lib: Add global config namespace
[strongswan.git] / scripts / tls_test.c
1 /*
2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <unistd.h>
17 #include <stdio.h>
18 #include <sys/types.h>
19 #include <sys/socket.h>
20 #include <getopt.h>
21 #include <errno.h>
22 #include <string.h>
23
24 #include <library.h>
25 #include <utils/debug.h>
26 #include <tls_socket.h>
27 #include <networking/host.h>
28 #include <credentials/sets/mem_cred.h>
29
30 /**
31 * Print usage information
32 */
33 static void usage(FILE *out, char *cmd)
34 {
35 fprintf(out, "usage:\n");
36 fprintf(out, " %s --connect <address> --port <port> [--key <key] [--cert <file>]+ [--times <n>]\n", cmd);
37 fprintf(out, " %s --listen <address> --port <port> --key <key> [--cert <file>]+ [--times <n>]\n", cmd);
38 }
39
40 /**
41 * Check, as client, if we have a client certificate with private key
42 */
43 static identification_t *find_client_id()
44 {
45 identification_t *client = NULL, *keyid;
46 enumerator_t *enumerator;
47 certificate_t *cert;
48 public_key_t *pubkey;
49 private_key_t *privkey;
50 chunk_t chunk;
51
52 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
53 CERT_X509, KEY_ANY, NULL, FALSE);
54 while (enumerator->enumerate(enumerator, &cert))
55 {
56 pubkey = cert->get_public_key(cert);
57 if (pubkey)
58 {
59 if (pubkey->get_fingerprint(pubkey, KEYID_PUBKEY_SHA1, &chunk))
60 {
61 keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
62 privkey = lib->credmgr->get_private(lib->credmgr,
63 pubkey->get_type(pubkey), keyid, NULL);
64 keyid->destroy(keyid);
65 if (privkey)
66 {
67 client = cert->get_subject(cert);
68 client = client->clone(client);
69 privkey->destroy(privkey);
70 }
71 }
72 pubkey->destroy(pubkey);
73 }
74 if (client)
75 {
76 break;
77 }
78 }
79 enumerator->destroy(enumerator);
80
81 return client;
82 }
83
84 /**
85 * Client routine
86 */
87 static int run_client(host_t *host, identification_t *server,
88 identification_t *client, int times, tls_cache_t *cache)
89 {
90 tls_socket_t *tls;
91 int fd, res;
92
93 while (times == -1 || times-- > 0)
94 {
95 fd = socket(AF_INET, SOCK_STREAM, 0);
96 if (fd == -1)
97 {
98 DBG1(DBG_TLS, "opening socket failed: %s", strerror(errno));
99 return 1;
100 }
101 if (connect(fd, host->get_sockaddr(host),
102 *host->get_sockaddr_len(host)) == -1)
103 {
104 DBG1(DBG_TLS, "connecting to %#H failed: %s", host, strerror(errno));
105 close(fd);
106 return 1;
107 }
108 tls = tls_socket_create(FALSE, server, client, fd, cache);
109 if (!tls)
110 {
111 close(fd);
112 return 1;
113 }
114 res = tls->splice(tls, 0, 1) ? 0 : 1;
115 tls->destroy(tls);
116 close(fd);
117 if (res)
118 {
119 break;
120 }
121 }
122 return res;
123 }
124
125 /**
126 * Server routine
127 */
128 static int serve(host_t *host, identification_t *server,
129 int times, tls_cache_t *cache)
130 {
131 tls_socket_t *tls;
132 int fd, cfd;
133
134 fd = socket(AF_INET, SOCK_STREAM, 0);
135 if (fd == -1)
136 {
137 DBG1(DBG_TLS, "opening socket failed: %s", strerror(errno));
138 return 1;
139 }
140 if (bind(fd, host->get_sockaddr(host),
141 *host->get_sockaddr_len(host)) == -1)
142 {
143 DBG1(DBG_TLS, "binding to %#H failed: %s", host, strerror(errno));
144 close(fd);
145 return 1;
146 }
147 if (listen(fd, 1) == -1)
148 {
149 DBG1(DBG_TLS, "listen to %#H failed: %m", host, strerror(errno));
150 close(fd);
151 return 1;
152 }
153
154 while (times == -1 || times-- > 0)
155 {
156 cfd = accept(fd, host->get_sockaddr(host), host->get_sockaddr_len(host));
157 if (cfd == -1)
158 {
159 DBG1(DBG_TLS, "accept failed: %s", strerror(errno));
160 close(fd);
161 return 1;
162 }
163 DBG1(DBG_TLS, "%#H connected", host);
164
165 tls = tls_socket_create(TRUE, server, NULL, cfd, cache);
166 if (!tls)
167 {
168 close(fd);
169 return 1;
170 }
171 tls->splice(tls, 0, 1);
172 DBG1(DBG_TLS, "%#H disconnected", host);
173 tls->destroy(tls);
174 }
175 close(fd);
176
177 return 0;
178 }
179
180 /**
181 * In-Memory credential set
182 */
183 static mem_cred_t *creds;
184
185 /**
186 * Load certificate from file
187 */
188 static bool load_certificate(char *filename)
189 {
190 certificate_t *cert;
191
192 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
193 BUILD_FROM_FILE, filename, BUILD_END);
194 if (!cert)
195 {
196 DBG1(DBG_TLS, "loading certificate from '%s' failed", filename);
197 return FALSE;
198 }
199 creds->add_cert(creds, TRUE, cert);
200 return TRUE;
201 }
202
203 /**
204 * Load private key from file
205 */
206 static bool load_key(char *filename)
207 {
208 private_key_t *key;
209
210 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
211 BUILD_FROM_FILE, filename, BUILD_END);
212 if (!key)
213 {
214 DBG1(DBG_TLS, "loading key from '%s' failed", filename);
215 return FALSE;
216 }
217 creds->add_key(creds, key);
218 return TRUE;
219 }
220
221 /**
222 * TLS debug level
223 */
224 static level_t tls_level = 1;
225
226 static void dbg_tls(debug_t group, level_t level, char *fmt, ...)
227 {
228 if ((group == DBG_TLS && level <= tls_level) || level <= 1)
229 {
230 va_list args;
231
232 va_start(args, fmt);
233 vfprintf(stderr, fmt, args);
234 fprintf(stderr, "\n");
235 va_end(args);
236 }
237 }
238
239 /**
240 * Cleanup
241 */
242 static void cleanup()
243 {
244 lib->credmgr->remove_set(lib->credmgr, &creds->set);
245 creds->destroy(creds);
246 library_deinit();
247 }
248
249 /**
250 * Initialize library
251 */
252 static void init()
253 {
254 library_init(NULL, "tls_test");
255
256 dbg = dbg_tls;
257
258 lib->plugins->load(lib->plugins, PLUGINS);
259
260 creds = mem_cred_create();
261 lib->credmgr->add_set(lib->credmgr, &creds->set);
262
263 atexit(cleanup);
264 }
265
266 int main(int argc, char *argv[])
267 {
268 char *address = NULL;
269 bool listen = FALSE;
270 int port = 0, times = -1, res;
271 identification_t *server, *client;
272 tls_cache_t *cache;
273 host_t *host;
274
275 init();
276
277 while (TRUE)
278 {
279 struct option long_opts[] = {
280 {"help", no_argument, NULL, 'h' },
281 {"connect", required_argument, NULL, 'c' },
282 {"listen", required_argument, NULL, 'l' },
283 {"port", required_argument, NULL, 'p' },
284 {"cert", required_argument, NULL, 'x' },
285 {"key", required_argument, NULL, 'k' },
286 {"times", required_argument, NULL, 't' },
287 {"debug", required_argument, NULL, 'd' },
288 {0,0,0,0 }
289 };
290 switch (getopt_long(argc, argv, "", long_opts, NULL))
291 {
292 case EOF:
293 break;
294 case 'h':
295 usage(stdout, argv[0]);
296 return 0;
297 case 'x':
298 if (!load_certificate(optarg))
299 {
300 return 1;
301 }
302 continue;
303 case 'k':
304 if (!load_key(optarg))
305 {
306 return 1;
307 }
308 continue;
309 case 'l':
310 listen = TRUE;
311 /* fall */
312 case 'c':
313 if (address)
314 {
315 usage(stderr, argv[0]);
316 return 1;
317 }
318 address = optarg;
319 continue;
320 case 'p':
321 port = atoi(optarg);
322 continue;
323 case 't':
324 times = atoi(optarg);
325 continue;
326 case 'd':
327 tls_level = atoi(optarg);
328 continue;
329 default:
330 usage(stderr, argv[0]);
331 return 1;
332 }
333 break;
334 }
335 if (!port || !address)
336 {
337 usage(stderr, argv[0]);
338 return 1;
339 }
340 host = host_create_from_dns(address, 0, port);
341 if (!host)
342 {
343 DBG1(DBG_TLS, "resolving hostname %s failed", address);
344 return 1;
345 }
346 server = identification_create_from_string(address);
347 cache = tls_cache_create(100, 30);
348 if (listen)
349 {
350 res = serve(host, server, times, cache);
351 }
352 else
353 {
354 client = find_client_id();
355 res = run_client(host, server, client, times, cache);
356 DESTROY_IF(client);
357 }
358 cache->destroy(cache);
359 host->destroy(host);
360 server->destroy(server);
361 return res;
362 }