1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
|
\begin{verbatim}
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <gnutls/gnutls.h>
#define MAX_BUF 1024
#define CRLFILE "crl.pem"
#define CAFILE "ca.pem"
#define SA struct sockaddr
#define MSG "GET / HTTP/1.0\r\n\r\n"
const int protocol_priority[] = { GNUTLS_TLS1, GNUTLS_SSL3, 0 };
const int kx_priority[] = { GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, 0 };
const int cipher_priority[] = { GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR\_128, 0};
const int comp_priority[] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_NULL, 0 };
const int mac_priority[] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
int main()
{
const char *PORT = "443";
const char *SERVER = "127.0.0.1";
int err, ret;
int sd, ii, alert;
struct sockaddr_in sa;
GNUTLS_STATE state;
char buffer[MAX_BUF + 1];
GNUTLS_CERTIFICATE_CLIENT_CREDENTIALS xcred;
/* variables used in session resuming */
int t;
char *session;
char *session_id;
int session_size;
int session_id_size;
char *tmp_session_id;
int tmp_session_id_size;
if (gnutls_global_init() < 0) {
fprintf(stderr, "global state initialization error\n");
exit(1);
}
/* X509 stuff */
if (gnutls_certificate_allocate_client_cred(&xcred) < 0) {
fprintf(stderr, "memory error\n");
exit(1);
}
gnutls_certificate_set_x509_trust_file(xcred, CAFILE, GNUTLS_X509_FMT_PEM);
for (t = 0; t < 2; t++) { /* connect 2 times to the server */
sd = socket(AF_INET, SOCK_STREAM, 0);
memset(&sa, '\0', sizeof(sa));
sa.sin_family = AF_INET;
sa.sin_port = htons(atoi(PORT));
inet_pton(AF_INET, SERVER, &sa.sin_addr);
err = connect(sd, (SA *) & sa, sizeof(sa));
if (err < 0) {
fprintf(stderr, "Connect error");
exit(1);
}
gnutls_init(&state, GNUTLS_CLIENT);
gnutls_protocol_set_priority(state, protocol_priority);
gnutls_cipher_set_priority(state, cipher_priority);
gnutls_compression_set_priority(state, comp_priority);
gnutls_kx_set_priority(state, kx_priority);
gnutls_mac_set_priority(state, mac_priority);
gnutls_cred_set(state, GNUTLS_CRD_CERTIFICATE, xcred);
if (t > 0) { /* if this is not the first time we connect */
gnutls_session_set_data(state, session, session_size);
free(session);
}
gnutls_transport_set_ptr( state, sd);
/* Perform the TLS handshake
*/
ret = gnutls_handshake( state);
if (ret < 0) {
fprintf(stderr, "*** Handshake failed\n");
gnutls_perror(ret);
goto end;
} else {
printf("- Handshake was completed\n");
}
if (t == 0) { /* the first time we connect */
/* get the session data size */
gnutls_session_get_data(state, NULL, &session_size);
session = malloc(session_size);
/* put session data to the session variable */
gnutls_session_get_data(state, session, &session_size);
/* keep the current session ID. This is only needed
* in order to check if the server actually resumed this
* connection.
*/
gnutls_session_get_id(state, NULL, &session_id_size);
session_id = malloc(session_id_size);
gnutls_session_get_id(state, session_id, &session_id_size);
} else { /* the second time we connect */
/* check if we actually resumed the previous session */
gnutls_session_get_id(state, NULL, &tmp_session_id_size);
tmp_session_id = malloc(tmp_session_id_size);
gnutls_session_get_id(state, tmp_session_id, &tmp_session_id_size);
if (memcmp(tmp_session_id, session_id, session_id_size) == 0) {
printf("- Previous session was resumed\n");
} else {
fprintf(stderr, "*** Previous session was NOT resumed\n");
}
free(tmp_session_id);
free(session_id);
}
/* This function was defined in a previous example
*/
print_info(state);
gnutls_record_send( state, MSG, strlen(MSG));
ret = gnutls_record_recv( state, buffer, MAX_BUF);
if (gnutls_error_is_fatal(ret) == 1 || ret == 0) {
if (ret == 0) {
printf("- Peer has closed the GNUTLS connection\n");
goto end;
} else {
fprintf(stderr, "*** Received corrupted data(%d) - server has terminated the connection abnormally\n",
ret);
goto end;
}
} else {
if (ret == GNUTLS_E_WARNING_ALERT_RECEIVED || ret == GNUTLS_E_FATAL_ALERT_RECEIVED)
alert = gnutls_alert_get(state);
printf("* Received alert [%d]: %s\n", alert, gnutls_alert_get_name(alert));
if (ret == GNUTLS_E_REHANDSHAKE) {
printf("* Received HelloRequest message (server asked to rehandshake)\n");
gnutls_alert_send_appropriate( state, ret); /* we don't want rehandshake */
}
}
if (ret > 0) {
printf("- Received %d bytes: ", ret);
for (ii = 0; ii < ret; ii++) {
fputc(buffer[ii], stdout);
}
fputs("\n", stdout);
}
gnutls_bye( state, GNUTLS_SHUT_RDWR);
end:
shutdown(sd, SHUT_RDWR); /* no more receptions */
close(sd);
gnutls_deinit(state);
} /* for() */
gnutls_certificate_free_client_cred(xcred);
gnutls_global_deinit();
return 0;
}
\end{verbatim}
|
