diff options
| author | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2016-09-11 10:34:21 +0200 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2016-09-11 10:50:54 +0200 |
| commit | 61a6551e469c7dbbbecf1cedfa142e88501428cd (patch) | |
| tree | ebb0874e06efad4dc614f12ab71d3876201ddbd3 /manual/html_node/Client-using-a-smart-card-with-TLS.html | |
| parent | 4b1dc46ae2106e720600f21609af107bc372f6c5 (diff) | |
| download | gnutls-web-pages2.tar.gz | |
Redesigned web page generationweb-pages2
Diffstat (limited to 'manual/html_node/Client-using-a-smart-card-with-TLS.html')
| -rw-r--r-- | manual/html_node/Client-using-a-smart-card-with-TLS.html | 357 |
1 files changed, 0 insertions, 357 deletions
diff --git a/manual/html_node/Client-using-a-smart-card-with-TLS.html b/manual/html_node/Client-using-a-smart-card-with-TLS.html deleted file mode 100644 index 22631d2458..0000000000 --- a/manual/html_node/Client-using-a-smart-card-with-TLS.html +++ /dev/null @@ -1,357 +0,0 @@ -<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> -<html> -<!-- This manual is last updated 4 March 2015 for version -3.5.4 of GnuTLS. - -Copyright (C) 2001-2015 Free Software Foundation, Inc.\\ -Copyright (C) 2001-2015 Nikos Mavrogiannopoulos - -Permission is granted to copy, distribute and/or modify this document -under the terms of the GNU Free Documentation License, Version 1.3 or -any later version published by the Free Software Foundation; with no -Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A -copy of the license is included in the section entitled "GNU Free -Documentation License". --> -<!-- Created by GNU Texinfo 6.1, http://www.gnu.org/software/texinfo/ --> -<head> -<title>GnuTLS 3.5.4: Client using a smart card with TLS</title> - -<meta name="description" content="GnuTLS 3.5.4: Client using a smart card with TLS"> -<meta name="keywords" content="GnuTLS 3.5.4: Client using a smart card with TLS"> -<meta name="resource-type" content="document"> -<meta name="distribution" content="global"> -<meta name="Generator" content="makeinfo"> -<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> -<link href="index.html#Top" rel="start" title="Top"> -<link href="Function-and-Data-Index.html#Function-and-Data-Index" rel="index" title="Function and Data Index"> -<link href="index.html#SEC_Contents" rel="contents" title="Table of Contents"> -<link href="Client-examples.html#Client-examples" rel="up" title="Client examples"> -<link href="Client-with-Resume-capability-example.html#Client-with-Resume-capability-example" rel="next" title="Client with Resume capability example"> -<link href="Verifying-a-certificate.html#Verifying-a-certificate" rel="prev" title="Verifying a certificate"> -<style type="text/css"> -<!-- -a.summary-letter {text-decoration: none} -blockquote.indentedblock {margin-right: 0em} -blockquote.smallindentedblock {margin-right: 0em; font-size: smaller} -blockquote.smallquotation {font-size: smaller} -div.display {margin-left: 3.2em} -div.example {margin-left: 3.2em} -div.lisp {margin-left: 3.2em} -div.smalldisplay {margin-left: 3.2em} -div.smallexample {margin-left: 3.2em} -div.smalllisp {margin-left: 3.2em} -kbd {font-style: oblique} -pre.display {font-family: inherit} -pre.format {font-family: inherit} -pre.menu-comment {font-family: serif} -pre.menu-preformatted {font-family: serif} -pre.smalldisplay {font-family: inherit; font-size: smaller} -pre.smallexample {font-size: smaller} -pre.smallformat {font-family: inherit; font-size: smaller} -pre.smalllisp {font-size: smaller} -span.nolinebreak {white-space: nowrap} -span.roman {font-family: initial; font-weight: normal} -span.sansserif {font-family: sans-serif; font-weight: normal} -ul.no-bullet {list-style: none} -body { - margin: 2%; - padding: 0 5%; - background: #ffffff; -} -h1,h2,h3,h4,h5 { - font-weight: bold; - padding: 5px 5px 5px 5px; - background-color: #c2e0ff; - color: #336699; -} -h1 { - padding: 2em 2em 2em 5%; - color: white; - background: #336699; - text-align: center; - letter-spacing: 3px; -} -h2 { text-decoration: underline; } -pre { - margin: 0 5%; - padding: 0.5em; -} -pre.example,pre.verbatim { - padding-bottom: 1em; - - border: solid #c2e0ff; - background: #f0faff; - border-width: 1px 1px 1px 5px; - margin: 1em auto; - width: 90%; -} - -div.node { - margin: 0 -5% 0 -2%; - padding: 0.5em 0.5em; - margin-top: 0.5em; - margin-bottom: 0.5em; - font-weight: bold; -} -dd, li { - padding-top: 0.1em; - padding-bottom: 0.1em; -} -div.float { - - margin-bottom: 0.5em; - text-align: center; -} - -table { - text-align: left; - margin-left:auto; - margin-right:auto; - border-spacing: 7px; - width: 50%; -} - -th { - padding: 0; - color: #336699; - background-color: #c2e0ff; - border: solid #000000; - border-width: 0px; - margin: 1em auto; - text-align: center; - margin-left:auto; - margin-right:auto; -} - -td { - padding: 0; - border: solid #000000; - background-color: #f0faff; - border-width: 0px; - margin: 1em auto; - text-align: left; - margin-left:auto; - margin-right:auto; - padding-left: 1em; -} - -dl { - text-align: left; - margin-left:auto; - margin-right:auto; - width: 50%; - - padding-left: 1em; - border: solid #c2e0ff; - background: #f0faff; - border-width: 5px 1px 1px 1px; - margin: 1em auto; -} - ---> -</style> - - -</head> - -<body lang="en"> -<a name="Client-using-a-smart-card-with-TLS"></a> -<div class="header"> -<p> -Next: <a href="Client-with-Resume-capability-example.html#Client-with-Resume-capability-example" accesskey="n" rel="next">Client with Resume capability example</a>, Previous: <a href="Verifying-a-certificate.html#Verifying-a-certificate" accesskey="p" rel="prev">Verifying a certificate</a>, Up: <a href="Client-examples.html#Client-examples" accesskey="u" rel="up">Client examples</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p> -</div> -<hr> -<a name="Using-a-smart-card-with-TLS"></a> -<h4 class="subsection">7.1.8 Using a smart card with TLS</h4> -<a name="ex_002dpkcs11_002dclient"></a><a name="index-Smart-card-example"></a> - -<p>This example will demonstrate how to load keys and certificates -from a smart-card or any other <acronym>PKCS</acronym> #11 token, and -use it in a TLS connection. -</p> -<pre class="verbatim">/* This example code is placed in the public domain. */ - -#ifdef HAVE_CONFIG_H -#include <config.h> -#endif - -#include <stdio.h> -#include <stdlib.h> -#include <string.h> -#include <sys/types.h> -#include <sys/socket.h> -#include <arpa/inet.h> -#include <unistd.h> -#include <gnutls/gnutls.h> -#include <gnutls/x509.h> -#include <gnutls/pkcs11.h> -#include <assert.h> -#include <sys/types.h> -#include <sys/stat.h> -#include <fcntl.h> -#include <getpass.h> /* for getpass() */ - -/* A TLS client that loads the certificate and key. - */ - -#define CHECK(x) assert((x)>=0) - -#define MAX_BUF 1024 -#define MSG "GET / HTTP/1.0\r\n\r\n" -#define MIN(x,y) (((x)<(y))?(x):(y)) - -#define CAFILE "/etc/ssl/certs/ca-certificates.crt" - -/* The URLs of the objects can be obtained - * using p11tool --list-all --login - */ -#define KEY_URL "pkcs11:manufacturer=SomeManufacturer;object=Private%20Key" \ - ";objecttype=private;id=%db%5b%3e%b5%72%33" -#define CERT_URL "pkcs11:manufacturer=SomeManufacturer;object=Certificate;" \ - "objecttype=cert;id=db%5b%3e%b5%72%33" - -extern int tcp_connect(void); -extern void tcp_close(int sd); - -static int -pin_callback(void *user, int attempt, const char *token_url, - const char *token_label, unsigned int flags, char *pin, - size_t pin_max) -{ - const char *password; - int len; - - printf("PIN required for token '%s' with URL '%s'\n", token_label, - token_url); - if (flags & GNUTLS_PIN_FINAL_TRY) - printf("*** This is the final try before locking!\n"); - if (flags & GNUTLS_PIN_COUNT_LOW) - printf("*** Only few tries left before locking!\n"); - if (flags & GNUTLS_PIN_WRONG) - printf("*** Wrong PIN\n"); - - password = getpass("Enter pin: "); - if (password == NULL || password[0] == 0) { - fprintf(stderr, "No password given\n"); - exit(1); - } - - len = MIN(pin_max - 1, strlen(password)); - memcpy(pin, password, len); - pin[len] = 0; - - return 0; -} - -int main(void) -{ - int ret, sd, ii; - gnutls_session_t session; - char buffer[MAX_BUF + 1]; - gnutls_certificate_credentials_t xcred; - /* Allow connections to servers that have OpenPGP keys as well. - */ - - if (gnutls_check_version("3.1.4") == NULL) { - fprintf(stderr, "GnuTLS 3.1.4 or later is required for this example\n"); - exit(1); - } - - /* for backwards compatibility with gnutls < 3.3.0 */ - CHECK(gnutls_global_init()); - - /* The PKCS11 private key operations may require PIN. - * Register a callback. */ - gnutls_pkcs11_set_pin_function(pin_callback, NULL); - - /* X509 stuff */ - CHECK(gnutls_certificate_allocate_credentials(&xcred)); - - /* sets the trusted cas file - */ - CHECK(gnutls_certificate_set_x509_trust_file(xcred, CAFILE, - GNUTLS_X509_FMT_PEM)); - - CHECK(gnutls_certificate_set_x509_key_file(xcred, CERT_URL, KEY_URL, - GNUTLS_X509_FMT_DER)); - - /* Note that there is no server certificate verification in this example - */ - - - /* Initialize TLS session - */ - CHECK(gnutls_init(&session, GNUTLS_CLIENT)); - - /* Use default priorities */ - CHECK(gnutls_set_default_priority(session)); - - /* put the x509 credentials to the current session - */ - CHECK(gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred)); - - /* connect to the peer - */ - sd = tcp_connect(); - - gnutls_transport_set_int(session, sd); - - /* Perform the TLS handshake - */ - ret = gnutls_handshake(session); - - if (ret < 0) { - fprintf(stderr, "*** Handshake failed\n"); - gnutls_perror(ret); - goto end; - } else { - char *desc; - - desc = gnutls_session_get_desc(session); - printf("- Session info: %s\n", desc); - gnutls_free(desc); - } - - CHECK(gnutls_record_send(session, MSG, strlen(MSG))); - - ret = gnutls_record_recv(session, buffer, MAX_BUF); - if (ret == 0) { - printf("- Peer has closed the TLS connection\n"); - goto end; - } else if (ret < 0) { - fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret)); - goto end; - } - - printf("- Received %d bytes: ", ret); - for (ii = 0; ii < ret; ii++) { - fputc(buffer[ii], stdout); - } - fputs("\n", stdout); - - CHECK(gnutls_bye(session, GNUTLS_SHUT_RDWR)); - - end: - - tcp_close(sd); - - gnutls_deinit(session); - - gnutls_certificate_free_credentials(xcred); - - gnutls_global_deinit(); - - return 0; -} -</pre> - -<hr> -<div class="header"> -<p> -Next: <a href="Client-with-Resume-capability-example.html#Client-with-Resume-capability-example" accesskey="n" rel="next">Client with Resume capability example</a>, Previous: <a href="Verifying-a-certificate.html#Verifying-a-certificate" accesskey="p" rel="prev">Verifying a certificate</a>, Up: <a href="Client-examples.html#Client-examples" accesskey="u" rel="up">Client examples</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p> -</div> - - - -</body> -</html> |