.sin_addr.s_addr = INADDR_ANY;
- sa_serv.sin_port = htons(PORT); /* Server Port number */
-
- setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(int));
-
- err = bind(listen_sd, (SA *) & sa_serv, sizeof(sa_serv));
- SOCKET_ERR(err, "bind");
- err = listen(listen_sd, 1024);
- SOCKET_ERR(err, "listen");
-
- printf("%s ready. Listening to port '%d'.\n\n", name, PORT);
-
- client_len = sizeof(sa_cli);
- for (;;) {
- session = initialize_tls_session();
-
- sd = accept(listen_sd, (SA *) & sa_cli, &client_len);
-
- printf("- connection from %s, port %d\n",
- inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
- sizeof(topbuf)), ntohs(sa_cli.sin_port));
-
- gnutls_transport_set_ptr( session, (gnutls_transport_ptr_t)sd);
- ret = gnutls_handshake( session);
- if (ret < 0) {
- close(sd);
- gnutls_deinit(session);
- fprintf(stderr, "*** Handshake has failed (%s)\n\n",
- gnutls_strerror(ret));
- continue;
- }
- printf("- Handshake was completed\n");
-
- /* print_info(session); */
-
- i = 0;
- for (;;) {
- bzero(buffer, MAX_BUF + 1);
- ret = gnutls_record_recv( session, buffer, MAX_BUF);
-
- if (ret == 0) {
- printf
- ("\n- Peer has closed the GNUTLS connection\n");
- break;
- } else if (ret < 0) {
- fprintf(stderr,
- "\n*** Received corrupted data(%d). Closing the connection.\n\n",
- ret);
- break;
- } else if (ret > 0) {
- /* echo data back to the client
- */
- gnutls_record_send( session, buffer,
- strlen(buffer));
- }
- }
- printf("\n");
- gnutls_bye( session, GNUTLS_SHUT_WR); /* do not wait for
- * the peer to close the connection.
- */
-
- close(sd);
- gnutls_deinit(session);
-
- }
- close(listen_sd);
-
- gnutls_srp_free_server_credentials(srp_cred);
- gnutls_certificate_free_credentials(cert_cred);
-
- gnutls_global_deinit();
-
- return 0;
+ int err, listen_sd, i;
+ int sd, ret;
+ struct sockaddr_in sa_serv;
+ struct sockaddr_in sa_cli;
+ int client_len;
+ char topbuf[512];
+ gnutls_session_t session;
+ char buffer[MAX_BUF + 1];
+ int optval = 1;
+ char name[256];
+
+ strcpy(name, "Echo Server");
+
+ /* these must be called once in the program
+ */
+ gnutls_global_init();
+ gnutls_global_init_extra(); /* for SRP */
+
+ /* SRP_PASSWD a password file (created with the included srptool utility)
+ */
+ gnutls_srp_allocate_server_credentials(&srp_cred);
+ gnutls_srp_set_server_credentials_file(srp_cred, SRP_PASSWD,
+ SRP_PASSWD_CONF);
+
+ gnutls_certificate_allocate_credentials(&cert_cred);
+ gnutls_certificate_set_x509_trust_file(cert_cred, CAFILE,
+ GNUTLS_X509_FMT_PEM);
+ gnutls_certificate_set_x509_key_file(cert_cred, CERTFILE, KEYFILE,
+ GNUTLS_X509_FMT_PEM);
+
+ /* TCP socket operations
+ */
+ listen_sd = socket(AF_INET, SOCK_STREAM, 0);
+ SOCKET_ERR(listen_sd, "socket");
+
+ memset(&sa_serv, '\0', sizeof(sa_serv));
+ sa_serv.sin_family = AF_INET;
+ sa_serv.sin_addr.s_addr = INADDR_ANY;
+ sa_serv.sin_port = htons(PORT); /* Server Port number */
+
+ setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(int));
+
+ err = bind(listen_sd, (SA *) & sa_serv, sizeof(sa_serv));
+ SOCKET_ERR(err, "bind");
+ err = listen(listen_sd, 1024);
+ SOCKET_ERR(err, "listen");
+
+ printf("%s ready. Listening to port '%d'.\n\n", name, PORT);
+
+ client_len = sizeof(sa_cli);
+ for (;;) {
+ session = initialize_tls_session();
+
+ sd = accept(listen_sd, (SA *) & sa_cli, &client_len);
+
+ printf("- connection from %s, port %d\n",
+ inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
+ sizeof(topbuf)), ntohs(sa_cli.sin_port));
+
+ gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) sd);
+ ret = gnutls_handshake(session);
+ if (ret < 0) {
+ close(sd);
+ gnutls_deinit(session);
+ fprintf(stderr, "*** Handshake has failed (%s)\n\n",
+ gnutls_strerror(ret));
+ continue;
+ }
+ printf("- Handshake was completed\n");
+
+ /* print_info(session); */
+
+ i = 0;
+ for (;;) {
+ bzero(buffer, MAX_BUF + 1);
+ ret = gnutls_record_recv(session, buffer, MAX_BUF);
+
+ if (ret == 0) {
+ printf("\n- Peer has closed the GNUTLS connection\n");
+ break;
+ } else if (ret < 0) {
+ fprintf(stderr, "\n*** Received corrupted "
+ "data(%d). Closing the connection.\n\n", ret);
+ break;
+ } else if (ret > 0) {
+ /* echo data back to the client
+ */
+ gnutls_record_send(session, buffer, strlen(buffer));
+ }
+ }
+ printf("\n");
+ /* do not wait for the peer to close the connection. */
+ gnutls_bye(session, GNUTLS_SHUT_WR);
+
+ close(sd);
+ gnutls_deinit(session);
+
+ }
+ close(listen_sd);
+
+ gnutls_srp_free_server_credentials(srp_cred);
+ gnutls_certificate_free_credentials(cert_cred);
+
+ gnutls_global_deinit();
+
+ return 0;
}
-
#define SA struct sockaddr
#define SOCKET_ERR(err,s) if(err==-1) {perror(s);return(1);}
#define MAX_BUF 1024
-#define PORT 5556 /* listen to 5556 port */
+#define PORT 5556 /* listen to 5556 port */
#define DH_BITS 1024
/* These are global */
gnutls_session_t initialize_tls_session()
{
- gnutls_session_t session;
+ gnutls_session_t session;
- gnutls_init(&session, GNUTLS_SERVER);
+ gnutls_init(&session, GNUTLS_SERVER);
- /* avoid calling all the priority functions, since the defaults
- * are adequate.
- */
- gnutls_set_default_priority( session);
+ /* avoid calling all the priority functions, since the defaults
+ * are adequate.
+ */
+ gnutls_set_default_priority(session);
- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred);
+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred);
- /* request client certificate if any.
- */
- gnutls_certificate_server_set_request( session, GNUTLS_CERT_REQUEST);
+ /* request client certificate if any.
+ */
+ gnutls_certificate_server_set_request(session, GNUTLS_CERT_REQUEST);
- gnutls_dh_set_prime_bits( session, DH_BITS);
+ gnutls_dh_set_prime_bits(session, DH_BITS);
- return session;
+ return session;
}
static gnutls_dh_params_t dh_params;
-static int generate_dh_params(void) {
-
- /* Generate Diffie Hellman parameters - for use with DHE
- * kx algorithms. These should be discarded and regenerated
- * once a day, once a week or once a month. Depending on the
- * security requirements.
- */
- gnutls_dh_params_init( &dh_params);
- gnutls_dh_params_generate2( dh_params, DH_BITS);
-
- return 0;
+static int generate_dh_params(void)
+{
+
+ /* Generate Diffie Hellman parameters - for use with DHE
+ * kx algorithms. These should be discarded and regenerated
+ * once a day, once a week or once a month. Depending on the
+ * security requirements.
+ */
+ gnutls_dh_params_init(&dh_params);
+ gnutls_dh_params_generate2(dh_params, DH_BITS);
+
+ return 0;
}
int main()
{
- int err, listen_sd, i;
- int sd, ret;
- struct sockaddr_in sa_serv;
- struct sockaddr_in sa_cli;
- int client_len;
- char topbuf[512];
- gnutls_session_t session;
- char buffer[MAX_BUF + 1];
- int optval = 1;
-
- /* this must be called once in the program
- */
- gnutls_global_init();
-
- gnutls_certificate_allocate_credentials(&x509_cred);
- gnutls_certificate_set_x509_trust_file(x509_cred, CAFILE,
- GNUTLS_X509_FMT_PEM);
-
- gnutls_certificate_set_x509_crl_file(x509_cred, CRLFILE,
- GNUTLS_X509_FMT_PEM);
-
- gnutls_certificate_set_x509_key_file(x509_cred, CERTFILE, KEYFILE,
- GNUTLS_X509_FMT_PEM);
-
- generate_dh_params();
-
- gnutls_certificate_set_dh_params( x509_cred, dh_params);
-
- /* Socket operations
- */
- listen_sd = socket(AF_INET, SOCK_STREAM, 0);
- SOCKET_ERR(listen_sd, "socket");
-
- memset(&sa_serv, '\0', sizeof(sa_serv));
- sa_serv.sin_family = AF_INET;
- sa_serv.sin_addr.s_addr = INADDR_ANY;
- sa_serv.sin_port = htons(PORT); /* Server Port number */
-
- setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(int));
-
- err = bind(listen_sd, (SA *) & sa_serv, sizeof(sa_serv));
- SOCKET_ERR(err, "bind");
- err = listen(listen_sd, 1024);
- SOCKET_ERR(err, "listen");
-
- printf("Server ready. Listening to port '%d'.\n\n", PORT);
-
- client_len = sizeof(sa_cli);
- for (;;) {
- session = initialize_tls_session();
-
- sd = accept(listen_sd, (SA *) & sa_cli, &client_len);
-
- printf("- connection from %s, port %d\n",
- inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
- sizeof(topbuf)), ntohs(sa_cli.sin_port));
-
- gnutls_transport_set_ptr( session, (gnutls_transport_ptr_t)sd);
- ret = gnutls_handshake( session);
- if (ret < 0) {
- close(sd);
- gnutls_deinit(session);
- fprintf(stderr, "*** Handshake has failed (%s)\n\n",
- gnutls_strerror(ret));
- continue;
- }
- printf("- Handshake was completed\n");
-
- /* see the Getting peer's information example */
- /* print_info(session); */
-
- i = 0;
- for (;;) {
- bzero(buffer, MAX_BUF + 1);
- ret = gnutls_record_recv( session, buffer, MAX_BUF);
-
- if (ret == 0) {
- printf
- ("\n- Peer has closed the GNUTLS connection\n");
- break;
- } else if (ret < 0) {
- fprintf(stderr,
- "\n*** Received corrupted data(%d). Closing the connection.\n\n",
- ret);
- break;
- } else if (ret > 0) {
- /* echo data back to the client
- */
- gnutls_record_send( session, buffer,
- strlen(buffer));
- }
- }
- printf("\n");
- gnutls_bye( session, GNUTLS_SHUT_WR); /* do not wait for
- * the peer to close the connection.
- */
-
- close(sd);
- gnutls_deinit(session);
-
- }
- close(listen_sd);
-
- gnutls_certificate_free_credentials(x509_cred);
-
- gnutls_global_deinit();
-
- return 0;
+ int err, listen_sd, i;
+ int sd, ret;
+ struct sockaddr_in sa_serv;
+ struct sockaddr_in sa_cli;
+ int client_len;
+ char topbuf[512];
+ gnutls_session_t session;
+ char buffer[MAX_BUF + 1];
+ int optval = 1;
+
+ /* this must be called once in the program
+ */
+ gnutls_global_init();
+
+ gnutls_certificate_allocate_credentials(&x509_cred);
+ gnutls_certificate_set_x509_trust_file(x509_cred, CAFILE,
+ GNUTLS_X509_FMT_PEM);
+
+ gnutls_certificate_set_x509_crl_file(x509_cred, CRLFILE,
+ GNUTLS_X509_FMT_PEM);
+
+ gnutls_certificate_set_x509_key_file(x509_cred, CERTFILE, KEYFILE,
+ GNUTLS_X509_FMT_PEM);
+
+ generate_dh_params();
+
+ gnutls_certificate_set_dh_params(x509_cred, dh_params);
+
+ /* Socket operations
+ */
+ listen_sd = socket(AF_INET, SOCK_STREAM, 0);
+ SOCKET_ERR(listen_sd, "socket");
+
+ memset(&sa_serv, '\0', sizeof(sa_serv));
+ sa_serv.sin_family = AF_INET;
+ sa_serv.sin_addr.s_addr = INADDR_ANY;
+ sa_serv.sin_port = htons(PORT); /* Server Port number */
+
+ setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(int));
+
+ err = bind(listen_sd, (SA *) & sa_serv, sizeof(sa_serv));
+ SOCKET_ERR(err, "bind");
+ err = listen(listen_sd, 1024);
+ SOCKET_ERR(err, "listen");
+
+ printf("Server ready. Listening to port '%d'.\n\n", PORT);
+
+ client_len = sizeof(sa_cli);
+ for (;;) {
+ session = initialize_tls_session();
+
+ sd = accept(listen_sd, (SA *) & sa_cli, &client_len);
+
+ printf("- connection from %s, port %d\n",
+ inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
+ sizeof(topbuf)), ntohs(sa_cli.sin_port));
+
+ gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) sd);
+ ret = gnutls_handshake(session);
+ if (ret < 0) {
+ close(sd);
+ gnutls_deinit(session);
+ fprintf(stderr, "*** Handshake has failed (%s)\n\n",
+ gnutls_strerror(ret));
+ continue;
+ }
+ printf("- Handshake was completed\n");
+
+ /* see the Getting peer's information example */
+ /* print_info(session); */
+
+ i = 0;
+ for (;;) {
+ bzero(buffer, MAX_BUF + 1);
+ ret = gnutls_record_recv(session, buffer, MAX_BUF);
+
+ if (ret == 0) {
+ printf("\n- Peer has closed the GNUTLS connection\n");
+ break;
+ } else if (ret < 0) {
+ fprintf(stderr, "\n*** Received corrupted "
+ "data(%d). Closing the connection.\n\n", ret);
+ break;
+ } else if (ret > 0) {
+ /* echo data back to the client
+ */
+ gnutls_record_send(session, buffer, strlen(buffer));
+ }
+ }
+ printf("\n");
+ /* do not wait for the peer to close the connection.
+ */
+ gnutls_bye(session, GNUTLS_SHUT_WR);
+
+ close(sd);
+ gnutls_deinit(session);
+
+ }
+ close(listen_sd);
+
+ gnutls_certificate_free_credentials(x509_cred);
+
+ gnutls_global_deinit();
+
+ return 0;
}
-
*/
int print_info(gnutls_session_t session)
{
- const char *tmp;
- gnutls_credentials_type_t cred;
- gnutls_kx_algorithm_t kx;
-
- /* print the key exchange's algorithm name
- */
- kx = gnutls_kx_get(session);
- tmp = gnutls_kx_get_name(kx);
- printf("- Key Exchange: %s\n", tmp);
-
- /* Check the authentication type used and switch
- * to the appropriate.
- */
- cred = gnutls_auth_get_type(session);
- switch (cred) {
- case GNUTLS_CRD_ANON: /* anonymous authentication */
-
- printf("- Anonymous DH using prime of %d bits\n",
- gnutls_dh_get_prime_bits(session));
- break;
-
- case GNUTLS_CRD_CERTIFICATE: /* certificate authentication */
-
- /* Check if we have been using ephemeral Diffie Hellman.
- */
- if (kx == GNUTLS_KX_DHE_RSA || kx == GNUTLS_KX_DHE_DSS) {
- printf("\n- Ephemeral DH using prime of %d bits\n",
- gnutls_dh_get_prime_bits(session));
- }
-
- /* if the certificate list is available, then
- * print some information about it.
- */
- print_x509_certificate_info(session);
-
- } /* switch */
-
- /* print the protocol's name (ie TLS 1.0)
- */
- tmp = gnutls_protocol_get_name(gnutls_protocol_get_version(session));
- printf("- Protocol: %s\n", tmp);
-
- /* print the certificate type of the peer.
- * ie X.509
- */
- tmp = gnutls_certificate_type_get_name(
- gnutls_certificate_type_get(session));
-
- printf("- Certificate Type: %s\n", tmp);
-
- /* print the compression algorithm (if any)
- */
- tmp = gnutls_compression_get_name( gnutls_compression_get(session));
- printf("- Compression: %s\n", tmp);
-
- /* print the name of the cipher used.
- * ie 3DES.
- */
- tmp = gnutls_cipher_get_name(gnutls_cipher_get(session));
- printf("- Cipher: %s\n", tmp);
-
- /* Print the MAC algorithms name.
- * ie SHA1
- */
- tmp = gnutls_mac_get_name(gnutls_mac_get(session));
- printf("- MAC: %s\n", tmp);
-
- return 0;
+ const char *tmp;
+ gnutls_credentials_type_t cred;
+ gnutls_kx_algorithm_t kx;
+
+ /* print the key exchange's algorithm name
+ */
+ kx = gnutls_kx_get(session);
+ tmp = gnutls_kx_get_name(kx);
+ printf("- Key Exchange: %s\n", tmp);
+
+ /* Check the authentication type used and switch
+ * to the appropriate.
+ */
+ cred = gnutls_auth_get_type(session);
+ switch (cred) {
+ case GNUTLS_CRD_ANON: /* anonymous authentication */
+
+ printf("- Anonymous DH using prime of %d bits\n",
+ gnutls_dh_get_prime_bits(session));
+ break;
+
+ case GNUTLS_CRD_CERTIFICATE: /* certificate authentication */
+
+ /* Check if we have been using ephemeral Diffie Hellman.
+ */
+ if (kx == GNUTLS_KX_DHE_RSA || kx == GNUTLS_KX_DHE_DSS) {
+ printf("\n- Ephemeral DH using prime of %d bits\n",
+ gnutls_dh_get_prime_bits(session));
+ }
+
+ /* if the certificate list is available, then
+ * print some information about it.
+ */
+ print_x509_certificate_info(session);
+
+ } /* switch */
+
+ /* print the protocol's name (ie TLS 1.0)
+ */
+ tmp = gnutls_protocol_get_name(gnutls_protocol_get_version(session));
+ printf("- Protocol: %s\n", tmp);
+
+ /* print the certificate type of the peer.
+ * ie X.509
+ */
+ tmp =
+ gnutls_certificate_type_get_name(gnutls_certificate_type_get
+ (session));
+
+ printf("- Certificate Type: %s\n", tmp);
+
+ /* print the compression algorithm (if any)
+ */
+ tmp = gnutls_compression_get_name(gnutls_compression_get(session));
+ printf("- Compression: %s\n", tmp);
+
+ /* print the name of the cipher used.
+ * ie 3DES.
+ */
+ tmp = gnutls_cipher_get_name(gnutls_cipher_get(session));
+ printf("- Cipher: %s\n", tmp);
+
+ /* Print the MAC algorithms name.
+ * ie SHA1
+ */
+ tmp = gnutls_mac_get_name(gnutls_mac_get(session));
+ printf("- MAC: %s\n", tmp);
+
+ return 0;
}
-
/* All the available CRLs
*/
-extern gnutls_x509_crl_t* crl_list;
+extern gnutls_x509_crl_t *crl_list;
extern int crl_list_size;
/* All the available trusted CAs
*/
-extern gnutls_x509_crt_t* ca_list;
+extern gnutls_x509_crt_t *ca_list;
extern int ca_list_size;
static void verify_cert2(gnutls_x509_crt_t crt,
- gnutls_x509_crt_t issuer, gnutls_x509_crl_t * crl_list, int crl_list_size);
+ gnutls_x509_crt_t issuer,
+ gnutls_x509_crl_t * crl_list, int crl_list_size);
static void verify_last_cert(gnutls_x509_crt_t crt,
- gnutls_x509_crt_t *ca_list, int ca_list_size,
- gnutls_x509_crl_t * crl_list, int crl_list_size);
+ gnutls_x509_crt_t * ca_list, int ca_list_size,
+ gnutls_x509_crl_t * crl_list,
+ int crl_list_size);
/* This function will try to verify the peer's certificate chain, and
* also check if the hostname matches, and the activation, expiration dates.
*/
-void verify_certificate_chain( gnutls_session_t session, const char* hostname,
- const gnutls_datum_t* cert_chain, int cert_chain_length)
+void verify_certificate_chain(gnutls_session_t session,
+ const char *hostname,
+ const gnutls_datum_t * cert_chain,
+ int cert_chain_length)
{
- int i, ret;
- gnutls_x509_crt_t cert[cert_chain_length];
-
- /* Import all the certificates in the chain to
- * native certificate format.
- */
- for (i=0;i<cert_chain_length;i++) {
- gnutls_x509_crt_init(&cert[i]);
- gnutls_x509_crt_import( cert[i], &cert_chain[i], GNUTLS_X509_FMT_DER);
- }
-
- /* Now verify the certificates against their issuers
- * in the chain.
- */
- for (i=1;i<cert_chain_length;i++) {
- verify_cert2( cert[i-1], cert[i], crl_list, crl_list_size);
- }
-
- /* Here we must verify the last certificate in the chain against
- * our trusted CA list.
- */
- verify_last_cert( cert[cert_chain_length-1],
- ca_list, ca_list_size, crl_list, crl_list_size);
-
- /* Check if the name in the first certificate matches our destination!
- */
- if ( !gnutls_x509_crt_check_hostname( cert[0], hostname)) {
- printf("The certificate's owner does not match hostname '%s'\n", hostname);
- }
-
- for (i=0;i<cert_chain_length;i++)
- gnutls_x509_crt_deinit( cert[i]);
-
- return;
+ int i, ret;
+ gnutls_x509_crt_t cert[cert_chain_length];
+
+ /* Import all the certificates in the chain to
+ * native certificate format.
+ */
+ for (i = 0; i < cert_chain_length; i++) {
+ gnutls_x509_crt_init(&cert[i]);
+ gnutls_x509_crt_import(cert[i], &cert_chain[i],
+ GNUTLS_X509_FMT_DER);
+ }
+
+ /* Now verify the certificates against their issuers
+ * in the chain.
+ */
+ for (i = 1; i < cert_chain_length; i++) {
+ verify_cert2(cert[i - 1], cert[i], crl_list, crl_list_size);
+ }
+
+ /* Here we must verify the last certificate in the chain against
+ * our trusted CA list.
+ */
+ verify_last_cert(cert[cert_chain_length - 1],
+ ca_list, ca_list_size, crl_list, crl_list_size);
+
+ /* Check if the name in the first certificate matches our destination!
+ */
+ if (!gnutls_x509_crt_check_hostname(cert[0], hostname)) {
+ printf("The certificate's owner does not match hostname '%s'\n",
+ hostname);
+ }
+
+ for (i = 0; i < cert_chain_length; i++)
+ gnutls_x509_crt_deinit(cert[i]);
+
+ return;
}
* crl_list if the certificate is revoked.
*/
static void verify_cert2(gnutls_x509_crt crt_t,
- gnutls_x509_crt_t issuer, gnutls_x509_crl_t * crl_list, int crl_list_size)
-{
- unsigned int output;
- int ret;
- time_t now = time(0);
- size_t name_size;
- char name[64];
-
- /* Print information about the certificates to
- * be checked.
- */
- name_size = sizeof(name);
- gnutls_x509_crt_get_dn( crt, name, &name_size);
+ gnutls_x509_crt_t issuer,
+ gnutls_x509_crl_t * crl_list, int crl_list_size)
+{
+ unsigned int output;
+ int ret;
+ time_t now = time(0);
+ size_t name_size;
+ char name[64];
+
+ /* Print information about the certificates to
+ * be checked.
+ */
+ name_size = sizeof(name);
+ gnutls_x509_crt_get_dn(crt, name, &name_size);
- fprintf(stderr, "\nCertificate: %s\n", name);
+ fprintf(stderr, "\nCertificate: %s\n", name);
- name_size = sizeof(name);
- gnutls_x509_crt_get_issuer_dn(crt, name, &name_size);
+ name_size = sizeof(name);
+ gnutls_x509_crt_get_issuer_dn(crt, name, &name_size);
- fprintf(stderr, "Issued by: %s\n", name);
+ fprintf(stderr, "Issued by: %s\n", name);
- /* Get the DN of the issuer cert.
- */
- name_size = sizeof(name);
- gnutls_x509_crt_get_dn(issuer, name, &name_size);
+ /* Get the DN of the issuer cert.
+ */
+ name_size = sizeof(name);
+ gnutls_x509_crt_get_dn(issuer, name, &name_size);
- fprintf(stderr, "Checking against: %s\n", name);
+ fprintf(stderr, "Checking against: %s\n", name);
- /* Do the actual verification.
- */
- gnutls_x509_crt_verify(crt, &issuer, 1, 0, &output);
+ /* Do the actual verification.
+ */
+ gnutls_x509_crt_verify(crt, &issuer, 1, 0, &output);
- if (output & GNUTLS_CERT_INVALID) {
- fprintf(stderr, "Not trusted");
+ if (output & GNUTLS_CERT_INVALID) {
+ fprintf(stderr, "Not trusted");
- if (output & GNUTLS_CERT_SIGNER_NOT_FOUND)
- fprintf(stderr, ": no issuer was found");
- if (output & GNUTLS_CERT_SIGNER_NOT_CA)
- fprintf(stderr, ": issuer is not a CA");
+ if (output & GNUTLS_CERT_SIGNER_NOT_FOUND)
+ fprintf(stderr, ": no issuer was found");
+ if (output & GNUTLS_CERT_SIGNER_NOT_CA)
+ fprintf(stderr, ": issuer is not a CA");
- fprintf(stderr, "\n");
- } else
- fprintf(stderr, "Trusted\n");
+ fprintf(stderr, "\n");
+ } else
+ fprintf(stderr, "Trusted\n");
/* Now check the expiration dates.
*/
- if (gnutls_x509_crt_get_activation_time(crt) > now)
- fprintf(stderr, "Not yet activated\n");
+ if (gnutls_x509_crt_get_activation_time(crt) > now)
+ fprintf(stderr, "Not yet activated\n");
- if (gnutls_x509_crt_get_expiration_time(crt) < now)
- fprintf(stderr, "Expired\n");
+ if (gnutls_x509_crt_get_expiration_time(crt) < now)
+ fprintf(stderr, "Expired\n");
/* Check if the certificate is revoked.
*/
- ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size);
- if (ret == 1) { /* revoked */
- fprintf(stderr, "Revoked\n");
- }
+ ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size);
+ if (ret == 1) { /* revoked */
+ fprintf(stderr, "Revoked\n");
+ }
}
* Also checks the crl_list if the certificate is revoked.
*/
static void verify_last_cert(gnutls_x509_crt_t crt,
- gnutls_x509_crt_t *ca_list, int ca_list_size,
- gnutls_x509_crl_t * crl_list, int crl_list_size)
-{
- unsigned int output;
- int ret;
- time_t now = time(0);
- size_t name_size;
- char name[64];
-
- /* Print information about the certificates to
- * be checked.
- */
- name_size = sizeof(name);
- gnutls_x509_crt_get_dn( crt, name, &name_size);
+ gnutls_x509_crt_t * ca_list, int ca_list_size,
+ gnutls_x509_crl_t * crl_list,
+ int crl_list_size)
+{
+ unsigned int output;
+ int ret;
+ time_t now = time(0);
+ size_t name_size;
+ char name[64];
+
+ /* Print information about the certificates to
+ * be checked.
+ */
+ name_size = sizeof(name);
+ gnutls_x509_crt_get_dn(crt, name, &name_size);
- fprintf(stderr, "\nCertificate: %s\n", name);
+ fprintf(stderr, "\nCertificate: %s\n", name);
- name_size = sizeof(name);
- gnutls_x509_crt_get_issuer_dn(crt, name, &name_size);
+ name_size = sizeof(name);
+ gnutls_x509_crt_get_issuer_dn(crt, name, &name_size);
- fprintf(stderr, "Issued by: %s\n", name);
+ fprintf(stderr, "Issued by: %s\n", name);
- /* Do the actual verification.
- */
- gnutls_x509_crt_verify(crt, ca_list, ca_list_size, 0, &output);
+ /* Do the actual verification.
+ */
+ gnutls_x509_crt_verify(crt, ca_list, ca_list_size, 0, &output);
- if (output & GNUTLS_CERT_INVALID) {
- fprintf(stderr, "Not trusted");
+ if (output & GNUTLS_CERT_INVALID) {
+ fprintf(stderr, "Not trusted");
- if (output & GNUTLS_CERT_SIGNER_NOT_CA)
- fprintf(stderr, ": Issuer is not a CA\n");
- else
- fprintf(stderr, "\n");
- } else
- fprintf(stderr, "Trusted\n");
+ if (output & GNUTLS_CERT_SIGNER_NOT_CA)
+ fprintf(stderr, ": Issuer is not a CA\n");
+ else
+ fprintf(stderr, "\n");
+ } else
+ fprintf(stderr, "Trusted\n");
/* Now check the expiration dates.
*/
- if (gnutls_x509_crt_get_activation_time(crt) > now)
- fprintf(stderr, "Not yet activated\n");
-
- if (gnutls_x509_crt_get_expiration_time(crt) < now)
- fprintf(stderr, "Expired\n");
-
- /* Check if the certificate is revoked.
- */
- ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size);
- if (ret == 1) { /* revoked */
- fprintf(stderr, "Revoked\n");
- }
-}
+ if (gnutls_x509_crt_get_activation_time(crt) > now)
+ fprintf(stderr, "Not yet activated\n");
+
+ if (gnutls_x509_crt_get_expiration_time(crt) < now)
+ fprintf(stderr, "Expired\n");
+ /* Check if the certificate is revoked.
+ */
+ ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size);
+ if (ret == 1) { /* revoked */
+ fprintf(stderr, "Revoked\n");
+ }
+}
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
-static const char* bin2hex( const void* bin, size_t bin_size)
+static const char *bin2hex(const void *bin, size_t bin_size)
{
-static char printable[110];
-unsigned char *_bin = bin;
-char* print;
+ static char printable[110];
+ unsigned char *_bin = bin;
+ char *print;
- if (bin_size > 50) bin_size = 50;
+ if (bin_size > 50)
+ bin_size = 50;
- print = printable;
- for (i = 0; i < bin_size; i++) {
- sprintf(print, "%.2x ", _bin[i]);
- print += 2;
- }
+ print = printable;
+ for (i = 0; i < bin_size; i++) {
+ sprintf(print, "%.2x ", _bin[i]);
+ print += 2;
+ }
- return printable;
+ return printable;
}
/* This function will print information about this session's peer
*/
static void print_x509_certificate_info(gnutls_session_t session)
{
- char serial[40];
- char dn[128];
- int i;
- size_t size;
- unsigned int algo, bits;
- time_t expiration_time, activation_time;
- const gnutls_datum_t *cert_list;
- int cert_list_size = 0;
- gnutls_x509_crt_t cert;
+ char serial[40];
+ char dn[128];
+ int i;
+ size_t size;
+ unsigned int algo, bits;
+ time_t expiration_time, activation_time;
+ const gnutls_datum_t *cert_list;
+ int cert_list_size = 0;
+ gnutls_x509_crt_t cert;
- /* This function only works for X.509 certificates.
- */
- if (gnutls_certificate_type_get(session) != GNUTLS_CRT_X509)
- return;
+ /* This function only works for X.509 certificates.
+ */
+ if (gnutls_certificate_type_get(session) != GNUTLS_CRT_X509)
+ return;
- cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
+ cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
- printf("Peer provided %d certificates.\n", cert_list_size);
+ printf("Peer provided %d certificates.\n", cert_list_size);
- if (cert_list_size > 0) {
+ if (cert_list_size > 0) {
- /* we only print information about the first certificate.
- */
- gnutls_x509_crt_init( &cert);
+ /* we only print information about the first certificate.
+ */
+ gnutls_x509_crt_init(&cert);
- gnutls_x509_crt_import( cert, &cert_list[0]);
+ gnutls_x509_crt_import(cert, &cert_list[0]);
- printf("Certificate info:\n");
+ printf("Certificate info:\n");
- expiration_time = gnutls_x509_crt_get_expiration_time( cert);
- activation_time = gnutls_x509_crt_get_activation_time( cert);
+ expiration_time = gnutls_x509_crt_get_expiration_time(cert);
+ activation_time = gnutls_x509_crt_get_activation_time(cert);
- printf("\tCertificate is valid since: %s", ctime(&activation_time));
- printf("\tCertificate expires: %s", ctime(&expiration_time));
+ printf("\tCertificate is valid since: %s",
+ ctime(&activation_time));
+ printf("\tCertificate expires: %s", ctime(&expiration_time));
- /* Print the serial number of the certificate.
- */
- size = sizeof(serial);
- gnutls_x509_crt_get_serial(cert, serial, &size);
+ /* Print the serial number of the certificate.
+ */
+ size = sizeof(serial);
+ gnutls_x509_crt_get_serial(cert, serial, &size);
- size = sizeof( serial);
- printf("\tCertificate serial number: %s\n",
- bin2hex( serial, size));
+ size = sizeof(serial);
+ printf("\tCertificate serial number: %s\n", bin2hex(serial, size));
- /* Extract some of the public key algorithm's parameters
- */
- algo =
- gnutls_x509_crt_get_pk_algorithm(cert, &bits);
+ /* Extract some of the public key algorithm's parameters
+ */
+ algo = gnutls_x509_crt_get_pk_algorithm(cert, &bits);
- printf("Certificate public key: %s", gnutls_pk_algorithm_get_name(algo));
+ printf("Certificate public key: %s",
+ gnutls_pk_algorithm_get_name(algo));
- /* Print the version of the X.509
- * certificate.
- */
- printf("\tCertificate version: #%d\n",
- gnutls_x509_crt_get_version( cert));
+ /* Print the version of the X.509
+ * certificate.
+ */
+ printf("\tCertificate version: #%d\n",
+ gnutls_x509_crt_get_version(cert));
- size = sizeof(dn);
- gnutls_x509_crt_get_dn( cert, dn, &size);
- printf("\tDN: %s\n", dn);
+ size = sizeof(dn);
+ gnutls_x509_crt_get_dn(cert, dn, &size);
+ printf("\tDN: %s\n", dn);
- size = sizeof(dn);
- gnutls_x509_crt_get_issuer_dn( cert, dn, &size);
- printf("\tIssuer's DN: %s\n", dn);
+ size = sizeof(dn);
+ gnutls_x509_crt_get_issuer_dn(cert, dn, &size);
+ printf("\tIssuer's DN: %s\n", dn);
- gnutls_x509_crt_deinit( cert);
+ gnutls_x509_crt_deinit(cert);
- }
+ }
}
-
projects / thirdparty / gnutls.git / commitdiff
