2 * Simple GnuTLS client used for testing.
4 * Copyright (C) 2011-2013 Simon Ruderich
6 * This program is free software: you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation, either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include <arpa/inet.h>
28 #include <sys/socket.h>
29 #include <sys/types.h>
32 #include <gnutls/gnutls.h>
33 #include <gnutls/x509.h>
36 #define MAX_REQUEST_LINE 4096
38 static int connect_to_host(const char *hostname, const char *port);
39 static int read_http_request(FILE *client_fd, char *request, size_t length);
42 int main (int argc, char *argv[]) {
45 char buffer[MAX_REQUEST_LINE];
49 gnutls_session_t session;
50 gnutls_certificate_credentials_t xcred;
52 gnutls_x509_crt_t cert;
53 const gnutls_datum_t *cert_list;
54 unsigned int cert_list_size;
58 "Usage: %s <ca-file> <hostname> <port> <hostname-verify>\n",
64 gnutls_certificate_allocate_credentials(&xcred);
66 gnutls_certificate_set_x509_trust_file(xcred,
67 argv[1], GNUTLS_X509_FMT_PEM);
69 gnutls_init(&session, GNUTLS_CLIENT);
70 gnutls_priority_set_direct(session, "NORMAL", NULL);
71 gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
73 server = connect_to_host("localhost", "4711");
77 fd = fdopen(server, "a+");
83 /* Talk to tlsproxy. */
84 fprintf(fd, "CONNECT %s:%s HTTP/1.0\r\n", argv[2], argv[3]);
87 if (-1 == read_http_request(fd, buffer, sizeof(buffer))) {
88 fprintf(stderr, "invalid proxy response\n");
92 printf("response: %s\n", buffer);
94 if (1 != sscanf(buffer, "HTTP/1.0 %d", &response)) {
95 fprintf(stderr, "invalid proxy response: %s\n", buffer);
99 if (200 != response) {
100 fprintf(stderr, "proxy failure\n");
104 gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t)server);
106 result = gnutls_handshake(session);
107 if (GNUTLS_E_SUCCESS != result) {
108 fprintf(stderr, "gnutls_handshake() failed\n");
109 gnutls_perror(result);
113 /* Verify the proxy certificate. */
114 result = gnutls_certificate_verify_peers2(session, &status);
116 fprintf(stderr, "gnutls_certificate_verify_peers2() failed\n");
117 gnutls_perror(result);
121 if (status & GNUTLS_CERT_INVALID) {
122 fprintf(stderr, "certificate invalid\n");
125 /* Get proxy certificate. */
126 if (0 > (result = gnutls_x509_crt_init(&cert))) {
127 fprintf(stderr, "gnutls_x509_crt_init() failed");
128 gnutls_perror(result);
132 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
133 if (NULL == cert_list) {
134 fprintf(stderr, "gnutls_certificate_get_peers() failed");
138 if (0 > (result = gnutls_x509_crt_import(cert, &cert_list[0],
139 GNUTLS_X509_FMT_DER))) {
140 fprintf(stderr, "gnutls_x509_crt_import() failed");
141 gnutls_perror(result);
145 /* Check hostname. */
146 if (!gnutls_x509_crt_check_hostname(cert, argv[4])) {
147 fprintf(stderr, "hostname didn't match '%s'\n", argv[4]);
151 gnutls_x509_crt_deinit(cert);
153 gnutls_bye(session, GNUTLS_SHUT_RDWR);
156 gnutls_deinit(session);
157 gnutls_certificate_free_credentials(xcred);
158 gnutls_global_deinit();
164 /* Copied from src/connection.c (and removed LOG_* stuff)! Don't modify. */
166 static int connect_to_host(const char *hostname, const char *port) {
167 struct addrinfo gai_hints;
168 struct addrinfo *gai_result;
172 struct addrinfo *server;
174 if (NULL == hostname || NULL == port) {
178 /* Get IP of hostname server. */
179 memset(&gai_hints, 0, sizeof(gai_hints));
180 gai_hints.ai_family = AF_UNSPEC;
181 gai_hints.ai_socktype = SOCK_STREAM;
182 gai_hints.ai_protocol = 0;
183 gai_hints.ai_flags = AI_NUMERICSERV /* given port is numeric */
184 | AI_ADDRCONFIG /* supported by this computer */
185 | AI_V4MAPPED; /* support IPv4 through IPv6 */
186 gai_return = getaddrinfo(hostname, port, &gai_hints, &gai_result);
187 if (0 != gai_return) {
188 perror("connect_to_host(): getaddrinfo()");
192 /* Now try to connect to each server returned by getaddrinfo(), use the
193 * first successful connect. */
194 for (server = gai_result; NULL != server; server = server->ai_next) {
195 server_socket = socket(server->ai_family,
197 server->ai_protocol);
198 if (-1 == server_socket) {
199 perror("connect_to_host(): socket(), trying next");
203 if (-1 != connect(server_socket, server->ai_addr,
204 server->ai_addrlen)) {
207 perror("connect_to_host(): connect(), trying next");
209 close(server_socket);
211 /* Make sure we free the result from getaddrinfo(). */
212 freeaddrinfo(gai_result);
214 if (NULL == server) {
215 perror("connect_to_host(): no server found, abort");
219 return server_socket;
222 static int read_http_request(FILE *client_fd, char *request, size_t length) {
223 char buffer[MAX_REQUEST_LINE];
225 if (NULL == fgets(request, (int)length, client_fd)) {
226 if (ferror(client_fd)) {
227 perror("read_http_request(): fgets()");
234 while (NULL != fgets(buffer, MAX_REQUEST_LINE, client_fd)) {
236 if (0 == strcmp(buffer, "\n") || 0 == strcmp(buffer, "\r\n")) {
240 if (ferror(client_fd)) {
241 perror("read_http_request(): fgets()");