gnutls-serv: improve output under TLS1.3

That is, silence fields no longer applicable under TLS1.3
and make sure that newer functions like gnutls_session_get_desc()
get used when describing the session.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

diff --git a/src/common.c b/src/common.c
index 7c41a994de8e18b9da7e473f1f58eb06e4694389..ee6c47e01cd7663271b1b909336940304b63cdc4 100644 (file)
--- a/src/common.c
+++ b/src/common.c
@@ -113,7 +113,7 @@ const char *raw_to_base64(const unsigned char *raw, size_t raw_size)
        return buf;
 }
 
-static void print_x509_info_compact(gnutls_session_t session)
+static void print_x509_info_compact(gnutls_session_t session, int print_crt_status)
 {
        gnutls_x509_crt_t crt;
        const gnutls_datum_t *cert_list;
@@ -123,7 +123,8 @@ static void print_x509_info_compact(gnutls_session_t session)
 
        cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
        if (cert_list_size == 0) {
-               fprintf(stderr, "No certificates found!\n");
+               if (print_crt_status)
+                       fprintf(stderr, "No certificates found!\n");
                return;
        }
 
@@ -152,7 +153,7 @@ static void print_x509_info_compact(gnutls_session_t session)
 }
 
 static void
-print_x509_info(gnutls_session_t session, FILE *out, int flag, int print_cert)
+print_x509_info(gnutls_session_t session, FILE *out, int flag, int print_cert, int print_crt_status)
 {
        gnutls_x509_crt_t crt;
        const gnutls_datum_t *cert_list;
@@ -161,7 +162,8 @@ print_x509_info(gnutls_session_t session, FILE *out, int flag, int print_cert)
 
        cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
        if (cert_list_size == 0) {
-               fprintf(stderr, "No certificates found!\n");
+               if (print_crt_status)
+                       fprintf(stderr, "No certificates found!\n");
                return;
        }
 
@@ -387,6 +389,7 @@ int print_info(gnutls_session_t session, int verbose, int flags)
        gnutls_srtp_profile_t srtp_profile;
        gnutls_datum_t p;
        char *desc;
+       gnutls_protocol_t version;
        int rc;
 
        desc = gnutls_session_get_desc(session);
@@ -395,8 +398,10 @@ int print_info(gnutls_session_t session, int verbose, int flags)
 
        /* print session ID */
        gnutls_session_get_id(session, session_id, &session_id_size);
-       printf("- Session ID: %s\n",
-              raw_to_string(session_id, session_id_size));
+       if (session_id_size > 0) {
+               printf("- Session ID: %s\n",
+                      raw_to_string(session_id, session_id_size));
+       }
 
        /* print the key exchange's algorithm name
         */
@@ -470,13 +475,15 @@ int print_info(gnutls_session_t session, int verbose, int flags)
                        print_ecdh_info(session, "Ephemeral ");
        }
 
+       version = gnutls_protocol_get_version(session);
        tmp =
-           SU(gnutls_protocol_get_name
-              (gnutls_protocol_get_version(session)));
+           SU(gnutls_protocol_get_name(version));
        printf("- Version: %s\n", tmp);
 
-       tmp = SU(gnutls_kx_get_name(kx));
-       printf("- Key Exchange: %s\n", tmp);
+       if (version < GNUTLS_TLS1_3) {
+               tmp = SU(gnutls_kx_get_name(kx));
+               printf("- Key Exchange: %s\n", tmp);
+       }
 
        if (gnutls_sign_algorithm_get(session) != GNUTLS_SIGN_UNKNOWN) {
                tmp =
@@ -558,38 +565,41 @@ void print_cert_info(gnutls_session_t session, int verbose, int print_cert)
 
 void print_cert_info2(gnutls_session_t session, int verbose, FILE *out, int print_cert)
 {
-       int flag;
+       int flag, print_crt_status = 0;
 
        if (verbose)
                flag = GNUTLS_CRT_PRINT_FULL;
        else
                flag = GNUTLS_CRT_PRINT_COMPACT;
 
-       if (gnutls_certificate_client_get_request_status(session) != 0)
+       if (gnutls_certificate_client_get_request_status(session) != 0) {
                printf("- Server has requested a certificate.\n");
+               print_crt_status = 1;
+       }
 
        switch (gnutls_certificate_type_get(session)) {
        case GNUTLS_CRT_X509:
-               print_x509_info(session, out, flag, print_cert);
+               print_x509_info(session, out, flag, print_cert, print_crt_status);
                break;
        default:
-               printf("Unknown type\n");
                break;
        }
 }
 
 void print_cert_info_compact(gnutls_session_t session)
 {
+       int verbose = 0;
 
-       if (gnutls_certificate_client_get_request_status(session) != 0)
+       if (gnutls_certificate_client_get_request_status(session) != 0) {
                printf("- Server has requested a certificate.\n");
+               verbose = 1;
+       }
 
        switch (gnutls_certificate_type_get(session)) {
        case GNUTLS_CRT_X509:
-               print_x509_info_compact(session);
+               print_x509_info_compact(session, verbose);
                break;
        default:
-               printf("Unknown type\n");
                break;
        }
 }

diff --git a/src/serv.c b/src/serv.c
index 42b4887bdc44814db8370e9b3cc3cf136f2b0897..ed7015ae45baf2e88e1d119f531353456015871c 100644 (file)
--- a/src/serv.c
+++ b/src/serv.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2004-2012 Free Software Foundation, Inc.
  * Copyright (C) 2001,2002 Paul Sheer
- * Copyright (C) 2016-2017 Red Hat, Inc.
+ * Copyright (C) 2016-2018 Red Hat, Inc.
  * Portions Copyright (C) 2002,2003 Nikos Mavrogiannopoulos
  *
  * This file is part of GnuTLS.
@@ -494,10 +494,11 @@ static char *peer_print_info(gnutls_session_t session, int *ret_length,
        const char *tmp;
        unsigned char sesid[32];
        size_t i, sesid_size;
-       char *http_buffer;
+       char *http_buffer, *desc;
        gnutls_kx_algorithm_t kx_alg;
        size_t len = 20 * 1024 + strlen(header);
        char *crtinfo = NULL, *crtinfo_old = NULL;
+       gnutls_protocol_t version;
        size_t ncrtinfo = 0;
 
        if (verbose == 0) {
@@ -566,16 +567,20 @@ static char *peer_print_info(gnutls_session_t session, int *ret_length,
 
        strcpy(http_buffer, HTTP_BEGIN);
 
+       version = gnutls_protocol_get_version(session);
+
        /* print session_id */
-       sesid_size = sizeof(sesid);
-       gnutls_session_get_id(session, sesid, &sesid_size);
-       snprintf(tmp_buffer, tmp_buffer_size, "\n<p>Session ID: <i>");
-       for (i = 0; i < sesid_size; i++)
-               snprintf(tmp_buffer, tmp_buffer_size, "%.2X", sesid[i]);
-       snprintf(tmp_buffer, tmp_buffer_size, "</i></p>\n");
-       snprintf(tmp_buffer, tmp_buffer_size,
-                "<h5>If your browser supports session resuming, then you should see the "
-                "same session ID, when you press the <b>reload</b> button.</h5>\n");
+       if (version < GNUTLS_TLS1_3) {
+               sesid_size = sizeof(sesid);
+               gnutls_session_get_id(session, sesid, &sesid_size);
+               snprintf(tmp_buffer, tmp_buffer_size, "\n<p>Session ID: <i>");
+               for (i = 0; i < sesid_size; i++)
+                       snprintf(tmp_buffer, tmp_buffer_size, "%.2X", sesid[i]);
+               snprintf(tmp_buffer, tmp_buffer_size, "</i></p>\n");
+               snprintf(tmp_buffer, tmp_buffer_size,
+                        "<h5>If your browser supports session resuming, then you should see the "
+                        "same session ID, when you press the <b>reload</b> button.</h5>\n");
+       }
 
        /* Here unlike print_info() we use the kx algorithm to distinguish
         * the functions to call.
@@ -605,39 +610,35 @@ static char *peer_print_info(gnutls_session_t session, int *ret_length,
 #endif
 
 #ifdef ENABLE_PSK
-       if (kx_alg == GNUTLS_KX_PSK) {
+       if (kx_alg == GNUTLS_KX_PSK && gnutls_psk_server_get_username(session)) {
                snprintf(tmp_buffer, tmp_buffer_size,
                         "<p>Connected as user '%s'.</p>\n",
                         gnutls_psk_server_get_username(session));
        }
 #endif
 
-#ifdef ENABLE_ANON
-       if (kx_alg == GNUTLS_KX_ANON_DH) {
-               snprintf(tmp_buffer, tmp_buffer_size,
-                        "<p> Connect using anonymous DH (prime of %d bits)</p>\n",
-                        gnutls_dh_get_prime_bits(session));
-       }
-#endif
-
-       if (kx_alg == GNUTLS_KX_DHE_RSA || kx_alg == GNUTLS_KX_DHE_DSS) {
-               snprintf(tmp_buffer, tmp_buffer_size,
-                        "Ephemeral DH using prime of <b>%d</b> bits.<br>\n",
-                        gnutls_dh_get_prime_bits(session));
-       }
 
        /* print session information */
        strcat(http_buffer, "<P>\n");
 
        tmp =
-           gnutls_protocol_get_name(gnutls_protocol_get_version(session));
+           gnutls_protocol_get_name(version);
        if (tmp == NULL)
                tmp = str_unknown;
        snprintf(tmp_buffer, tmp_buffer_size,
                 "<TABLE border=1><TR><TD>Protocol version:</TD><TD>%s</TD></TR>\n",
                 tmp);
 
-       if (gnutls_auth_get_type(session) == GNUTLS_CRD_CERTIFICATE) {
+       desc = gnutls_session_get_desc(session);
+       if (desc) {
+               snprintf(tmp_buffer, tmp_buffer_size,
+                       "<TR><TD>Description:</TD><TD>%s</TD></TR>\n",
+                       desc);
+               gnutls_free(desc);
+       }
+
+       if (gnutls_auth_get_type(session) == GNUTLS_CRD_CERTIFICATE &&
+           gnutls_certificate_type_get(session) != GNUTLS_CRT_X509) {
                tmp =
                    gnutls_certificate_type_get_name
                    (gnutls_certificate_type_get(session));
@@ -648,17 +649,42 @@ static char *peer_print_info(gnutls_session_t session, int *ret_length,
                         tmp);
        }
 
-       tmp = gnutls_kx_get_name(kx_alg);
-       if (tmp == NULL)
-               tmp = str_unknown;
-       snprintf(tmp_buffer, tmp_buffer_size,
-                "<TR><TD>Key Exchange:</TD><TD>%s</TD></TR>\n", tmp);
+       if (version < GNUTLS_TLS1_3) {
+               tmp = gnutls_kx_get_name(kx_alg);
+               if (tmp == NULL)
+                       tmp = str_unknown;
+               snprintf(tmp_buffer, tmp_buffer_size,
+                        "<TR><TD>Key Exchange:</TD><TD>%s</TD></TR>\n", tmp);
 
-       tmp = gnutls_compression_get_name(gnutls_compression_get(session));
-       if (tmp == NULL)
-               tmp = str_unknown;
-       snprintf(tmp_buffer, tmp_buffer_size,
-                "<TR><TD>Compression</TD><TD>%s</TD></TR>\n", tmp);
+#ifdef ENABLE_ANON
+               if (kx_alg == GNUTLS_KX_ANON_DH) {
+                       snprintf(tmp_buffer, tmp_buffer_size,
+                                "<p> Connect using anonymous DH (prime of %d bits)</p>\n",
+                                gnutls_dh_get_prime_bits(session));
+               }
+#endif
+
+               if (kx_alg == GNUTLS_KX_DHE_RSA || kx_alg == GNUTLS_KX_DHE_DSS) {
+                       snprintf(tmp_buffer, tmp_buffer_size,
+                                "Ephemeral DH using prime of <b>%d</b> bits.<br>\n",
+                                gnutls_dh_get_prime_bits(session));
+               }
+
+               tmp = gnutls_compression_get_name(gnutls_compression_get(session));
+               if (tmp == NULL)
+                       tmp = str_unknown;
+               snprintf(tmp_buffer, tmp_buffer_size,
+                        "<TR><TD>Compression</TD><TD>%s</TD></TR>\n", tmp);
+
+               tmp = gnutls_cipher_suite_get_name(kx_alg,
+                                                  gnutls_cipher_get(session),
+                                                  gnutls_mac_get(session));
+               if (tmp == NULL)
+                       tmp = str_unknown;
+               snprintf(tmp_buffer, tmp_buffer_size,
+                        "<TR><TD>Ciphersuite</TD><TD>%s</TD></TR></p></TABLE>\n",
+                        tmp);
+       }
 
        tmp = gnutls_cipher_get_name(gnutls_cipher_get(session));
        if (tmp == NULL)
@@ -672,14 +698,6 @@ static char *peer_print_info(gnutls_session_t session, int *ret_length,
        snprintf(tmp_buffer, tmp_buffer_size,
                 "<TR><TD>MAC</TD><TD>%s</TD></TR>\n", tmp);
 
-       tmp = gnutls_cipher_suite_get_name(kx_alg,
-                                          gnutls_cipher_get(session),
-                                          gnutls_mac_get(session));
-       if (tmp == NULL)
-               tmp = str_unknown;
-       snprintf(tmp_buffer, tmp_buffer_size,
-                "<TR><TD>Ciphersuite</TD><TD>%s</TD></TR></p></TABLE>\n",
-                tmp);
 
        if (crtinfo) {
                snprintf(tmp_buffer, tmp_buffer_size,