Add, PSK self test.

diff --git a/doc/examples/ex-client-psk.c b/doc/examples/ex-client-psk.c
new file mode 100644 (file)
index 0000000..3b2f280
--- /dev/null
+++ b/doc/examples/ex-client-psk.c
@@ -0,0 +1,119 @@
+/* Copyright 2007, 2008 Free Software Foundation
+ *
+ * Copying and distribution of this file, with or without modification,
+ * are permitted in any medium without royalty provided the copyright
+ * notice and this notice are preserved.
+ */
+
+#if HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <gnutls/gnutls.h>
+
+/* A very basic TLS client, with PSK authentication.
+ */
+
+#define MAX_BUF 1024
+#define CAFILE "ca.pem"
+#define MSG "GET / HTTP/1.0\r\n\r\n"
+
+extern int tcp_connect (void);
+extern void tcp_close (int sd);
+
+int
+main (void)
+{
+  int ret, sd, ii;
+  gnutls_session_t session;
+  char buffer[MAX_BUF + 1];
+  const char *err;
+  gnutls_psk_client_credentials_t pskcred;
+  const gnutls_datum_t key = { "DEADBEEF", 8 };
+
+  gnutls_global_init ();
+
+  gnutls_psk_allocate_client_credentials (&pskcred);
+  gnutls_psk_set_client_credentials (pskcred, "test", &key,
+                                    GNUTLS_PSK_KEY_HEX);
+
+  /* Initialize TLS session 
+   */
+  gnutls_init (&session, GNUTLS_CLIENT);
+
+  /* Use default priorities */
+  ret = gnutls_priority_set_direct (session, "PERFORMANCE", &err);
+  if (ret < 0) {
+    if (ret == GNUTLS_E_INVALID_REQUEST) {
+      fprintf(stderr, "Syntax error at: %s\n", err);
+    }
+    exit(1);
+  }
+
+  /* put the x509 credentials to the current session
+   */
+  gnutls_credentials_set (session, GNUTLS_CRD_PSK, pskcred);
+
+  /* connect to the peer
+   */
+  sd = tcp_connect ();
+
+  gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+
+  /* Perform the TLS handshake
+   */
+  ret = gnutls_handshake (session);
+
+  if (ret < 0)
+    {
+      fprintf (stderr, "*** Handshake failed\n");
+      gnutls_perror (ret);
+      goto end;
+    }
+  else
+    {
+      printf ("- Handshake was completed\n");
+    }
+
+  gnutls_record_send (session, MSG, strlen (MSG));
+
+  ret = gnutls_record_recv (session, buffer, MAX_BUF);
+  if (ret == 0)
+    {
+      printf ("- Peer has closed the TLS connection\n");
+      goto end;
+    }
+  else if (ret < 0)
+    {
+      fprintf (stderr, "*** Error: %s\n", gnutls_strerror (ret));
+      goto end;
+    }
+
+  printf ("- Received %d bytes: ", ret);
+  for (ii = 0; ii < ret; ii++)
+    {
+      fputc (buffer[ii], stdout);
+    }
+  fputs ("\n", stdout);
+
+  gnutls_bye (session, GNUTLS_SHUT_RDWR);
+
+end:
+
+  tcp_close (sd);
+
+  gnutls_deinit (session);
+
+  gnutls_psk_free_client_credentials (pskcred);
+
+  gnutls_global_deinit ();
+
+  return 0;
+}

diff --git a/doc/examples/ex-serv-psk.c b/doc/examples/ex-serv-psk.c
new file mode 100644 (file)
index 0000000..840eb8b
--- /dev/null
+++ b/doc/examples/ex-serv-psk.c
@@ -0,0 +1,225 @@
+/* Copyright 2007, 2008 Free Software Foundation
+ *
+ * Copying and distribution of this file, with or without modification,
+ * are permitted in any medium without royalty provided the copyright
+ * notice and this notice are preserved.
+ */
+
+#if HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <string.h>
+#include <unistd.h>
+#include <gnutls/gnutls.h>
+#include <gcrypt.h> /* for gcry_control */
+
+#define KEYFILE "key.pem"
+#define CERTFILE "cert.pem"
+#define CAFILE "ca.pem"
+#define CRLFILE "crl.pem"
+
+/* This is a sample TLS 1.0 echo server, using PSK authentication.
+ */
+
+
+#define SA struct sockaddr
+#define SOCKET_ERR(err,s) if(err==-1) {perror(s);return(1);}
+#define MAX_BUF 1024
+#define PORT 5556              /* listen to 5556 port */
+#define DH_BITS 1024
+
+/* These are global */
+gnutls_certificate_credentials_t x509_cred;
+gnutls_psk_server_credentials_t psk_cred;
+gnutls_priority_t priority_cache;
+
+gnutls_session_t
+initialize_tls_session (void)
+{
+  gnutls_session_t session;
+
+  gnutls_init (&session, GNUTLS_SERVER);
+
+  gnutls_priority_set (session, priority_cache);
+
+  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);
+  gnutls_credentials_set (session, GNUTLS_CRD_PSK, psk_cred);
+
+  /* request client certificate if any.
+   */
+  gnutls_certificate_server_set_request (session, GNUTLS_CERT_REQUEST);
+
+  return session;
+}
+
+static gnutls_dh_params_t dh_params;
+
+static int
+generate_dh_params (void)
+{
+
+  /* Generate Diffie Hellman parameters - for use with DHE
+   * kx algorithms. When short bit length is used, it might
+   * be wise to regenerate parameters.
+   *
+   * Check the ex-serv-export.c example for using static
+   * parameters.
+   */
+  gnutls_dh_params_init (&dh_params);
+  gnutls_dh_params_generate2 (dh_params, DH_BITS);
+
+  return 0;
+}
+
+static int
+pskfunc (gnutls_session_t session, const char *username, gnutls_datum_t * key)
+{
+  printf ("psk: username %s\n", username);
+  key->data = gnutls_malloc (4);
+  key->data[0] = 0xDE;
+  key->data[1] = 0xAD;
+  key->data[2] = 0xBE;
+  key->data[3] = 0xEF;
+  key->size = 4;
+  return 0;
+}
+
+int
+main (void)
+{
+  int err, listen_sd, i;
+  int sd, ret;
+  struct sockaddr_in sa_serv;
+  struct sockaddr_in sa_cli;
+  int client_len;
+  char topbuf[512];
+  gnutls_session_t session;
+  char buffer[MAX_BUF + 1];
+  int optval = 1;
+
+  /* to disallow usage of the blocking /dev/random 
+   */
+  gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
+
+  /* this must be called once in the program
+   */
+  gnutls_global_init ();
+
+  gnutls_certificate_allocate_credentials (&x509_cred);
+  gnutls_certificate_set_x509_trust_file (x509_cred, CAFILE,
+                                         GNUTLS_X509_FMT_PEM);
+
+  gnutls_certificate_set_x509_crl_file (x509_cred, CRLFILE,
+                                       GNUTLS_X509_FMT_PEM);
+
+  gnutls_certificate_set_x509_key_file (x509_cred, CERTFILE, KEYFILE,
+                                       GNUTLS_X509_FMT_PEM);
+
+  gnutls_psk_allocate_server_credentials (&psk_cred);
+  gnutls_psk_set_server_credentials_function (psk_cred, pskfunc);
+
+  generate_dh_params ();
+
+  gnutls_priority_init( &priority_cache, "NORMAL:PSK", NULL);
+
+
+  gnutls_certificate_set_dh_params (x509_cred, dh_params);
+
+  /* Socket operations
+   */
+  listen_sd = socket (AF_INET, SOCK_STREAM, 0);
+  SOCKET_ERR (listen_sd, "socket");
+
+  memset (&sa_serv, '\0', sizeof (sa_serv));
+  sa_serv.sin_family = AF_INET;
+  sa_serv.sin_addr.s_addr = INADDR_ANY;
+  sa_serv.sin_port = htons (PORT);     /* Server Port number */
+
+  setsockopt (listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof (int));
+
+  err = bind (listen_sd, (SA *) & sa_serv, sizeof (sa_serv));
+  SOCKET_ERR (err, "bind");
+  err = listen (listen_sd, 1024);
+  SOCKET_ERR (err, "listen");
+
+  printf ("Server ready. Listening to port '%d'.\n\n", PORT);
+
+  client_len = sizeof (sa_cli);
+  for (;;)
+    {
+      session = initialize_tls_session ();
+
+      sd = accept (listen_sd, (SA *) & sa_cli, &client_len);
+
+      printf ("- connection from %s, port %d\n",
+             inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
+                        sizeof (topbuf)), ntohs (sa_cli.sin_port));
+
+      gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+      ret = gnutls_handshake (session);
+      if (ret < 0)
+       {
+         close (sd);
+         gnutls_deinit (session);
+         fprintf (stderr, "*** Handshake has failed (%s)\n\n",
+                  gnutls_strerror (ret));
+         continue;
+       }
+      printf ("- Handshake was completed\n");
+
+      /* see the Getting peer's information example */
+      /* print_info(session); */
+
+      i = 0;
+      for (;;)
+       {
+         memset (buffer, 0, MAX_BUF + 1);
+         ret = gnutls_record_recv (session, buffer, MAX_BUF);
+
+         if (ret == 0)
+           {
+             printf ("\n- Peer has closed the GNUTLS connection\n");
+             break;
+           }
+         else if (ret < 0)
+           {
+             fprintf (stderr, "\n*** Received corrupted "
+                      "data(%d). Closing the connection.\n\n", ret);
+             break;
+           }
+         else if (ret > 0)
+           {
+             /* echo data back to the client
+              */
+             gnutls_record_send (session, buffer, strlen (buffer));
+           }
+       }
+      printf ("\n");
+      /* do not wait for the peer to close the connection.
+       */
+      gnutls_bye (session, GNUTLS_SHUT_WR);
+
+      close (sd);
+      gnutls_deinit (session);
+
+    }
+  close (listen_sd);
+
+  gnutls_certificate_free_credentials (x509_cred);
+  gnutls_psk_free_server_credentials (psk_cred);
+
+  gnutls_priority_deinit(priority_cache);
+
+  gnutls_global_deinit ();
+
+  return 0;
+
+}