migrated code to connection_https

fixed gcrypt lib initialization to support mt
removed some gnutls psk code
added CIPHER_ALGORITHM & KX_PRIORITY options
added certificate loading test
added TLS GET test
This commit is contained in:
lv-426 committed 2008-07-07 02:38:41 +00:00
1 parent eb391a612d
commit b9f09651e6
19 files changed
+699 -740

No files matched your search

-41
View File
@@ -15,7 +15,6 @@ typedef struct
int error_index;
} error_name;
static int
compar (const void *_n1, const void *_n2)
{
@@ -23,43 +22,3 @@ compar (const void *_n1, const void *_n2)
*n2 = (const error_name *) _n2;
return strcmp (n1->name, n2->name);
}
//int
//main (int argc, char *argv[])
//{
// int i, j;
// const char *desc;
// const char *_name;
// error_name names_to_sort[400]; /* up to 400 names */
//
// printf ("@table @code\n");
//
// memset (names_to_sort, 0, sizeof (names_to_sort));
// j = 0;
// for (i = 0; i > -400; i--)
// {
// _name = _gnutls_strerror (i);
// if (_name == NULL)
// continue;
//
// strcpy (names_to_sort[j].name, _name);
// names_to_sort[j].error_index = i;
// j++;
// }
//
// qsort (names_to_sort, j, sizeof (error_name), compar);
//
// for (i = 0; i < j; i++)
// {
// _name = names_to_sort[i].name;
// desc = gnutls_strerror (names_to_sort[i].error_index);
// if (desc == NULL || _name == NULL)
// continue;
//
// printf ("@item %s:\n%s\n\n", _name, desc);
// }
//
// printf ("@end table\n");
//
// return 0;
//}
+2 -4
View File
@@ -93,8 +93,6 @@ extern "C"
GNUTLS_KX_RSA_EXPORT,
GNUTLS_KX_SRP_RSA,
GNUTLS_KX_SRP_DSS,
GNUTLS_KX_PSK,
GNUTLS_KX_DHE_PSK
} gnutls_kx_algorithm_t;
typedef enum
@@ -318,7 +316,7 @@ extern "C"
typedef struct gnutls_x509_privkey_int *gnutls_rsa_params_t; /* XXX ugly. */
struct gnutls_priority_st;
typedef struct gnutls_priority_st *gnutls_priority_t;
typedef struct gnutls_priority_st * gnutls_priority_t;
typedef struct
{
@@ -508,7 +506,7 @@ extern "C"
/* if you just want some defaults, use the following.
*/
int gnutls_priority_init( gnutls_priority_t*, const char *priority, const char** err_pos);
int gnutls_priority_init( gnutls_priority_t * , const char *priority, const char** err_pos);
void gnutls_priority_deinit( gnutls_priority_t);
int gnutls_priority_set(gnutls_session_t session, gnutls_priority_t);
+3 -45
View File
@@ -23,7 +23,7 @@
*/
/* This file contains common stuff in Ephemeral Diffie Hellman (DHE) and
* Anonymous DH key exchange(DHA). These are used in the handshake procedure
* Anonymous DH key exchange(DHA). These are used in the handshake procedure
* of the certificate and anoymous authentication.
*/
@@ -86,29 +86,7 @@ _gnutls_proc_dh_common_client_kx (gnutls_session_t session,
_gnutls_mpi_release (&session->key->client_Y);
_gnutls_mpi_release (&session->key->dh_secret);
if (_gnutls_cipher_suite_get_kx_algo
(&session->security_parameters.current_cipher_suite)
!= GNUTLS_KX_DHE_PSK)
{
ret = _gnutls_mpi_dprint (&session->key->key, session->key->KEY);
}
/* In DHE_PSK the key is set differently
else
{
gnutls_datum_t tmp_dh_key;
ret = _gnutls_mpi_dprint (&tmp_dh_key, session->key->KEY);
if (ret < 0)
{
gnutls_assert ();
return ret;
}
ret = _gnutls_set_psk_session_key (session, &tmp_dh_key);
_gnutls_free_datum (&tmp_dh_key);
}
*/
ret = _gnutls_mpi_dprint (&session->key->key, session->key->KEY);
_gnutls_mpi_release (&session->key->KEY);
@@ -170,27 +148,7 @@ _gnutls_gen_dh_common_client_kx (gnutls_session_t session, opaque ** data)
_gnutls_mpi_release (&session->key->client_p);
_gnutls_mpi_release (&session->key->client_g);
if (_gnutls_cipher_suite_get_kx_algo
(&session->security_parameters.current_cipher_suite)
!= GNUTLS_KX_DHE_PSK)
{
ret = _gnutls_mpi_dprint (&session->key->key, session->key->KEY);
}
/* In DHE_PSK the key is set differently
else
{
gnutls_datum_t tmp_dh_key;
ret = _gnutls_mpi_dprint (&tmp_dh_key, session->key->KEY);
if (ret < 0)
{
gnutls_assert ();
goto error;
}
ret = _gnutls_set_psk_session_key (session, &tmp_dh_key);
_gnutls_free_datum (&tmp_dh_key);
}*/
ret = _gnutls_mpi_dprint (&session->key->key, session->key->KEY);
_gnutls_mpi_release (&session->key->KEY);
+5 -39
View File
@@ -29,7 +29,7 @@
/* x509 */
#include "common.h"
/* Cred type mappings to KX algorithms
/* Cred type mappings to KX algorithms
* FIXME: The mappings are not 1-1. Some KX such as SRP_RSA require
* more than one credentials type.
*/
@@ -57,12 +57,6 @@ static const gnutls_cred_map cred_mappings[] = {
{GNUTLS_KX_DHE_RSA,
GNUTLS_CRD_CERTIFICATE,
GNUTLS_CRD_CERTIFICATE},
{GNUTLS_KX_PSK,
GNUTLS_CRD_PSK,
GNUTLS_CRD_PSK},
{GNUTLS_KX_DHE_PSK,
GNUTLS_CRD_PSK,
GNUTLS_CRD_PSK},
{GNUTLS_KX_SRP,
GNUTLS_CRD_SRP,
GNUTLS_CRD_SRP},
@@ -197,7 +191,7 @@ struct gnutls_cipher_entry
};
typedef struct gnutls_cipher_entry gnutls_cipher_entry;
/* Note that all algorithms are in CBC or STREAM modes.
/* Note that all algorithms are in CBC or STREAM modes.
* Do not add any algorithms in other modes (avoid modified algorithms).
* View first: "The order of encryption and authentication for
* protecting communications" by Hugo Krawczyk - CRYPTO 2001
@@ -614,34 +608,6 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = {
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
#endif
/* PSK */
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_ARCFOUR_SHA1,
GNUTLS_CIPHER_ARCFOUR, GNUTLS_KX_PSK,
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_3DES_EDE_CBC_SHA1,
GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_PSK,
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_AES_128_CBC_SHA1,
GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_PSK,
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_AES_256_CBC_SHA1,
GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_PSK,
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
/* DHE-PSK */
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_ARCFOUR_SHA1,
GNUTLS_CIPHER_ARCFOUR, GNUTLS_KX_DHE_PSK,
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_3DES_EDE_CBC_SHA1,
GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_PSK,
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_AES_128_CBC_SHA1,
GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_PSK,
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_AES_256_CBC_SHA1,
GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_PSK,
GNUTLS_MAC_SHA1, GNUTLS_TLS1),
/* SRP */
GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_3DES_EDE_CBC_SHA1,
GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP,
@@ -1689,8 +1655,8 @@ _gnutls_qsort (gnutls_session_t session,
compar);
}
/* a compare function for KX algorithms (using priorities).
* For use with qsort
/* a compare function for KX algorithms (using priorities).
* For use with qsort
*/
static int
_gnutls_compare_algo (gnutls_session_t session,
@@ -1894,7 +1860,7 @@ _gnutls_supported_ciphersuites (gnutls_session_t session,
#define MIN_PRIVATE_COMP_ALGO 0xEF
/* returns the TLS numbers of the compression methods we support
/* returns the TLS numbers of the compression methods we support
*/
#define SUPPORTED_COMPRESSION_METHODS session->internals.priorities.compression.algorithms
int
+99 -62
View File
@@ -27,10 +27,19 @@
#include <libtasn1.h>
#include <gnutls_dh.h>
/* this is used in order to make the multi-threaded initialization call to libgcrypt */
#include <pthread.h>
#include <gcrypt.h>
/* TODO fix : needed by GCRY_THREAD_OPTION_PTHREAD_IMPL but missing otherwise */
#define ENOMEM 12 /* Out of memory */
#ifdef HAVE_WINSOCK
# include <winsock2.h>
#endif
GCRY_THREAD_OPTION_PTHREAD_IMPL;
#include "gettext.h"
#define gnutls_log_func LOG_FUNC
@@ -57,7 +66,8 @@ ASN1_TYPE _gnutls_gnutls_asn;
* gnutls_log_func is of the form,
* void (*gnutls_log_func)( int level, const char*);
**/
void gnutls_global_set_log_function(gnutls_log_func log_func)
void
gnutls_global_set_log_function (gnutls_log_func log_func)
{
_gnutls_log_func = log_func;
}
@@ -74,7 +84,8 @@ void gnutls_global_set_log_function(gnutls_log_func log_func)
* Use a log level over 10 to enable all debugging options.
*
**/
void gnutls_global_set_log_level(int level)
void
gnutls_global_set_log_level (int level)
{
_gnutls_log_level = level;
}
@@ -83,21 +94,20 @@ void gnutls_global_set_log_level(int level)
/* default logging function */
static void
dlog (int level, const char *str)
{
fputs (str, stderr);
}
{
fputs (str, stderr);
}
#endif
extern gnutls_alloc_function gnutls_secure_malloc;
extern gnutls_alloc_function gnutls_malloc;
extern gnutls_free_function gnutls_free;
extern int (*_gnutls_is_secure_memory)(const void *);
extern int (*_gnutls_is_secure_memory) (const void *);
extern gnutls_realloc_function gnutls_realloc;
extern char *(*gnutls_strdup)(const char *);
extern void *(*gnutls_calloc)(size_t,
size_t);
extern char *(*gnutls_strdup) (const char *);
extern void *(*gnutls_calloc) (size_t, size_t);
int _gnutls_is_secure_mem_null(const void *);
int _gnutls_is_secure_mem_null (const void *);
/**
* gnutls_global_set_mem_functions - This function sets the memory allocation functions
@@ -116,13 +126,14 @@ int _gnutls_is_secure_mem_null(const void *);
* This function must be called before gnutls_global_init() is called.
*
**/
void gnutls_global_set_mem_functions(gnutls_alloc_function alloc_func,
gnutls_alloc_function
secure_alloc_func,
gnutls_is_secure_function
is_secure_func,
gnutls_realloc_function realloc_func,
gnutls_free_function free_func)
void
gnutls_global_set_mem_functions (gnutls_alloc_function alloc_func,
gnutls_alloc_function
secure_alloc_func,
gnutls_is_secure_function
is_secure_func,
gnutls_realloc_function realloc_func,
gnutls_free_function free_func)
{
gnutls_secure_malloc = secure_alloc_func;
gnutls_malloc = alloc_func;
@@ -152,10 +163,10 @@ void gnutls_global_set_mem_functions(gnutls_alloc_function alloc_func,
#ifdef DEBUG
static void
_gnutls_gcry_log_handler (void *dummy, int level,
const char *fmt, va_list list)
{
_gnutls_log (fmt, list);
}
const char *fmt, va_list list)
{
_gnutls_log (fmt, list);
}
#endif
static int _gnutls_init = 0;
@@ -190,7 +201,8 @@ static int _gnutls_init = 0;
* memory leak is also an option.
*
**/
int gnutls_global_init(void)
int
gnutls_global_init (void)
{
int result = 0;
int res;
@@ -200,41 +212,62 @@ int gnutls_global_init(void)
return;
#if HAVE_WINSOCK
{
WORD requested;
WSADATA data;
int err;
{
WORD requested;
WSADATA data;
int err;
requested = MAKEWORD (1, 1);
err = WSAStartup (requested, &data);
if (err != 0)
{
_gnutls_debug_log ("WSAStartup failed: %d.\n", err);
return GNUTLS_E_LIBRARY_VERSION_MISMATCH;
}
requested = MAKEWORD (1, 1);
err = WSAStartup (requested, &data);
if (err != 0)
{
_gnutls_debug_log ("WSAStartup failed: %d.\n", err);
return GNUTLS_E_LIBRARY_VERSION_MISMATCH;
}
if (data.wVersion < requested)
{
_gnutls_debug_log ("WSAStartup version check failed (%d < %d).\n",
data.wVersion, requested);
WSACleanup ();
return GNUTLS_E_LIBRARY_VERSION_MISMATCH;
}
}
if (data.wVersion < requested)
{
_gnutls_debug_log ("WSAStartup version check failed (%d < %d).\n",
data.wVersion, requested);
WSACleanup ();
return GNUTLS_E_LIBRARY_VERSION_MISMATCH;
}
}
#endif
// TODO rm ? bindtextdomain(PACKAGE, LOCALEDIR);
if (gcry_control(GCRYCTL_ANY_INITIALIZATION_P) == 0)
// bindtextdomain("mhd", "./");
if (gcry_control (GCRYCTL_ANY_INITIALIZATION_P) == 0)
{
const char *p;
/* to enable multi-threading this call must precede any other call made to libgcrypt */
gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
/* set p to point at the required version of gcrypt */
p = strchr(MHD_GCRYPT_VERSION, ':');
if (p == NULL)
p = MHD_GCRYPT_VERSION;
else
p++;
/* this call initializes libgcrypt */
if (gcry_check_version(p) == NULL)
{
gnutls_assert();
_gnutls_debug_log("Checking for libgcrypt failed '%s'\n", p);
return GNUTLS_E_INCOMPATIBLE_GCRYPT_LIBRARY;
}
/* for gcrypt in order to be able to allocate memory */
gcry_set_allocation_handler(gnutls_malloc, gnutls_secure_malloc,
_gnutls_is_secure_memory, gnutls_realloc,
gnutls_free);
gcry_set_allocation_handler (gnutls_malloc, gnutls_secure_malloc,
_gnutls_is_secure_memory, gnutls_realloc,
gnutls_free);
/* gcry_control (GCRYCTL_DISABLE_INTERNAL_LOCKING, NULL, 0); */
gcry_control(GCRYCTL_INITIALIZATION_FINISHED, NULL, 0);
gcry_control (GCRYCTL_INITIALIZATION_FINISHED, NULL, 0);
#ifdef DEBUG
/* applications may want to override that, so we only use
@@ -244,7 +277,7 @@ int gnutls_global_init(void)
#endif
}
if (gc_init() != GC_OK)
if (gc_init () != GC_OK)
{
gnutls_assert ();
_gnutls_debug_log ("Initializing crypto backend failed\n");
@@ -267,16 +300,16 @@ int gnutls_global_init(void)
return result;
}
res = asn1_array2tree(gnutls_asn1_tab, &_gnutls_gnutls_asn, NULL);
res = asn1_array2tree (gnutls_asn1_tab, &_gnutls_gnutls_asn, NULL);
if (res != ASN1_SUCCESS)
{
asn1_delete_structure(&_gnutls_pkix1_asn);
result = _gnutls_asn2err(res);
asn1_delete_structure (&_gnutls_pkix1_asn);
result = _gnutls_asn2err (res);
return result;
}
/* Initialize the gcrypt (if used random generator) */
gc_pseudo_random(&c, 1);
gc_pseudo_random (&c, 1);
return result;
}
@@ -291,16 +324,17 @@ int gnutls_global_init(void)
* gnutls_global_init() for more information.
*
**/
void gnutls_global_deinit(void)
void
gnutls_global_deinit (void)
{
if (_gnutls_init == 1)
{
#if HAVE_WINSOCK
WSACleanup ();
#endif
asn1_delete_structure(&_gnutls_gnutls_asn);
asn1_delete_structure(&_gnutls_pkix1_asn);
gc_done();
asn1_delete_structure (&_gnutls_gnutls_asn);
asn1_delete_structure (&_gnutls_pkix1_asn);
gc_done ();
}
_gnutls_init--;
}
@@ -322,8 +356,9 @@ void gnutls_global_deinit(void)
* PULL_FUNC is of the form,
* ssize_t (*gnutls_pull_func)(gnutls_transport_ptr_t, void*, size_t);
**/
void gnutls_transport_set_pull_function(gnutls_session_t session,
gnutls_pull_func pull_func)
void
gnutls_transport_set_pull_function (gnutls_session_t session,
gnutls_pull_func pull_func)
{
session->internals._gnutls_pull_func = pull_func;
}
@@ -342,8 +377,9 @@ void gnutls_transport_set_pull_function(gnutls_session_t session,
* PUSH_FUNC is of the form,
* ssize_t (*gnutls_push_func)(gnutls_transport_ptr_t, const void*, size_t);
**/
void gnutls_transport_set_push_function(gnutls_session_t session,
gnutls_push_func push_func)
void
gnutls_transport_set_push_function (gnutls_session_t session,
gnutls_push_func push_func)
{
session->internals._gnutls_push_func = push_func;
}
@@ -366,9 +402,10 @@ void gnutls_transport_set_push_function(gnutls_session_t session,
* %NULL is passed to this function no check is done and only the
* version string is returned.
**/
const char * gnutls_check_version(const char *req_version)
const char *
gnutls_check_version (const char *req_version)
{
if (!req_version || strverscmp(req_version, VERSION) <= 0)
if (!req_version || strverscmp (req_version, VERSION) <= 0)
return VERSION;
return NULL;
+9 -8
View File
@@ -28,9 +28,9 @@
#include <defines.h>
#include <gnutls.h>
#include <extra.h>
#include <gnutls_mem.h>
#include "gnutls.h"
#include "extra.h"
#include "gnutls_mem.h"
/* FIXME: delete this once opencdk has reentrant keyring functions
*/
@@ -210,7 +210,7 @@ struct gnutls_key_st
*/
void *auth_info;
gnutls_credentials_type_t auth_info_type;
int auth_info_size; /* needed in order to store to db for restoring
int auth_info_size; /* needed in order to store to db for restoring
*/
uint8_t crypt_algo;
@@ -424,7 +424,7 @@ typedef struct
typedef struct
{
gnutls_buffer application_data_buffer; /* holds data to be delivered to application layer */
gnutls_buffer handshake_hash_buffer; /* used to keep the last received handshake
gnutls_buffer handshake_hash_buffer; /* used to keep the last received handshake
* message */
mac_hd_t handshake_mac_handle_sha; /* hash of the handshake messages */
mac_hd_t handshake_mac_handle_md5; /* hash of the handshake messages */
@@ -500,10 +500,12 @@ typedef struct
int expire_time; /* after expire_time seconds this session will expire */
struct mod_auth_st_int *auth_struct; /* used in handshake packets and KX algorithms */
/* TODO rm */
int v2_hello; /* 0 if the client hello is v3+.
* non-zero if we got a v2 hello.
*/
/* keeps the headers of the handshake packet
/* keeps the headers of the handshake packet
*/
handshake_header_buffer_st handshake_header_buffer;
@@ -653,8 +655,7 @@ struct gnutls_session_int
gnutls_key_st key;
};
/* functions
*/
/* functions */
void _gnutls_set_current_version(gnutls_session_t session,
gnutls_protocol_t version);
+3 -45
View File
@@ -32,10 +32,6 @@
#define MAX_ELEMENTS 48
static void break_comma_list (char *etag,
char **broken_etag,
int *elements, int max_elements, char sep);
/**
* gnutls_cipher_set_priority - Sets the priority on the ciphers supported by gnutls.
* @session: is a #gnutls_session_t structure.
@@ -87,7 +83,6 @@ _set_priority (priority_st * st, const int *list)
}
return 0;
}
/**
@@ -215,7 +210,8 @@ gnutls_certificate_type_set_priority (gnutls_session_t session,
}
static const int protocol_priority[] = { GNUTLS_TLS1_1,
GNUTLS_TLS1_0, GNUTLS_SSL3,
GNUTLS_TLS1_0,
GNUTLS_SSL3,
0
};
@@ -336,10 +332,6 @@ int
gnutls_priority_init (gnutls_priority_t * priority_cache,
const char *priorities, const char **err_pos)
{
int broken_list_size, i, j;
char *darg;
int algo;
*priority_cache = gnutls_calloc (1, sizeof (struct gnutls_priority_st));
if (*priority_cache == NULL)
{
@@ -354,8 +346,8 @@ gnutls_priority_init (gnutls_priority_t * priority_cache,
_set_priority (&(*priority_cache)->mac, mac_priority_secure);
_set_priority (&(*priority_cache)->cert_type, cert_type_priority);
_set_priority (&(*priority_cache)->compression, comp_priority);
(*priority_cache)->no_padding = 0;
(*priority_cache)->no_padding = 0;
return 0;
}
@@ -412,40 +404,6 @@ gnutls_priority_set_direct (gnutls_session_t session,
return 0;
}
/* Breaks a list of "xxx", "yyy", to a character array, of
* MAX_COMMA_SEP_ELEMENTS size; Note that the given string is modified.
*/
static void
break_comma_list (char *etag,
char **broken_etag,
int *elements, int max_elements, char sep)
{
char *p = etag;
if (sep == 0)
sep = ',';
*elements = 0;
do
{
broken_etag[*elements] = p;
(*elements)++;
p = strchr (p, sep);
if (p)
{
*p = 0;
p++; /* move to next entry and skip white
* space.
*/
while (*p == ' ')
p++;
}
}
while (p != NULL && *elements < max_elements);
}
/**
* gnutls_set_default_priority - Sets some default priority on the cipher suites supported by gnutls.
* @session: is a #gnutls_session_t structure.
+1 -16
View File
@@ -49,21 +49,6 @@ static int unpack_certificate_auth_info (gnutls_session_t,
const gnutls_datum_t *
packed_session);
static int unpack_srp_auth_info (gnutls_session_t session,
const gnutls_datum_t * packed_session);
static int pack_srp_auth_info (gnutls_session_t session,
gnutls_datum_t * packed_session);
static int unpack_psk_auth_info (gnutls_session_t session,
const gnutls_datum_t * packed_session);
static int pack_psk_auth_info (gnutls_session_t session,
gnutls_datum_t * packed_session);
static int unpack_anon_auth_info (gnutls_session_t session,
const gnutls_datum_t * packed_session);
static int pack_anon_auth_info (gnutls_session_t session,
gnutls_datum_t * packed_session);
static int unpack_security_parameters (gnutls_session_t session,
const gnutls_datum_t * packed_session);
static int pack_security_parameters (gnutls_session_t session,
@@ -230,7 +215,7 @@ _gnutls_session_unpack (gnutls_session_t session,
}
/* Format:
/* Format:
* 1 byte the credentials type
* 4 bytes the size of the whole structure
* DH stuff